Analysis
- user interaction
yes - max time kernel
67s - max time network
76s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/09/2026, 03:45
Errors
General
- Target TRK.exe
- Size 32KB
- Sample260913-ebk6dscj2s
- SHA256 50bb87c764f42bbc944e1cf28102f53dbcde58ebd7ab40346caa2a237f86bf96
Malware Config
Extracted
-
xworm
-
5.0
-
x0hpgvcqiu.localto.net:5546
-
kQfvxYay7sdtKHVi
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Executes dropped EXE 5 IoCs
- Drops file in System32 directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TRK.exe"C:\Users\Admin\AppData\Local\Temp\TRK.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ejnyay.COM"C:\Users\Admin\AppData\Local\Temp\ejnyay.COM"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MBR2.exe"C:\Users\Admin\AppData\Local\Temp\MBR2.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\MatrixMBR.exe"C:\Windows\System32\MatrixMBR.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\GDI.exe"C:\Users\Admin\AppData\Local\Temp\GDI.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MBR.exe"C:\Users\Admin\AppData\Local\Temp\MBR.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004F01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MBR2.exe
TROLL2.exe
TROLL5.exe
ejnyay.COM
MatrixMBR.exe
memory/1216-8-0x000001C073BC0000-0x000001C073D09000-memory.dmp
memory/2520-70-0x00000000000B0000-0x00000000000B8000-memory.dmp
memory/2568-48-0x00000000006A0000-0x00000000006DA000-memory.dmp
memory/3236-57-0x00000000055E0000-0x00000000055EA000-memory.dmp
memory/3236-56-0x00000000056C0000-0x0000000005752000-memory.dmp
memory/3236-54-0x0000000005BE0000-0x000000000619A000-memory.dmp
memory/3236-53-0x0000000000B50000-0x0000000000C08000-memory.dmp
memory/3936-7-0x00000000021D0000-0x00000000021DC000-memory.dmp
memory/3936-59-0x000000001ADD0000-0x000000001ADDC000-memory.dmp
memory/3936-0-0x00007FFF68E0F000-0x00007FFF68E10000-memory.dmp
memory/3936-2-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp
memory/3936-60-0x000000001F1C0000-0x000000001F6E8000-memory.dmp
memory/3936-3-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp
memory/3936-4-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp
memory/3936-1-0x0000000000040000-0x000000000004E000-memory.dmp
memory/3936-6-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp
memory/3936-5-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp
memory/5800-55-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp
memory/5800-19-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp
memory/5800-21-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp
memory/5800-22-0x000000001BC50000-0x000000001BD34000-memory.dmp
memory/5800-20-0x0000000000BF0000-0x0000000000CDC000-memory.dmp
memory/5800-24-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp
memory/5800-23-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp
memory/6048-67-0x0000000000400000-0x000000000041D000-memory.dmp