Analysis
- geolocation tags
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 07:03
General
- Target WizWorm.exe
- Size 14.6MB
- Sample260910-hvdgfaga27
- SHA256 2daa630ffe26dfd66079d179d19b4c81adacec6a3bc10b9ef82e4ff2cb44fe82
Malware Config
Extracted
-
xworm
-
5.0
-
143.14.44.97:505
-
llnmu2y78-35554.portmap.host:35554
-
ulZxWeFX7AsKLfws
-
Install_directory
%ProgramData%
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates a file in the Startup directory 1 TTPs 4 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 53 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\WizWorm.exe"C:\Users\Admin\AppData\Local\Temp\WizWorm.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\dllhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'dllhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB81B.tmp.bat""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\dllhost.exeC:\Users\Admin\dllhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\dllhost.exe"C:\Users\Admin\dllhost.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WizWorm.exe"C:\Users\Admin\AppData\Roaming\WizWorm.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\n1s.exe"C:\Users\Admin\AppData\Roaming\n1s.exe"2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\bbvv55.exe"C:\Users\Admin\AppData\Roaming\bbvv55.exe"2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_uvnvunvy.tbh.ps1
tmpB81B.tmp.bat
WizWorm.exe
bbvv55.exe
n1s.exe
dllhost.exe
memory/572-37-0x000001F297570000-0x000001F297622000-memory.dmp
memory/944-12-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/944-29-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/944-7-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/944-13-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/944-14-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/944-15-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/944-16-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/944-19-0x0000017E21A80000-0x0000017E21A9E000-memory.dmp
memory/944-20-0x0000017E21AD0000-0x0000017E21B82000-memory.dmp
memory/944-21-0x0000017E21AA0000-0x0000017E21AAA000-memory.dmp
memory/944-22-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/944-23-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/944-24-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/944-25-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/944-10-0x0000017E09470000-0x0000017E09492000-memory.dmp
memory/944-27-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/944-28-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/944-11-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/944-31-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/2872-76-0x0000000000230000-0x000000000023E000-memory.dmp
memory/3004-59-0x000001F192830000-0x000001F19368E000-memory.dmp
memory/3004-77-0x000001F1ADDC0000-0x000001F1AEFB2000-memory.dmp
memory/3188-5-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/3188-43-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/3188-46-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/3188-4-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/3188-3-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/3188-26-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/3188-1-0x0000000000110000-0x0000000000FB4000-memory.dmp
memory/3188-2-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/3188-6-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp
memory/3188-0-0x00007FFB0CABF000-0x00007FFB0CAC0000-memory.dmp
memory/3448-68-0x00000000006F0000-0x00000000006FE000-memory.dmp
memory/5956-49-0x000000001C070000-0x000000001CEE2000-memory.dmp