Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 11:25
General
- Target adb964cf76f216318c20012708a1e916dfedc7be162432ea4c50294d35609821.exe
- Size 903KB
- Sample260810-njfqbaswat
- SHA256 adb964cf76f216318c20012708a1e916dfedc7be162432ea4c50294d35609821
Malware Config
Extracted
-
xworm
-
5.0
-
104.168.7.219:8823
-
frBvNnnFYR6XR622pBE0NQ==:23
-
yy44YYqisu2DFrXX
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 49 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\adb964cf76f216318c20012708a1e916dfedc7be162432ea4c50294d35609821.exe"C:\Users\Admin\AppData\Local\Temp\adb964cf76f216318c20012708a1e916dfedc7be162432ea4c50294d35609821.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\adb964cf76f216318c20012708a1e916dfedc7be162432ea4c50294d35609821.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\mqroyjkoauc.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\xZBRnJUjEpNex.exe"C:\Users\Admin\AppData\Roaming\xZBRnJUjEpNex.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xZBRnJUjEpNex.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_30cbvqhy.fu3.ps1
mqroyjkoauc.ps1
xZBRnJUjEpNex.exe
memory/716-36-0x0000000007810000-0x0000000007846000-memory.dmp
memory/716-43-0x0000000007B80000-0x0000000007B9A000-memory.dmp
memory/716-48-0x0000000074600000-0x0000000074DBC000-memory.dmp
memory/716-45-0x0000000007DF0000-0x0000000007E86000-memory.dmp
memory/716-44-0x0000000007BF0000-0x0000000007BFA000-memory.dmp
memory/716-28-0x0000000006490000-0x00000000064AE000-memory.dmp
memory/716-42-0x00000000081C0000-0x000000000883C000-memory.dmp
memory/716-37-0x0000000074EC0000-0x0000000074F0C000-memory.dmp
memory/716-41-0x0000000007A50000-0x0000000007AF3000-memory.dmp
memory/716-40-0x0000000006D70000-0x0000000006D90000-memory.dmp
memory/716-15-0x0000000003010000-0x0000000003046000-memory.dmp
memory/716-17-0x0000000074600000-0x0000000074DBC000-memory.dmp
memory/716-19-0x0000000005C70000-0x00000000062BA000-memory.dmp
memory/716-20-0x0000000074600000-0x0000000074DBC000-memory.dmp
memory/716-26-0x0000000006330000-0x0000000006396000-memory.dmp
memory/716-21-0x0000000074600000-0x0000000074DBC000-memory.dmp
memory/716-25-0x00000000062C0000-0x0000000006326000-memory.dmp
memory/716-29-0x0000000006DC0000-0x0000000006E0C000-memory.dmp
memory/1536-32-0x0000021CFAC30000-0x0000021CFAC52000-memory.dmp
memory/1768-55-0x0000000006550000-0x00000000068AB000-memory.dmp
memory/1768-61-0x0000000007B70000-0x0000000007C13000-memory.dmp
memory/1768-58-0x0000000071D00000-0x0000000071D4C000-memory.dmp
memory/1768-57-0x0000000006950000-0x000000000699C000-memory.dmp
memory/3888-3-0x0000000005900000-0x0000000005992000-memory.dmp
memory/3888-8-0x0000000074600000-0x0000000074DBC000-memory.dmp
memory/3888-2-0x0000000005EC0000-0x000000000647A000-memory.dmp
memory/3888-13-0x0000000008C60000-0x0000000008CFC000-memory.dmp
memory/3888-12-0x0000000008B20000-0x0000000008BC4000-memory.dmp
memory/3888-11-0x0000000074600000-0x0000000074DBC000-memory.dmp
memory/3888-27-0x0000000074600000-0x0000000074DBC000-memory.dmp
memory/3888-4-0x0000000005B60000-0x0000000005EBB000-memory.dmp
memory/3888-6-0x00000000058B0000-0x00000000058D2000-memory.dmp
memory/3888-0-0x0000000074612000-0x0000000074613000-memory.dmp
memory/3888-7-0x00000000059E0000-0x00000000059EA000-memory.dmp
memory/3888-1-0x0000000000C60000-0x0000000000D48000-memory.dmp
memory/3888-9-0x00000000087A0000-0x00000000087BE000-memory.dmp
memory/3888-5-0x0000000005860000-0x0000000005872000-memory.dmp
memory/3888-10-0x0000000074612000-0x0000000074613000-memory.dmp
memory/4924-51-0x0000000074600000-0x0000000074DBC000-memory.dmp
memory/4924-50-0x0000000074600000-0x0000000074DBC000-memory.dmp
memory/4924-18-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4924-49-0x0000000074600000-0x0000000074DBC000-memory.dmp
memory/4924-22-0x0000000074600000-0x0000000074DBC000-memory.dmp