Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/08/2026, 16:29
General
- Target 35f6b5905b4995c50de76e54a05e644e9d384ec0101e7160685d57df9e831584.exe
- Size 845KB
- Sample260824-tzc71sam8x
- SHA256 35f6b5905b4995c50de76e54a05e644e9d384ec0101e7160685d57df9e831584
Malware Config
Extracted
-
xworm
-
XWorm V7.4
-
216.250.250.247:8086
-
Install_directory
%AppData%
-
install_file
XWormClient.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\35f6b5905b4995c50de76e54a05e644e9d384ec0101e7160685d57df9e831584.exe"C:\Users\Admin\AppData\Local\Temp\35f6b5905b4995c50de76e54a05e644e9d384ec0101e7160685d57df9e831584.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\35f6b5905b4995c50de76e54a05e644e9d384ec0101e7160685d57df9e831584.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\35f6b5905b4995c50de76e54a05e644e9d384ec0101e7160685d57df9e831584.exe"C:\Users\Admin\AppData\Local\Temp\35f6b5905b4995c50de76e54a05e644e9d384ec0101e7160685d57df9e831584.exe"2⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/752-33-0x0000000070BC0000-0x0000000070C0C000-memory.dmp
memory/752-17-0x00000000748E0000-0x000000007509C000-memory.dmp
memory/752-25-0x0000000006840000-0x000000000688C000-memory.dmp
memory/752-43-0x00000000748E0000-0x000000007509C000-memory.dmp
memory/752-41-0x0000000007D50000-0x0000000007DE6000-memory.dmp
memory/752-40-0x0000000007B50000-0x0000000007B5A000-memory.dmp
memory/752-39-0x0000000007AE0000-0x0000000007AFA000-memory.dmp
memory/752-38-0x0000000008120000-0x000000000879C000-memory.dmp
memory/752-37-0x00000000079A0000-0x0000000007A43000-memory.dmp
memory/752-15-0x00000000748E0000-0x000000007509C000-memory.dmp
memory/752-18-0x00000000058C0000-0x00000000058E2000-memory.dmp
memory/752-24-0x0000000006780000-0x000000000679E000-memory.dmp
memory/752-23-0x00000000063F0000-0x000000000674B000-memory.dmp
memory/752-32-0x0000000007940000-0x0000000007976000-memory.dmp
memory/752-14-0x0000000005290000-0x00000000052C6000-memory.dmp
memory/752-16-0x0000000005920000-0x0000000005F6A000-memory.dmp
memory/752-26-0x00000000748E0000-0x000000007509C000-memory.dmp
memory/752-19-0x0000000005FE0000-0x0000000006046000-memory.dmp
memory/752-36-0x0000000006D60000-0x0000000006D80000-memory.dmp
memory/752-20-0x0000000006180000-0x00000000061E6000-memory.dmp
memory/3260-31-0x00000000748E0000-0x000000007509C000-memory.dmp
memory/3260-12-0x00000000748E0000-0x000000007509C000-memory.dmp
memory/3260-11-0x0000000000400000-0x0000000000418000-memory.dmp
memory/3260-44-0x00000000748E0000-0x000000007509C000-memory.dmp
memory/4808-9-0x0000000009380000-0x000000000942A000-memory.dmp
memory/4808-1-0x0000000000780000-0x000000000085A000-memory.dmp
memory/4808-13-0x00000000748E0000-0x000000007509C000-memory.dmp
memory/4808-0-0x00000000748F2000-0x00000000748F3000-memory.dmp
memory/4808-10-0x00000000094D0000-0x000000000956C000-memory.dmp
memory/4808-8-0x00000000748E0000-0x000000007509C000-memory.dmp
memory/4808-7-0x00000000748F2000-0x00000000748F3000-memory.dmp
memory/4808-6-0x0000000008EB0000-0x0000000008ECE000-memory.dmp
memory/4808-5-0x00000000748E0000-0x000000007509C000-memory.dmp
memory/4808-4-0x0000000005380000-0x000000000538A000-memory.dmp
memory/4808-3-0x00000000053F0000-0x0000000005482000-memory.dmp
memory/4808-2-0x0000000005910000-0x0000000005ECA000-memory.dmp