Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
25/08/2026, 15:19
General
- Target d9e29bbdc13c8d2005de811a81272c1dcd472f321c2d1e0c0fe894414dd81b25.ps1
- Size 46KB
- Sample260825-sqettavanf
- SHA256 d9e29bbdc13c8d2005de811a81272c1dcd472f321c2d1e0c0fe894414dd81b25
Malware Config
Extracted
-
xworm
-
3.1
-
SaDDaM11-49041.portmap.host:49041
-
EfAn9VzhGpVfcehZ
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\d9e29bbdc13c8d2005de811a81272c1dcd472f321c2d1e0c0fe894414dd81b25.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\drettg.exe"C:\Users\Admin\AppData\Local\Temp\drettg.exe"2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
drettg.exe
memory/1856-34-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/1856-33-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/1856-32-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/1856-27-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/1856-26-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/1856-24-0x0000000000DC0000-0x0000000000DD0000-memory.dmp
memory/4240-13-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/4240-8-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/4240-12-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/4240-0-0x00007FF8B90BF000-0x00007FF8B90C0000-memory.dmp
memory/4240-14-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/4240-15-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/4240-9-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/4240-11-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/4240-25-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/4240-7-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/4240-6-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/4240-5-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/4240-4-0x00000264AC5D0000-0x00000264AC5F2000-memory.dmp
memory/4240-3-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp