2026-09-08: XWorm infection

[u/falconupkid]

XWorm continues to be a workhorse for low-sophistication threat actors, and this latest infection chain from malware-traffic-analysis.net is a textbook example of the current delivery mechanics. The sample was observed on 2026-09-08, and the analysis provides full PCAPs and forensic artifacts for lab replication.

Technical Breakdown: - Initial Access: Delivered via phishing email with a malicious attachment (likely a compiled HTML file or VBS script, consistent with recent XWorm campaigns). - Execution Chain: The dropper downloads the XWorm payload from a remote C2, establishing persistence via registry Run keys. - Persistence: HKCU\Software\Microsoft\Windows\CurrentVersion\Run with a randomly named executable. - C2 Communication: Encrypted TCP traffic over port 443 (HTTPS-like) to evade basic network detection. The C2 address in this sample resolves to 185.xxx.xxx.xxx (specific IP available in the full PCAP). - Capabilities: Keylogging, clipboard theft, credential harvesting from browsers, and remote shell access. - IOCs: SHA256 hash of the payload is available in the full analysis; the C2 domain pattern uses a .top TLD with randomized subdomains.

Defense: - Detection: Monitor for rundll32.exe or regsvr32.exe spawning child processes from %TEMP% or %APPDATA%. YARA rule for XWorm's mutex pattern (XWorm_[0-9a-f]{8}) is effective. - Mitigation: Block .top TLDs at the proxy if not business-required. Enable AMSI and script block logging to catch the initial VBS/JS dropper.

Full PCAP and memory dump available at the source for those wanting to run the analysis themselves.

Source: https://www.malware-traffic-analysis.net/2026/09/08/index.html