Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
31/07/2026, 17:28
General
- Target 58928c973bd77cabdf6bca123c77f7915c3f335f42e364893c2673d954d22d93.exe
- Size 842KB
- Sample260731-v2byeaea66
- SHA256 58928c973bd77cabdf6bca123c77f7915c3f335f42e364893c2673d954d22d93
Malware Config
Extracted
-
xworm
-
5.0
-
194.116.236.216:5005
-
kDUCuY6YhsbNxpcA
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\58928c973bd77cabdf6bca123c77f7915c3f335f42e364893c2673d954d22d93.exe"C:\Users\Admin\AppData\Local\Temp\58928c973bd77cabdf6bca123c77f7915c3f335f42e364893c2673d954d22d93.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\58928c973bd77cabdf6bca123c77f7915c3f335f42e364893c2673d954d22d93.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\58928c973bd77cabdf6bca123c77f7915c3f335f42e364893c2673d954d22d93.exe"C:\Users\Admin\AppData\Local\Temp\58928c973bd77cabdf6bca123c77f7915c3f335f42e364893c2673d954d22d93.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\58928c973bd77cabdf6bca123c77f7915c3f335f42e364893c2673d954d22d93.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_a35963bd80b7489791eae6d15e5480e0.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6DA4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5EE9C5E035BD4F73A15FE474517B2B32.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\58928c973bd77cabdf6bca123c77f7915c3f335f42e364893c2673d954d22d93.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_aab53f21b57d41948356f80192555aa2.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES85D0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEFDD01B29B024DEEB730FDC3D0544AC0.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES6DA4.tmp
RES85D0.tmp
__PSScriptPolicyTest_tc2b5anz.5di.ps1
CSC5EE9C5E035BD4F73A15FE474517B2B32.TMP
guardian_src_a35963bd80b7489791eae6d15e5480e0.cs
memory/2192-42-0x00000000070F0000-0x0000000007193000-memory.dmp
memory/2192-25-0x0000000005AD0000-0x0000000005E24000-memory.dmp
memory/2192-44-0x0000000007430000-0x000000000744A000-memory.dmp
memory/2192-45-0x00000000074A0000-0x00000000074AA000-memory.dmp
memory/2192-51-0x0000000007750000-0x0000000007758000-memory.dmp
memory/2192-11-0x0000000004C00000-0x0000000004C10000-memory.dmp
memory/2192-12-0x0000000004B30000-0x0000000004B66000-memory.dmp
memory/2192-13-0x0000000004C00000-0x0000000004C10000-memory.dmp
memory/2192-14-0x0000000005240000-0x0000000005868000-memory.dmp
memory/2192-15-0x0000000005170000-0x0000000005192000-memory.dmp
memory/2192-16-0x0000000005870000-0x00000000058D6000-memory.dmp
memory/2192-17-0x00000000058E0000-0x0000000005946000-memory.dmp
memory/2192-50-0x0000000007770000-0x000000000778A000-memory.dmp
memory/2192-43-0x0000000007A70000-0x00000000080EA000-memory.dmp
memory/2192-26-0x00000000060E0000-0x00000000060FE000-memory.dmp
memory/2192-27-0x0000000006180000-0x00000000061CC000-memory.dmp
memory/2192-49-0x0000000007670000-0x0000000007684000-memory.dmp
memory/2192-29-0x000000007FCF0000-0x000000007FD00000-memory.dmp
memory/2192-31-0x0000000070400000-0x000000007044C000-memory.dmp
memory/2192-30-0x00000000070A0000-0x00000000070D2000-memory.dmp
memory/2192-41-0x0000000007080000-0x000000000709E000-memory.dmp
memory/2192-40-0x0000000004C00000-0x0000000004C10000-memory.dmp
memory/2192-39-0x0000000004C00000-0x0000000004C10000-memory.dmp
memory/2192-48-0x0000000007660000-0x000000000766E000-memory.dmp
memory/2192-47-0x0000000007630000-0x0000000007641000-memory.dmp
memory/2192-46-0x00000000076B0000-0x0000000007746000-memory.dmp
memory/3168-56-0x0000000006B00000-0x0000000006B7C000-memory.dmp
memory/3168-83-0x00000000088F0000-0x000000000893A000-memory.dmp
memory/3168-95-0x000000000C1B0000-0x000000000C1C4000-memory.dmp
memory/3168-94-0x000000000BCC0000-0x000000000BCD1000-memory.dmp
memory/3168-28-0x00000000030D0000-0x00000000030E0000-memory.dmp
memory/3168-93-0x000000000BB90000-0x000000000BC33000-memory.dmp
memory/3168-9-0x0000000000400000-0x000000000040E000-memory.dmp
memory/3168-54-0x00000000030D0000-0x00000000030E0000-memory.dmp
memory/3168-55-0x000000000F4E0000-0x000000001031C000-memory.dmp
memory/3168-85-0x000000000A690000-0x000000000A6DC000-memory.dmp
memory/3168-58-0x0000000006CE0000-0x0000000006CE6000-memory.dmp
memory/3168-57-0x0000000006C90000-0x0000000006CC4000-memory.dmp
memory/3168-84-0x0000000009080000-0x00000000093D4000-memory.dmp
memory/3168-82-0x0000000008790000-0x00000000087B2000-memory.dmp
memory/3168-67-0x0000000006B90000-0x0000000006B98000-memory.dmp
memory/3168-66-0x0000000006C30000-0x0000000006C60000-memory.dmp
memory/4756-2-0x0000000004DF0000-0x0000000004E82000-memory.dmp
memory/4756-1-0x00000000053A0000-0x0000000005944000-memory.dmp
memory/4756-7-0x0000000004D00000-0x0000000004D10000-memory.dmp
memory/4756-3-0x0000000004D00000-0x0000000004D10000-memory.dmp
memory/4756-4-0x0000000004DB0000-0x0000000004DBA000-memory.dmp
memory/4756-8-0x0000000006050000-0x00000000060F6000-memory.dmp
memory/4756-5-0x0000000005020000-0x00000000050BC000-memory.dmp
memory/4756-0-0x00000000002E0000-0x00000000003B8000-memory.dmp
memory/4756-6-0x0000000005210000-0x0000000005232000-memory.dmp