Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 23:17
General
- Target 830fdb947aa60a491d22c8f698e9531fdd651f76cecafd3350d408442db4c59e.exe
- Size 465KB
- Sample260808-29sz8aem91
- SHA256 830fdb947aa60a491d22c8f698e9531fdd651f76cecafd3350d408442db4c59e
Malware Config
Extracted
-
xworm
-
XWorm V5.6
-
ov1j9h5mhk.localto.net:4811
-
Install_directory
%Public%
-
install_file
USB.exe
Extracted
-
44caliber
-
https://discord.com/api/webhooks/1529155980405899375/jgpGJH-0z5WL1zBCJQo_q9gLgK1B8QLLkvo_AwKcMUvUKICyfFHEAc6bX364j0YsfP7s
Signatures
- Family: 44Caliber
An open source infostealer written in C#.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 4 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\830fdb947aa60a491d22c8f698e9531fdd651f76cecafd3350d408442db4c59e.exe"C:\Users\Admin\AppData\Local\Temp\830fdb947aa60a491d22c8f698e9531fdd651f76cecafd3350d408442db4c59e.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XXXXXXXXXXXXXXX.exe"C:\Users\Admin\AppData\Local\Temp\XXXXXXXXXXXXXXX.exe"2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XXXXXXXXXXXXXXX.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XXXXXXXXXXXXXXX.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\svchost'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Insidious.exe"C:\Users\Admin\AppData\Local\Temp\Insidious.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Public\svchost"C:\Users\Public\svchost"1⤵
- Executes dropped EXE
-
C:\Users\Public\svchost"C:\Users\Public\svchost"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
Insidious.exe
XXXXXXXXXXXXXXX.exe
__PSScriptPolicyTest_o1u4x2mf.nra.ps1
Process.txt
Process.txt
memory/480-32-0x0000028C2FDF0000-0x0000028C2FE12000-memory.dmp
memory/480-37-0x0000028C48200000-0x0000028C4820A000-memory.dmp
memory/480-36-0x0000028C484C0000-0x0000028C48572000-memory.dmp
memory/480-35-0x0000028C481E0000-0x0000028C481FE000-memory.dmp
memory/3588-28-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/3588-29-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/3588-25-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/3588-23-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/3588-18-0x00000000005E0000-0x0000000000612000-memory.dmp
memory/3588-15-0x00007FF9BD71F000-0x00007FF9BD720000-memory.dmp
memory/4488-27-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4488-26-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4488-22-0x000001A47BE80000-0x000001A47BECA000-memory.dmp
memory/4488-151-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/5140-24-0x0000000000400000-0x000000000047C000-memory.dmp