Analysis
- user interaction
yes - max time kernel
2s - max time network
14s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 03:21
General
- Target XWormClient.exe
- Size 128KB
- Sample260731-dwn74sshkd
- SHA256 7c46d77f1e521efd535dbf51a9190c85f0f2726cc1671f53633e613970c8daf1
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWormClient.exe"C:\Users\Admin\AppData\Local\Temp\XWormClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWormClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3108-19-0x00007FFECA380000-0x00007FFECAD24000-memory.dmp
memory/3108-20-0x00007FFECA380000-0x00007FFECAD24000-memory.dmp
memory/3108-26-0x00007FFECA380000-0x00007FFECAD24000-memory.dmp
memory/3108-24-0x00007FFECA380000-0x00007FFECAD24000-memory.dmp
memory/3108-23-0x00007FFECA380000-0x00007FFECAD24000-memory.dmp
memory/3108-22-0x00007FFECA380000-0x00007FFECAD24000-memory.dmp
memory/3108-21-0x00007FFECA380000-0x00007FFECAD24000-memory.dmp
memory/3108-9-0x000001CA35830000-0x000001CA35852000-memory.dmp
memory/3108-13-0x000001CA4DFF0000-0x000001CA4E0A2000-memory.dmp
memory/3108-16-0x00007FFECA380000-0x00007FFECAD24000-memory.dmp
memory/3108-14-0x00007FFECA380000-0x00007FFECAD24000-memory.dmp
memory/3108-15-0x000001CA4DD60000-0x000001CA4DD6A000-memory.dmp
memory/3108-12-0x000001CA4DD40000-0x000001CA4DD5E000-memory.dmp
memory/3108-17-0x00007FFECA380000-0x00007FFECAD24000-memory.dmp
memory/3108-18-0x00007FFECA380000-0x00007FFECAD24000-memory.dmp
memory/4292-0-0x00007FFECA50F000-0x00007FFECA510000-memory.dmp
memory/4292-1-0x00000000000B0000-0x00000000000D6000-memory.dmp
memory/4292-6-0x00007FFECA380000-0x00007FFECAD24000-memory.dmp
memory/4292-5-0x00007FFECA380000-0x00007FFECAD24000-memory.dmp
memory/4292-4-0x00007FFECA380000-0x00007FFECAD24000-memory.dmp
memory/4292-3-0x00007FFECA380000-0x00007FFECAD24000-memory.dmp
memory/4292-2-0x00007FFECA380000-0x00007FFECAD24000-memory.dmp