Analysis
- user interaction
yes - max time kernel
186s - max time network
189s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 23:41
General
- Target XWorm V7.4.exe
- Size 22.1MB
- Sample260730-3pgbcshd69
- SHA256 98f0a3fe8cedb340ace6bd1dcb57360d75e52b63074fb39cad09811da8ff4378
Malware Config
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Checks processor information in registry 2 TTPs 16 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 43 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3572 -prefsLen 27274 -prefMapHandle 3576 -prefMapSize 270331 -jsInitHandle 3580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3588 -initialChannelId {d3d2c617-e642-4a9c-abc1-89fc6e14b2da} -parentPid 3076 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3076" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab1⤵
- Checks processor information in registry
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3736 -prefsLen 27274 -prefMapHandle 3740 -prefMapSize 270331 -ipcHandle 3756 -initialChannelId {45873a0f-0840-4303-ab24-042f857844ef} -parentPid 3076 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3076" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd1⤵
-
C:\Users\Admin\AppData\Local\Temp\XWorm V7.4.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V7.4.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4192 -prefsLen 34827 -prefMapHandle 4196 -prefMapSize 270331 -jsInitHandle 4200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3556 -initialChannelId {c5793455-4fd5-46c6-904e-1c308a84fa62} -parentPid 3076 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3076" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab1⤵
- Checks processor information in registry
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4980 -prefsLen 35089 -prefMapHandle 4984 -prefMapSize 270331 -ipcHandle 5000 -initialChannelId {cf0ca3ee-5d21-4861-a9eb-90968b8f3684} -parentPid 3076 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3076" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility1⤵
- Checks processor information in registry
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4540 -prefsLen 33031 -prefMapHandle 5156 -prefMapSize 270331 -jsInitHandle 2692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4868 -initialChannelId {d8bdcb99-382c-4cb7-98e2-577b0c5cd859} -parentPid 3076 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3076" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab1⤵
- Checks processor information in registry
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4376 -prefsLen 33031 -prefMapHandle 3532 -prefMapSize 270331 -jsInitHandle 2416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4816 -initialChannelId {37a1018f-a82e-450a-9f44-4f2c8aafa7f9} -parentPid 3076 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3076" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab1⤵
- Checks processor information in registry
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5632 -prefsLen 33031 -prefMapHandle 5628 -prefMapSize 270331 -jsInitHandle 5624 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5776 -initialChannelId {e8b06ff5-1e68-4cf5-95de-aa8a86a2e685} -parentPid 3076 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3076" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab1⤵
- Checks processor information in registry
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4808 -prefsLen 33031 -prefMapHandle 5900 -prefMapSize 270331 -jsInitHandle 2900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2832 -initialChannelId {92769d03-71dd-41ff-8e00-c7c049b21dea} -parentPid 3076 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3076" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab1⤵
- Checks processor information in registry
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5192 -prefsLen 36845 -prefMapHandle 5180 -prefMapSize 270331 -jsInitHandle 2472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6520 -initialChannelId {eb16bfe5-dd71-468a-a6e4-c686064c56b2} -parentPid 3076 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3076" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab1⤵
- Checks processor information in registry
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\thanks for buy! XWorm 7.4\thanks for buy! XWorm 7.4\XWorm V7.4.exe"C:\Users\Admin\Downloads\thanks for buy! XWorm 7.4\thanks for buy! XWorm 7.4\XWorm V7.4.exe"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\znyrdims\znyrdims.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC7B1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5A2C675C439C42C7ABA08E9CD6D6D93F.TMP"3⤵
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004F41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESC7B1.tmp
vbc5A2C675C439C42C7ABA08E9CD6D6D93F.TMP
znyrdims.0.vb
znyrdims.cmdline
memory/2948-24-0x00007FF827A00000-0x00007FF8283A4000-memory.dmp
memory/2948-23-0x00007FF827A00000-0x00007FF8283A4000-memory.dmp
memory/2948-28-0x000000002E7F0000-0x000000002E958000-memory.dmp
memory/2948-26-0x000000001FF70000-0x000000001FFAC000-memory.dmp
memory/2948-25-0x0000000020040000-0x0000000020166000-memory.dmp
memory/2948-22-0x00007FF827A00000-0x00007FF8283A4000-memory.dmp
memory/2948-21-0x000000001F640000-0x000000001F652000-memory.dmp
memory/2948-20-0x000000001F710000-0x000000001F904000-memory.dmp
memory/2948-13-0x00007FF827A00000-0x00007FF8283A4000-memory.dmp
memory/2948-12-0x00007FF827A00000-0x00007FF8283A4000-memory.dmp
memory/2948-14-0x00007FF827A00000-0x00007FF8283A4000-memory.dmp
memory/2948-15-0x00007FF827A00000-0x00007FF8283A4000-memory.dmp
memory/2948-16-0x00007FF827A00000-0x00007FF8283A4000-memory.dmp
memory/2948-17-0x00007FF827A00000-0x00007FF8283A4000-memory.dmp
memory/2948-18-0x00007FF827A00000-0x00007FF8283A4000-memory.dmp
memory/2948-19-0x00007FF827A00000-0x00007FF8283A4000-memory.dmp
memory/4708-11-0x00007FF829790000-0x00007FF82A134000-memory.dmp
memory/4708-10-0x000000001CC00000-0x000000001DF2C000-memory.dmp
memory/4708-9-0x00007FF829790000-0x00007FF82A134000-memory.dmp
memory/4708-5-0x00007FF829790000-0x00007FF82A134000-memory.dmp
memory/4708-0-0x00007FF82991F000-0x00007FF829920000-memory.dmp
memory/4708-8-0x00007FF829790000-0x00007FF82A134000-memory.dmp
memory/4708-7-0x00007FF829790000-0x00007FF82A134000-memory.dmp
memory/4708-6-0x00007FF829790000-0x00007FF82A134000-memory.dmp
memory/4708-4-0x00007FF829790000-0x00007FF82A134000-memory.dmp
memory/4708-3-0x00007FF829790000-0x00007FF82A134000-memory.dmp
memory/4708-2-0x0000000000850000-0x0000000001E6C000-memory.dmp
memory/4708-1-0x00007FF829790000-0x00007FF82A134000-memory.dmp