Analysis
- user interaction
yes - max time kernel
149s - max time network
149s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
16/08/2026, 00:56
General
- Target Njrat.exe
- Size 15.3MB
- Sample260816-bap66sar21
- SHA256 7e498a94deecb952a7800689b6364b092fc10cc3217e0305f9b31d5bdf3ad731
Malware Config
Extracted
-
xworm
-
XWorm V6.5 by soviet
-
128.234.0.32:7834
-
Install_directory
%ProgramData%
-
install_file
XWormClient.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Njrat.exe"C:\Users\Admin\AppData\Local\Temp\Njrat.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Njrat.exe"C:\Users\Admin\AppData\Roaming\Njrat.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\svshost.exe"C:\Users\Admin\AppData\Roaming\svshost.exe"2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\PROGRA~3\XWormClient.exeC:\PROGRA~3\XWORMC~1.EXE1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Njrat.exe
svshost.exe
memory/2712-0-0x0000000000160000-0x00000000010B0000-memory.dmp
memory/3144-47-0x0000000001170000-0x0000000001180000-memory.dmp
memory/3144-30-0x0000000000950000-0x0000000000968000-memory.dmp
memory/3144-48-0x0000000002BA0000-0x0000000002BAC000-memory.dmp
memory/3144-36-0x0000000001170000-0x0000000001180000-memory.dmp
memory/5556-37-0x00000000070D0000-0x0000000007A90000-memory.dmp
memory/5556-42-0x00000000125B0000-0x000000001264C000-memory.dmp
memory/5556-43-0x0000000012C00000-0x00000000131A6000-memory.dmp
memory/5556-44-0x0000000012650000-0x00000000126E2000-memory.dmp
memory/5556-45-0x0000000005FF0000-0x0000000005FFA000-memory.dmp
memory/5556-46-0x0000000006A90000-0x0000000006AE6000-memory.dmp
memory/5556-41-0x000000000F3E0000-0x0000000010510000-memory.dmp
memory/5556-31-0x0000000000600000-0x0000000001532000-memory.dmp