Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
15/08/2026, 03:17
General
- Target d045846ff104a450d04e4ddbc8b3b2d34b1d34f4e3fbe0b4bde0e1d2255c9c44.exe
- Size 12.4MB
- Sample260815-ds3akayvft
- SHA256 d045846ff104a450d04e4ddbc8b3b2d34b1d34f4e3fbe0b4bde0e1d2255c9c44
Malware Config
Extracted
-
xworm
-
3.1
-
fds6gbae3v.localto.net:4294
-
WHx0XqzWQ60CU9Vw
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 26 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d045846ff104a450d04e4ddbc8b3b2d34b1d34f4e3fbe0b4bde0e1d2255c9c44.exe"C:\Users\Admin\AppData\Local\Temp\d045846ff104a450d04e4ddbc8b3b2d34b1d34f4e3fbe0b4bde0e1d2255c9c44.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d045846ff104a450d04e4ddbc8b3b2d34b1d34f4e3fbe0b4bde0e1d2255c9c44.exe"C:\Users\Admin\AppData\Local\Temp\d045846ff104a450d04e4ddbc8b3b2d34b1d34f4e3fbe0b4bde0e1d2255c9c44.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -command "Add-MpPreference -ExclusionPath ""C:\Users\Admin\AppData\Local\Temp"""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Add-MpPreference -ExclusionPath ""C:\Users\Admin\AppData\Local\Temp""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp_qnoepqcf.exe"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp_qnoepqcf.exeC:\Users\Admin\AppData\Local\Temp\tmp_qnoepqcf.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "tmp_qnoepqcf" /tr "C:\Users\Admin\AppData\Roaming\tmp_qnoepqcf.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\tmp_qnoepqcf.exeC:\Users\Admin\AppData\Roaming\tmp_qnoepqcf.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\tmp_qnoepqcf.exe"C:\Users\Admin\AppData\Roaming\tmp_qnoepqcf.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\tmp_qnoepqcf.exe"C:\Users\Admin\AppData\Roaming\tmp_qnoepqcf.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_raw_aes.pyd
_raw_aesni.pyd
_raw_ctr.pyd
_raw_ecb.pyd
_BLAKE2s.pyd
_ghash_clmul.pyd
_ghash_portable.pyd
_cpuid_c.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
_psutil_windows.pyd
python3.DLL
python314.dll
Lorem ipsum.txt
tmp_qnoepqcf.exe
memory/3108-140-0x0000000000860000-0x000000000086E000-memory.dmp
memory/4540-108-0x00007FF847B70000-0x00007FF848514000-memory.dmp
memory/4540-117-0x00007FF847B70000-0x00007FF848514000-memory.dmp
memory/4540-115-0x00007FF847B70000-0x00007FF848514000-memory.dmp
memory/4540-114-0x00007FF847B70000-0x00007FF848514000-memory.dmp
memory/4540-113-0x00007FF847B70000-0x00007FF848514000-memory.dmp
memory/4540-112-0x00007FF847B70000-0x00007FF848514000-memory.dmp
memory/4540-111-0x00007FF847B70000-0x00007FF848514000-memory.dmp
memory/4540-110-0x00007FF847B70000-0x00007FF848514000-memory.dmp
memory/4540-109-0x00000220662B0000-0x00000220662D2000-memory.dmp
memory/4540-105-0x00007FF847B70000-0x00007FF848514000-memory.dmp
memory/4540-104-0x00007FF847CFF000-0x00007FF847D00000-memory.dmp