Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 12:45
General
- Target XClient.exe
- Size 32KB
- Sample260924-py3dasss3k
- SHA256 558f4d83a90a3e8c8a56960e6d793e1772fd1d7b87e9da3b09b09f082dccb71c
Malware Config
Extracted
-
xworm
-
3.0
-
82.47.102.179:5001
-
431fDc4L3mvZEUlE
-
Install_directory
%Userprofile%
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Creates a file in the Startup directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\drsdir.exe"C:\Users\Admin\AppData\Local\Temp\drsdir.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
drsdir.exe
memory/1380-24-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/1380-20-0x0000000074C12000-0x0000000074C13000-memory.dmp
memory/1380-27-0x0000000074C00000-0x00000000753BC000-memory.dmp
memory/1380-26-0x0000000074C12000-0x0000000074C13000-memory.dmp
memory/1380-25-0x0000000005F40000-0x0000000005F4A000-memory.dmp
memory/1380-21-0x0000000000F20000-0x00000000013BC000-memory.dmp
memory/1380-22-0x0000000006570000-0x0000000006B2A000-memory.dmp
memory/1380-23-0x0000000005FB0000-0x0000000006042000-memory.dmp
memory/5804-1-0x00000000008E0000-0x00000000008EE000-memory.dmp
memory/5804-2-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp
memory/5804-10-0x0000000002A10000-0x0000000002A1A000-memory.dmp
memory/5804-0-0x00007FF95F5DF000-0x00007FF95F5E0000-memory.dmp
memory/5804-9-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp
memory/5804-8-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp
memory/5804-7-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp