Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 17:46
General
- Target fe1e3f38e6bd2ec3cfcacc946a22c8d8212f083c8165cb3caa9ae301c25332ff.exe
- Size 812KB
- Sample260809-wcehnsbk4v
- SHA256 fe1e3f38e6bd2ec3cfcacc946a22c8d8212f083c8165cb3caa9ae301c25332ff
Malware Config
Extracted
-
xworm
-
5.0
-
109.248.150.244:1070
-
vq0enb35BNzySK9c
-
Install_directory
%AppData%
-
install_file
bin.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates new service(s) 2 TTPs
- Stops running service(s) 4 TTPs
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe1e3f38e6bd2ec3cfcacc946a22c8d8212f083c8165cb3caa9ae301c25332ff.exe"C:\Users\Admin\AppData\Local\Temp\fe1e3f38e6bd2ec3cfcacc946a22c8d8212f083c8165cb3caa9ae301c25332ff.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exe"sc.exe" stop Warsaw_PM2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" delete Warsaw_PM2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" create Warsaw_PM binPath= "C:\Drivers\Warsaw_PM.sys" type= kernel start= demand2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" start Warsaw_PM2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'MSBuild.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\bin.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bin.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "bin" /tr "C:\Users\Admin\AppData\Roaming\bin.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 10162⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3556 -ip 35561⤵
-
C:\Users\Admin\AppData\Roaming\bin.exeC:\Users\Admin\AppData\Roaming\bin.exe1⤵
-
C:\Users\Admin\AppData\Roaming\bin.exe"C:\Users\Admin\AppData\Roaming\bin.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\bin.exe"C:\Users\Admin\AppData\Roaming\bin.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_u2xp22p5.a4a.ps1
people.csv
people.csv
bin.exe
memory/1164-74-0x0000000074890000-0x000000007504C000-memory.dmp
memory/1164-64-0x0000000074890000-0x000000007504C000-memory.dmp
memory/1164-23-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/1164-25-0x0000000074890000-0x000000007504C000-memory.dmp
memory/1164-24-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1164-26-0x0000000004FF0000-0x000000000508C000-memory.dmp
memory/1164-80-0x0000000074890000-0x000000007504C000-memory.dmp
memory/1200-57-0x00000000056F0000-0x0000000005A4B000-memory.dmp
memory/1200-61-0x00000000721C0000-0x000000007220C000-memory.dmp
memory/1664-49-0x0000000006300000-0x000000000665B000-memory.dmp
memory/1664-53-0x00000000721C0000-0x000000007220C000-memory.dmp
memory/2132-69-0x00000000721C0000-0x000000007220C000-memory.dmp
memory/2448-79-0x00000000059D0000-0x0000000005B2A000-memory.dmp
memory/2448-78-0x00000000032A0000-0x00000000032BA000-memory.dmp
memory/2448-77-0x0000000000DB0000-0x0000000000DF0000-memory.dmp
memory/3556-22-0x0000000004CE0000-0x0000000004CE8000-memory.dmp
memory/3556-0-0x00000000748A2000-0x00000000748A3000-memory.dmp
memory/3556-1-0x0000000000150000-0x0000000000222000-memory.dmp
memory/3556-3-0x0000000074890000-0x000000007504C000-memory.dmp
memory/3556-15-0x0000000004C80000-0x0000000004C88000-memory.dmp
memory/3556-16-0x0000000004C90000-0x0000000004CA4000-memory.dmp
memory/3556-27-0x0000000074890000-0x000000007504C000-memory.dmp
memory/4812-47-0x00000000077B0000-0x0000000007846000-memory.dmp
memory/4812-30-0x0000000005410000-0x0000000005432000-memory.dmp
memory/4812-28-0x0000000004CF0000-0x0000000004D26000-memory.dmp
memory/4812-38-0x00000000071A0000-0x00000000071D6000-memory.dmp
memory/4812-39-0x00000000721C0000-0x000000007220C000-memory.dmp
memory/4812-42-0x0000000006740000-0x0000000006760000-memory.dmp
memory/4812-37-0x00000000067C0000-0x000000000680C000-memory.dmp
memory/4812-29-0x0000000005480000-0x0000000005ACA000-memory.dmp
memory/4812-46-0x00000000075B0000-0x00000000075BA000-memory.dmp
memory/4812-36-0x00000000061D0000-0x00000000061EE000-memory.dmp
memory/4812-45-0x0000000007540000-0x000000000755A000-memory.dmp
memory/4812-44-0x0000000007B80000-0x00000000081FC000-memory.dmp
memory/4812-35-0x0000000005E50000-0x00000000061AB000-memory.dmp
memory/4812-31-0x0000000005C00000-0x0000000005C66000-memory.dmp
memory/4812-32-0x0000000005C70000-0x0000000005CD6000-memory.dmp
memory/4812-43-0x00000000073E0000-0x0000000007483000-memory.dmp