Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
26/08/2026, 11:17
General
- Target 3e04a850d6abade3e836a44b4d65eaf7d711064d99f43808c38a46aa791af434.exe
- Size 1.5MB
- Sample260826-nd3ynaxfmb
- SHA256 3e04a850d6abade3e836a44b4d65eaf7d711064d99f43808c38a46aa791af434
Malware Config
Extracted
-
xworm
-
XWorm V6.0
-
172.29.4.79:443
-
Install_directory
%AppData%
-
install_file
Loader.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e04a850d6abade3e836a44b4d65eaf7d711064d99f43808c38a46aa791af434.exe"C:\Users\Admin\AppData\Local\Temp\3e04a850d6abade3e836a44b4d65eaf7d711064d99f43808c38a46aa791af434.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\jei-1.21.1-neoforge-19.27.0.336.jar"2⤵
-
-
C:\Users\Admin\AppData\Roaming\Ahh.exe"C:\Users\Admin\AppData\Roaming\Ahh.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Ahh.exe
jei-1.21.1-neoforge-19.27.0.336.jar
memory/1236-22-0x00007FFA5A4E0000-0x00007FFA5AE84000-memory.dmp
memory/1236-0-0x00007FFA5A66F000-0x00007FFA5A670000-memory.dmp
memory/1236-2-0x00007FFA5A4E0000-0x00007FFA5AE84000-memory.dmp
memory/1236-1-0x0000000000BE0000-0x0000000000D6E000-memory.dmp
memory/1236-14-0x00007FFA5A4E0000-0x00007FFA5AE84000-memory.dmp
memory/1236-4-0x00007FFA5A4E0000-0x00007FFA5AE84000-memory.dmp
memory/3668-37-0x00007FFA5A4E0000-0x00007FFA5AE84000-memory.dmp
memory/3668-25-0x00007FFA5A4E0000-0x00007FFA5AE84000-memory.dmp
memory/3668-34-0x00007FFA5A4E0000-0x00007FFA5AE84000-memory.dmp
memory/3668-35-0x00007FFA5A4E0000-0x00007FFA5AE84000-memory.dmp
memory/3668-36-0x00007FFA5A4E0000-0x00007FFA5AE84000-memory.dmp
memory/3668-21-0x00000000008C0000-0x00000000008D6000-memory.dmp
memory/3668-40-0x00007FFA5A4E0000-0x00007FFA5AE84000-memory.dmp
memory/3668-39-0x00007FFA5A4E0000-0x00007FFA5AE84000-memory.dmp
memory/3668-38-0x00007FFA5A4E0000-0x00007FFA5AE84000-memory.dmp
memory/4500-32-0x0000027A61CF0000-0x0000027A61CF1000-memory.dmp
memory/4500-33-0x0000027A61E80000-0x0000027A620F0000-memory.dmp