Analysis
- max time kernel
53s - max time network
62s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/09/2026, 16:43
Errors
General
- Target systemm.exe
- Size 7.2MB
- Sample260916-t8jfdstalc
- SHA256 8b8863c9714248efbb2131e82e53c30a5627c4e051c98fe758caa22f1b3985d8
Malware Config
Extracted
-
xworm
-
3.0
-
82.47.101.153:7165
-
W5UazQxWqWYqnndf
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 8 IoCs
- Drops file in System32 directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\systemm.exe"C:\Users\Admin\AppData\Local\Temp\systemm.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\system.exe"C:\Users\Admin\AppData\Local\system.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jivduk.COM"C:\Users\Admin\AppData\Local\Temp\jivduk.COM"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MBR2.exe"C:\Users\Admin\AppData\Local\Temp\MBR2.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\MatrixMBR.exe"C:\Windows\System32\MatrixMBR.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GDI.exe"C:\Users\Admin\AppData\Local\Temp\GDI.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\MBR.exe"C:\Users\Admin\AppData\Local\Temp\MBR.exe"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\XWorm V3.0.exe"C:\Users\Admin\AppData\Local\XWorm V3.0.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x0000000000000494 0x000000000000049C1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GDI.exe
MBR.exe
MBR2.exe
TROLL2.exe
TROLL5.exe
jivduk.COM
XWorm V3.0.exe
system.exe
MatrixMBR.exe
memory/1804-84-0x0000000005010000-0x00000000050A2000-memory.dmp
memory/1804-79-0x0000000000440000-0x00000000004F8000-memory.dmp
memory/1804-82-0x00000000056E0000-0x0000000005C9A000-memory.dmp
memory/1804-85-0x00000000050D0000-0x00000000050DA000-memory.dmp
memory/2188-24-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp
memory/2188-34-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp
memory/2188-12-0x0000000000910000-0x000000000091E000-memory.dmp
memory/2188-41-0x0000000002980000-0x000000000298A000-memory.dmp
memory/2188-39-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp
memory/2188-35-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp
memory/2204-53-0x000000001B3B0000-0x000000001B494000-memory.dmp
memory/2204-52-0x00000000004E0000-0x00000000005CC000-memory.dmp
memory/2284-14-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp
memory/2284-0-0x00007FFD3431F000-0x00007FFD34320000-memory.dmp
memory/2284-2-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp
memory/2284-1-0x0000000000180000-0x00000000008B4000-memory.dmp
memory/2284-10-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp
memory/2284-19-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp
memory/2284-22-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp
memory/2284-26-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp
memory/2592-95-0x00000000006C0000-0x0000000000706000-memory.dmp
memory/3172-110-0x0000000000710000-0x0000000000718000-memory.dmp
memory/5616-69-0x0000000000A90000-0x0000000000ACA000-memory.dmp
memory/5968-32-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp
memory/5968-36-0x0000026AC7C10000-0x0000026AC8726000-memory.dmp
memory/5968-25-0x0000026AAAD70000-0x0000026AAB49A000-memory.dmp
memory/5968-33-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp
memory/5968-28-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp
memory/5968-29-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp
memory/5968-27-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp
memory/5968-30-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp
memory/5968-40-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp
memory/5968-31-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp
memory/6140-96-0x0000000000400000-0x000000000041D000-memory.dmp