Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 23:17
General
- Target e9905233078468b1b5b58198695c63bda4d6a3580a67bb5cba33d545896c9da8.exe
- Size 1.7MB
- Sample260808-29tlraen2s
- SHA256 e9905233078468b1b5b58198695c63bda4d6a3580a67bb5cba33d545896c9da8
Malware Config
Extracted
-
xworm
-
XWorm V6.5 by c3lestial.fun
-
0.tcp.ap.ngrok.io:14591
-
0.tcp.ap.ngrok.io:18011
-
jWeNmeWcVkCeKJLn
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 5 IoCs
- Executes dropped EXE 4 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9905233078468b1b5b58198695c63bda4d6a3580a67bb5cba33d545896c9da8.exe"C:\Users\Admin\AppData\Local\Temp\e9905233078468b1b5b58198695c63bda4d6a3580a67bb5cba33d545896c9da8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ytarrake.exe"C:\Users\Admin\AppData\Local\Temp\ytarrake.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MWPriv+_64.exe"C:\Users\Admin\AppData\Local\Temp\MWPriv+_64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MWPriv+_Cheat_x64 (1).exe"C:\Users\Admin\AppData\Local\Temp\MWPriv+_Cheat_x64 (1).exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MWPriv+_Cheat_x64.exe"C:\Users\Admin\AppData\Local\Temp\MWPriv+_Cheat_x64.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MWPriv+_64.exe
MWPriv+_Cheat_x64 (1).exe
MWPriv+_Cheat_x64.exe
ytarrake.exe
memory/1252-46-0x00007FFE27710000-0x00007FFE28148000-memory.dmp
memory/1252-33-0x00007FFE27710000-0x00007FFE28148000-memory.dmp
memory/1252-32-0x00007FFE27A0C000-0x00007FFE27A0D000-memory.dmp
memory/1664-25-0x00007FFE253C0000-0x00007FFE25D64000-memory.dmp
memory/1664-48-0x00007FFE2554F000-0x00007FFE25550000-memory.dmp
memory/1664-50-0x00000000014B0000-0x00000000014C0000-memory.dmp
memory/1664-49-0x00007FFE253C0000-0x00007FFE25D64000-memory.dmp
memory/1664-19-0x00007FFE25550000-0x00007FFE25551000-memory.dmp
memory/1664-30-0x00007FFE253C0000-0x00007FFE25D64000-memory.dmp
memory/1664-47-0x00000000014B0000-0x00000000014C0000-memory.dmp
memory/1664-12-0x0000000000C30000-0x0000000000C3E000-memory.dmp
memory/1664-31-0x00007FFE253C0000-0x00007FFE25D64000-memory.dmp
memory/2188-18-0x00007FFE27710000-0x00007FFE28148000-memory.dmp
memory/2188-3-0x00007FFE27710000-0x00007FFE28148000-memory.dmp
memory/2188-13-0x00007FFE27710000-0x00007FFE28148000-memory.dmp
memory/2188-2-0x00007FFE27710000-0x00007FFE28148000-memory.dmp
memory/2188-0-0x00007FFE27A0A000-0x00007FFE27A0B000-memory.dmp
memory/2188-24-0x00007FFE27710000-0x00007FFE28148000-memory.dmp
memory/3812-38-0x0000000000AC0000-0x0000000000ACE000-memory.dmp