Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 09:17
General
- Target 1cff0c1c7c34dadda81cfadab09200e7b26e2f47fec06e699d33cca52871f88d.exe
- Size 76KB
- Sample260804-k9drvsssez
- SHA256 1cff0c1c7c34dadda81cfadab09200e7b26e2f47fec06e699d33cca52871f88d
Score
10/10
Malware Config
Extracted
Family
-
xworm
C2
-
https://jquery-api.neocities.org/hi.txt:666666666
Attributes
-
Install_directory
%ProgramData%
-
install_file
$77windriver.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cff0c1c7c34dadda81cfadab09200e7b26e2f47fec06e699d33cca52871f88d.exe"C:\Users\Admin\AppData\Local\Temp\1cff0c1c7c34dadda81cfadab09200e7b26e2f47fec06e699d33cca52871f88d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2536-0-0x00007FFC72F2F000-0x00007FFC72F30000-memory.dmp
memory/2536-1-0x0000000000880000-0x000000000089A000-memory.dmp
memory/2536-2-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/2536-3-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/2536-4-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/2536-5-0x000000001BC30000-0x000000001BD20000-memory.dmp
memory/2536-6-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp