Analysis
- max time kernel
8s - max time network
5s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/09/2026, 21:37
Errors
General
- Target TEOZKT9EFW.exe
- Size 195KB
- Sample260905-1gr2satang
- SHA256 606ba93af2734ffb262c48a103470f4a4419910ed1387ef2a4929f62354c7343
Malware Config
Extracted
-
xworm
-
3.0
-
VnA9vWdju0dWHdlO
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\TEOZKT9EFW.exe"C:\Users\Admin\AppData\Local\Temp\TEOZKT9EFW.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Query /TN TEOZKT9EFW2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /SC ONLOGON /TN TEOZKT9EFW /TR C:\Users\Admin\AppData\Roaming\TEOZKT9EFW.exe /RU INTERACTIVE /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\TEOZKT9EFW.exeC:\Users\Admin\AppData\Roaming\TEOZKT9EFW.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
TEOZKT9EFW.exe
memory/2480-0-0x00000000004B0000-0x00000000004E8000-memory.dmp
memory/2480-1-0x00007FF844B9F000-0x00007FF844BA0000-memory.dmp
memory/2480-2-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/2480-3-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/2480-4-0x0000000000D70000-0x0000000000D7E000-memory.dmp
memory/2480-5-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/2480-7-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/2952-8-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/2952-9-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp