Analysis
- max time kernel
25s - max time network
28s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
05/09/2026, 23:20
General
- Target Fatality.exe
- Size 57KB
- Sample260905-3bf4favbjh
- SHA256 748104c04b0aee5788852a293dd1c90cdaa02a472d7f7541c96113ad4fcca0b3
Malware Config
Extracted
-
xworm
-
13.143.128.127:1372
-
Install_directory
%Temp%
-
install_file
RunTimeBroker.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fatality.exe"C:\Users\Admin\AppData\Local\Temp\Fatality.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Fatality.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Fatality.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_vvm55hfo.gcf.ps1
memory/3372-16-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3372-28-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3372-30-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3372-17-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3372-27-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3372-7-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3372-8-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3372-9-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3372-10-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3372-13-0x000002619DA00000-0x000002619DA22000-memory.dmp
memory/3372-14-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3372-15-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3372-26-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3372-25-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3372-24-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3372-21-0x000002619DAD0000-0x000002619DB82000-memory.dmp
memory/3372-22-0x000002619DB90000-0x000002619DB9A000-memory.dmp
memory/3372-23-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3372-20-0x000002619DAB0000-0x000002619DACE000-memory.dmp
memory/6128-0-0x00007FFB11F0F000-0x00007FFB11F10000-memory.dmp
memory/6128-3-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/6128-6-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/6128-5-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/6128-4-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/6128-2-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/6128-1-0x00000000006E0000-0x00000000006F4000-memory.dmp