Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/08/2026, 14:41
General
- Target 2026-08-17_fd42d2667a9e8be229f426999b6b4bd6_cobalt-strike_icedid_stealc.exe
- Size 156KB
- Sample260817-r2rgbasdmb
- SHA256 8af4016584fbe1713eeda598150e68c51ee6a709206782255a6c4399bb092541
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
5.0
C2
-
82.22.62.213:666
Mutex
-
g9TjMEKoPZ1QH1PL
Attributes
-
install_file
USB.exe
-
localhost
127.0.0.1
aes.plain
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_fd42d2667a9e8be229f426999b6b4bd6_cobalt-strike_icedid_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_fd42d2667a9e8be229f426999b6b4bd6_cobalt-strike_icedid_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\runtime_host_e5ab6fd.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_fd42d2667a9e8be229f426999b6b4bd6_cobalt-strike_icedid_stealc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
runtime_host_e5ab6fd.exe
memory/2020-4-0x00007FFDBBC9F000-0x00007FFDBBCA0000-memory.dmp
memory/2020-5-0x0000000000470000-0x000000000047E000-memory.dmp
memory/2020-6-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
memory/2020-7-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
memory/2020-8-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
memory/2020-9-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
memory/2020-10-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp