Analysis
- max time kernel
150s - max time network
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 07:18
General
- Target 44b315df4f8f96e390cc5eafe48a17ff6e80276c55b7f5dc21828258d4ac2418.exe
- Size 41.9MB
- Sample260804-h44d8atflf
- SHA256 44b315df4f8f96e390cc5eafe48a17ff6e80276c55b7f5dc21828258d4ac2418
Malware Config
Extracted
-
xworm
-
Install_directory
%ProgramData%
-
install_file
svchost.exe
-
pastebin_url
https://pastebin.com/raw/a2MqR3va
-
telegram
https://api.telegram.org/bot8508842279:AAHqz-g1_P_OZJ7MGXxzhTueSRErSNbWygc/sendMessage?chat_id=5547542407
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\44b315df4f8f96e390cc5eafe48a17ff6e80276c55b7f5dc21828258d4ac2418.exe"C:\Users\Admin\AppData\Local\Temp\44b315df4f8f96e390cc5eafe48a17ff6e80276c55b7f5dc21828258d4ac2418.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\SILENT AIM.exe"C:\ProgramData\SILENT AIM.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SILENT AIM.exe
svchost.exe
memory/1796-31-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/1796-30-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/1796-28-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/1796-24-0x000001C202E50000-0x000001C2057B4000-memory.dmp
memory/3868-26-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/3868-20-0x00000000002A0000-0x00000000002BC000-memory.dmp
memory/3868-22-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/3868-23-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/3868-27-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/3868-29-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/5180-4-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/5180-25-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/5180-0-0x00007FFB799CF000-0x00007FFB799D0000-memory.dmp
memory/5180-3-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/5180-2-0x00000000009C0000-0x00000000033A4000-memory.dmp
memory/5180-1-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp