Analysis
- user interaction
yes - max time kernel
6s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
05/09/2026, 10:45
General
- Target XBinderOutput.exe
- Size 12.8MB
- Sample260905-mthf8aar5t
- SHA256 3e8758dc4351bf1868de049745018d22b2d5f28cf6c3d2b92b1de3d9ef05a3dd
Malware Config
Extracted
-
xworm
-
5.0
-
gkjfndgkzdfhngfkh-30595.portmap.host:30595
-
QVDhErkvmrwTXjyw
-
install_file
USB.exe
-
localhost
127.0.0.1
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe"C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\XClient.exe"C:\Windows\System32\XClient.exe"2⤵
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\XClient.exeC:\Windows\System32\XClient.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Guna.UI2.dll
Xworm V5.6.exe
Xworm V5.6.exe.config
__PSScriptPolicyTest_mjyuisvj.k3s.ps1
XClient.exe
memory/2952-41-0x000002207AC50000-0x000002207AC5A000-memory.dmp
memory/2952-39-0x000002207AB70000-0x000002207AB8C000-memory.dmp
memory/2952-44-0x000002207ACC0000-0x000002207ACDA000-memory.dmp
memory/2952-43-0x000002207AC60000-0x000002207AC6A000-memory.dmp
memory/2952-42-0x000002207AC80000-0x000002207AC9C000-memory.dmp
memory/2952-47-0x000002207ACB0000-0x000002207ACBA000-memory.dmp
memory/2952-40-0x000002207AB90000-0x000002207AC43000-memory.dmp
memory/2952-32-0x000002207AAE0000-0x000002207AB02000-memory.dmp
memory/2952-45-0x000002207AC70000-0x000002207AC78000-memory.dmp
memory/2952-46-0x000002207ACA0000-0x000002207ACA6000-memory.dmp
memory/5148-64-0x0000000000330000-0x000000000033E000-memory.dmp
memory/5684-20-0x0000025A2DA60000-0x0000025A2E948000-memory.dmp
memory/5684-66-0x0000025A4B840000-0x0000025A4BA34000-memory.dmp
memory/6020-0-0x0000000000430000-0x0000000001100000-memory.dmp
memory/6020-1-0x000000001D660000-0x000000001D670000-memory.dmp