xworm | 52e09689549aff2c3b22f7d69efa364e8d4e6b3c6eca46c926c310d1ddfedf3f

Analysis

max time kernel
62s
max time network
64s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250217-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
28/02/2025, 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient.exe
Size

33KB
MD5

64ed16ebbb5bd2d6b94bb4b97e10f1de
SHA1

a773b14383fa41ba7514f2888b3a5259676deae3
SHA256

0a5d8947d87f12e44fd14e696d93984d7aaa7cce4715a833ee895f80f14e389e
SHA512

14f249fb78684dc3a73553b89c69034db2280ff7382c5a34df1ad350a6f0b6b53160fd6f5cd961c7fc88afee86412b0159e23fd5e6cfff086176d6aaf7e1ddee
SSDEEP

768:Ym1NILpb4RzVLbiVW5Nm7U6eKc+dW9FW9Y0Ojhoby:YmSpb4RzVCVW5Y8Kc+WFW9Y0OjqO

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

fri-potential.gl.at.ply.gg:2356

Mutex

TPSsTZlAfV3c8oIQ

Attributes

Install_directory
%ProgramData%
install_file
XClient.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/5100-1-0x0000000000280000-0x000000000028E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-983685854-559653692-675906587-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\ProgramData\\XClient.exe"	XClient.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5100	XClient.exe

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5100-0-0x00007FFB55BA3000-0x00007FFB55BA5000-memory.dmp

Filesize
8KB

Download
memory/5100-1-0x0000000000280000-0x000000000028E000-memory.dmp

Filesize
56KB

Download
memory/5100-3-0x00007FFB55BA0000-0x00007FFB56662000-memory.dmp

Filesize
10.8MB

Download
memory/5100-4-0x00007FFB55BA0000-0x00007FFB56662000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads