Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 09:19
General
- Target 46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe
- Size 801KB
- Sample260729-lafmvadj91
- SHA256 46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4
Malware Config
Extracted
-
xworm
-
5.0
-
carrenzaalwarex.ddns.net:7004
-
2B7HLE7nXIzGq07o
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious use of AdjustPrivilegeToken 49 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe"C:\Users\Admin\AppData\Local\Temp\46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\cftl5hlembn.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\rwjJOH.exe"C:\Users\Admin\AppData\Roaming\rwjJOH.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rwjJOH.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_fstyllul.10u.ps1
cftl5hlembn.ps1
rwjJOH.exe
memory/1400-4-0x0000000005410000-0x00000000054A2000-memory.dmp
memory/1400-5-0x00000000053E0000-0x00000000053EA000-memory.dmp
memory/1400-6-0x00000000743F0000-0x0000000074BAC000-memory.dmp
memory/1400-7-0x0000000005590000-0x000000000559C000-memory.dmp
memory/1400-8-0x0000000074402000-0x0000000074403000-memory.dmp
memory/1400-9-0x00000000743F0000-0x0000000074BAC000-memory.dmp
memory/1400-10-0x0000000007930000-0x00000000079CC000-memory.dmp
memory/1400-11-0x00000000079D0000-0x0000000007A7E000-memory.dmp
memory/1400-3-0x0000000005930000-0x0000000005EEA000-memory.dmp
memory/1400-0-0x0000000074402000-0x0000000074403000-memory.dmp
memory/1400-2-0x0000000004FA0000-0x00000000052FB000-memory.dmp
memory/1400-24-0x00000000743F0000-0x0000000074BAC000-memory.dmp
memory/1400-1-0x0000000000430000-0x00000000004FE000-memory.dmp
memory/3004-63-0x00000000084E0000-0x00000000086A2000-memory.dmp
memory/3004-48-0x00000000743F0000-0x0000000074BAC000-memory.dmp
memory/3004-18-0x00000000743F0000-0x0000000074BAC000-memory.dmp
memory/3004-17-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3004-49-0x00000000743F0000-0x0000000074BAC000-memory.dmp
memory/3004-61-0x0000000007920000-0x0000000007A86000-memory.dmp
memory/3004-62-0x0000000007640000-0x000000000764A000-memory.dmp
memory/3004-31-0x00000000743F0000-0x0000000074BAC000-memory.dmp
memory/3556-27-0x000001B8E42B0000-0x000001B8E42D2000-memory.dmp
memory/5008-29-0x0000000005B90000-0x0000000005BDC000-memory.dmp
memory/5008-44-0x00000000743F0000-0x0000000074BAC000-memory.dmp
memory/5008-35-0x0000000074CD0000-0x0000000074D1C000-memory.dmp
memory/5008-38-0x0000000006020000-0x0000000006040000-memory.dmp
memory/5008-39-0x0000000006C60000-0x0000000006D03000-memory.dmp
memory/5008-20-0x0000000005380000-0x00000000053E6000-memory.dmp
memory/5008-34-0x0000000006C10000-0x0000000006C46000-memory.dmp
memory/5008-40-0x0000000007400000-0x0000000007A7C000-memory.dmp
memory/5008-41-0x0000000006DC0000-0x0000000006DDA000-memory.dmp
memory/5008-42-0x0000000006E30000-0x0000000006E3A000-memory.dmp
memory/5008-43-0x0000000007050000-0x00000000070E6000-memory.dmp
memory/5008-28-0x0000000005A50000-0x0000000005A6E000-memory.dmp
memory/5008-21-0x00000000053F0000-0x0000000005456000-memory.dmp
memory/5008-47-0x00000000743F0000-0x0000000074BAC000-memory.dmp
memory/5008-19-0x00000000052E0000-0x0000000005302000-memory.dmp
memory/5008-16-0x0000000004C90000-0x00000000052DA000-memory.dmp
memory/5008-13-0x0000000004580000-0x00000000045B6000-memory.dmp
memory/5008-14-0x00000000743F0000-0x0000000074BAC000-memory.dmp
memory/5008-15-0x00000000743F0000-0x0000000074BAC000-memory.dmp
memory/5604-59-0x0000000007550000-0x00000000075F3000-memory.dmp
memory/5604-56-0x0000000072BE0000-0x0000000072C2C000-memory.dmp
memory/5604-55-0x0000000006340000-0x000000000638C000-memory.dmp
memory/5604-53-0x0000000005D90000-0x00000000060EB000-memory.dmp