Analysis
- max time kernel
151s - max time network
24s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
06/10/2026, 19:35
General
- Target WAX CLIENT V2.3.1.exe
- Size 44.5MB
- Sample261006-ya273avyax
- SHA256 5d6456dbdc10c247e43eeb4911055b4ad2c397cfc172d96deca0e6e5052fb9e1
Malware Config
Extracted
-
xworm
-
XWorm V6.4 by celestialproject.org
-
bw73kzvtxz.localto.net:7402
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 18 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\WAX CLIENT V2.3.1.exe"C:\Users\Admin\AppData\Local\Temp\WAX CLIENT V2.3.1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WAX CLIENT V2.3.1.exe"C:\Users\Admin\AppData\Local\Temp\WAX CLIENT V2.3.1.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -Command "Get-Service WpnUserService* | Where-Object {$_.Status -eq 'Running'} | Restart-Service -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\UpdateAssistant' -ErrorAction SilentlyContinue""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\UpdateAssistant' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\UpdateAssistant\rhVqpcFv.exe' -ErrorAction SilentlyContinue""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\UpdateAssistant\rhVqpcFv.exe' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp' -ErrorAction SilentlyContinue""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "MicrosoftUpdate" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\UpdateAssistant\rhVqpcFv.exe"" /sc onlogon /f"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "MicrosoftUpdate" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\UpdateAssistant\rhVqpcFv.exe"" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\UpdateAssistant\rhVqpcFv.exeC:\Users\Admin\AppData\Roaming\Microsoft\UpdateAssistant\rhVqpcFv.exe3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\UpdateAssistant\rhVqpcFv.exe"C:\Users\Admin\AppData\Roaming\Microsoft\UpdateAssistant\rhVqpcFv.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
VCRUNTIME140.dll
_bz2.pyd
_cffi_backend.cp314-win_amd64.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_zstd.pyd
base_library.zip
_rust.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python3.DLL
python314.dll
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_epjrggds.z1w.ps1
kQfKOMfhJE.exe
memory/3048-169-0x0000000000580000-0x0000000000596000-memory.dmp
memory/5460-113-0x00007FF905CE0000-0x00007FF906684000-memory.dmp
memory/5460-116-0x00007FF905CE0000-0x00007FF906684000-memory.dmp
memory/5460-114-0x00007FF905CE0000-0x00007FF906684000-memory.dmp
memory/5460-112-0x00007FF905CE0000-0x00007FF906684000-memory.dmp
memory/5460-111-0x00007FF905CE0000-0x00007FF906684000-memory.dmp
memory/5460-108-0x0000025B24970000-0x0000025B24992000-memory.dmp
memory/5460-109-0x00007FF905CE0000-0x00007FF906684000-memory.dmp
memory/5460-102-0x00007FF905E6F000-0x00007FF905E70000-memory.dmp
memory/5788-136-0x0000023379260000-0x000002337927E000-memory.dmp
memory/5788-137-0x00000233794A0000-0x0000023379552000-memory.dmp
memory/5788-138-0x0000023379280000-0x000002337928A000-memory.dmp