Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 23:22
General
- Target 67851f424ccbe66c1d79bdb2c7dac0bcb2f833d6225014ddbf143974d5d96766.exe
- Size 896KB
- Sample260731-3c151asgpf
- SHA256 67851f424ccbe66c1d79bdb2c7dac0bcb2f833d6225014ddbf143974d5d96766
Malware Config
Extracted
-
xworm
-
5.0
-
151.244.232.26:443
-
Uwzmx31jE3HrW27j
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 49 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\67851f424ccbe66c1d79bdb2c7dac0bcb2f833d6225014ddbf143974d5d96766.exe"C:\Users\Admin\AppData\Local\Temp\67851f424ccbe66c1d79bdb2c7dac0bcb2f833d6225014ddbf143974d5d96766.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\67851f424ccbe66c1d79bdb2c7dac0bcb2f833d6225014ddbf143974d5d96766.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\2epvgu2iog2.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\uNvfhms.exe"C:\Users\Admin\AppData\Roaming\uNvfhms.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uNvfhms.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
2epvgu2iog2.ps1
__PSScriptPolicyTest_xolcehxj.wmw.ps1
uNvfhms.exe
memory/3296-37-0x0000000075870000-0x00000000758BC000-memory.dmp
memory/3296-31-0x0000000006460000-0x00000000064AC000-memory.dmp
memory/3296-48-0x0000000074FB0000-0x000000007576C000-memory.dmp
memory/3296-45-0x00000000079B0000-0x0000000007A46000-memory.dmp
memory/3296-44-0x0000000005250000-0x000000000525A000-memory.dmp
memory/3296-42-0x0000000007D60000-0x00000000083DC000-memory.dmp
memory/3296-43-0x0000000007720000-0x000000000773A000-memory.dmp
memory/3296-36-0x00000000075A0000-0x00000000075D6000-memory.dmp
memory/3296-41-0x00000000075E0000-0x0000000007683000-memory.dmp
memory/3296-40-0x00000000069C0000-0x00000000069E0000-memory.dmp
memory/3296-14-0x0000000002B70000-0x0000000002BA6000-memory.dmp
memory/3296-16-0x0000000074FB0000-0x000000007576C000-memory.dmp
memory/3296-18-0x0000000074FB0000-0x000000007576C000-memory.dmp
memory/3296-19-0x0000000074FB0000-0x000000007576C000-memory.dmp
memory/3296-17-0x0000000005720000-0x0000000005D6A000-memory.dmp
memory/3296-23-0x0000000005E50000-0x0000000005EB6000-memory.dmp
memory/3296-22-0x0000000005DE0000-0x0000000005E46000-memory.dmp
memory/3296-30-0x0000000006040000-0x000000000605E000-memory.dmp
memory/4560-10-0x0000000074FC2000-0x0000000074FC3000-memory.dmp
memory/4560-12-0x00000000083D0000-0x0000000008472000-memory.dmp
memory/4560-5-0x0000000004FE0000-0x0000000004FF2000-memory.dmp
memory/4560-11-0x0000000074FB0000-0x000000007576C000-memory.dmp
memory/4560-6-0x0000000005100000-0x0000000005122000-memory.dmp
memory/4560-4-0x00000000052B0000-0x000000000560B000-memory.dmp
memory/4560-26-0x0000000074FB0000-0x000000007576C000-memory.dmp
memory/4560-13-0x0000000008510000-0x00000000085AC000-memory.dmp
memory/4560-8-0x0000000074FB0000-0x000000007576C000-memory.dmp
memory/4560-2-0x0000000005620000-0x0000000005BDA000-memory.dmp
memory/4560-3-0x0000000005060000-0x00000000050F2000-memory.dmp
memory/4560-7-0x0000000005160000-0x000000000516A000-memory.dmp
memory/4560-0-0x0000000074FC2000-0x0000000074FC3000-memory.dmp
memory/4560-1-0x00000000003E0000-0x00000000004C6000-memory.dmp
memory/4560-9-0x0000000007F20000-0x0000000007F3E000-memory.dmp
memory/4652-54-0x00000000065B0000-0x000000000690B000-memory.dmp
memory/4652-56-0x0000000006DE0000-0x0000000006E2C000-memory.dmp
memory/4652-57-0x00000000726D0000-0x000000007271C000-memory.dmp
memory/4652-60-0x0000000007D30000-0x0000000007DD3000-memory.dmp
memory/5052-29-0x000001EF05BD0000-0x000001EF05BF2000-memory.dmp
memory/5920-21-0x0000000074FB0000-0x000000007576C000-memory.dmp
memory/5920-33-0x0000000074FB0000-0x000000007576C000-memory.dmp
memory/5920-20-0x0000000000400000-0x000000000040E000-memory.dmp
memory/5920-49-0x0000000074FB0000-0x000000007576C000-memory.dmp
memory/5920-50-0x0000000074FB0000-0x000000007576C000-memory.dmp