Analysis
- user interaction
yes - max time kernel
149s - max time network
123s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
04/11/2026, 19:30
General
- Target ZARAR-PREMIUM-SAFE.exe
- Size 113.7MB
- Sample261104-x78wfaee69
- SHA256 0310dbb0647eb64525295d4ab349dd1d7bbb10b7a2217c3b4536902c60ebae5d
Malware Config
Extracted
-
xworm
-
XWorm V5.6
-
33.tcp.cpolar.top:10611
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 23 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZARAR-PREMIUM-SAFE.exe"C:\Users\Admin\AppData\Local\Temp\ZARAR-PREMIUM-SAFE.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\EXTERNAL MENU.exe"C:\Users\Admin\AppData\Roaming\EXTERNAL MENU.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Roaming\ZARAR-PREMIUM.exe"C:\Users\Admin\AppData\Roaming\ZARAR-PREMIUM.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Aimkill.dll
EXTERNAL MENU.dll
Microsoft.Win32.Registry.dll
Microsoft.Win32.SystemEvents.dll
System.Collections.Concurrent.dll
System.Collections.NonGeneric.dll
System.Collections.Specialized.dll
System.Collections.dll
System.ComponentModel.EventBasedAsync.dll
System.ComponentModel.Primitives.dll
System.ComponentModel.TypeConverter.dll
System.ComponentModel.dll
System.Drawing.Common.dll
System.Drawing.Primitives.dll
System.Memory.dll
System.Private.CoreLib.dll
System.Private.Windows.Core.dll
System.Private.Windows.GdiPlus.dll
System.Runtime.InteropServices.dll
System.Threading.dll
System.Windows.Forms.Primitives.dll
System.Windows.Forms.dll
ZARAR-PREMIUM.exe
memory/712-0-0x00000000008E0000-0x00000000018E0000-memory.dmp
memory/4748-98-0x0000000000F90000-0x0000000000FAA000-memory.dmp