Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 15:19
General
- Target 1bd34690cfc06974ed0fd3d525da012ec8e59084d6fb6ef34f22175452cfe5b1.exe
- Size 33KB
- Sample260810-sqa6maxtdt
- SHA256 1bd34690cfc06974ed0fd3d525da012ec8e59084d6fb6ef34f22175452cfe5b1
Malware Config
Extracted
-
xworm
-
5.0
-
91.92.47.228:1372:1372
-
91.92.47.228:1372
-
9bqooCWtCMmIws4L
-
install_file
USB.exe
-
localhost
127.0.0.1
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 4 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bd34690cfc06974ed0fd3d525da012ec8e59084d6fb6ef34f22175452cfe5b1.exe"C:\Users\Admin\AppData\Local\Temp\1bd34690cfc06974ed0fd3d525da012ec8e59084d6fb6ef34f22175452cfe5b1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\shutdown.exeshutdown.exe /f /s /t 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\SuspendMeasure.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5396 -s 11962⤵
- Program crash
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5396 -ip 53961⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a2c055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
CurrentDatabase_400.wmdb
WMSDKNS.XML.bak
wmsetup.log
index.dat
74d7f43c1561fc1e.customDestinations-ms
74d7f43c1561fc1e.customDestinations-ms
fb3b0dbfee58fac8.customDestinations-ms
fb3b0dbfee58fac8.customDestinations-ms
memory/4132-6-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4132-133-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4132-131-0x000000001D080000-0x000000001D0C0000-memory.dmp
memory/4132-129-0x000000001CDB0000-0x000000001CDE4000-memory.dmp
memory/4132-128-0x000000001D010000-0x000000001D082000-memory.dmp
memory/4132-127-0x00000000021F0000-0x00000000021F6000-memory.dmp
memory/4132-126-0x000000001B500000-0x000000001B54A000-memory.dmp
memory/4132-132-0x000000001AF20000-0x000000001AF26000-memory.dmp
memory/4132-8-0x0000000000930000-0x0000000000936000-memory.dmp
memory/4132-7-0x000000001B450000-0x000000001B49E000-memory.dmp
memory/4132-5-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4132-4-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4132-3-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4132-2-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4132-1-0x0000000000060000-0x000000000006E000-memory.dmp
memory/4132-0-0x00007FFC6847F000-0x00007FFC68480000-memory.dmp
memory/4412-19-0x00007FFC8B120000-0x00007FFC8B383000-memory.dmp
memory/4412-14-0x00007FFC8B120000-0x00007FFC8B383000-memory.dmp
memory/4412-18-0x00007FFC8B120000-0x00007FFC8B383000-memory.dmp
memory/4412-41-0x00007FFC8B120000-0x00007FFC8B383000-memory.dmp
memory/4412-20-0x00007FFC8B120000-0x00007FFC8B383000-memory.dmp
memory/4412-21-0x00007FFC8B120000-0x00007FFC8B383000-memory.dmp
memory/4412-24-0x00007FFC8B120000-0x00007FFC8B383000-memory.dmp
memory/4412-25-0x00007FFC48ED0000-0x00007FFC48EE0000-memory.dmp
memory/4412-22-0x00007FFC8B120000-0x00007FFC8B383000-memory.dmp
memory/4412-9-0x00007FFC4B260000-0x00007FFC4B270000-memory.dmp
memory/4412-11-0x00007FFC4B260000-0x00007FFC4B270000-memory.dmp
memory/4412-23-0x00007FFC8B120000-0x00007FFC8B383000-memory.dmp
memory/4412-10-0x00007FFC4B260000-0x00007FFC4B270000-memory.dmp
memory/4412-12-0x00007FFC8B27F000-0x00007FFC8B280000-memory.dmp
memory/4412-17-0x00007FFC8B120000-0x00007FFC8B383000-memory.dmp
memory/4412-15-0x00007FFC4B260000-0x00007FFC4B270000-memory.dmp
memory/4412-16-0x00007FFC8B120000-0x00007FFC8B383000-memory.dmp
memory/4412-13-0x00007FFC4B260000-0x00007FFC4B270000-memory.dmp
memory/4412-125-0x00007FFC8B120000-0x00007FFC8B383000-memory.dmp
memory/4412-26-0x00007FFC48ED0000-0x00007FFC48EE0000-memory.dmp
memory/5396-112-0x00000000052B0000-0x00000000052C0000-memory.dmp
memory/5396-113-0x00000000052B0000-0x00000000052C0000-memory.dmp
memory/5396-110-0x00000000052B0000-0x00000000052C0000-memory.dmp
memory/5396-111-0x00000000052B0000-0x00000000052C0000-memory.dmp
memory/5396-108-0x0000000007E80000-0x0000000007E90000-memory.dmp
memory/5396-107-0x0000000007E80000-0x0000000007E90000-memory.dmp