xworm | 9f154946c6fa841ab93dba5fd341afb2a0a17f1981c46a84dc1787d85e598282

Analysis

max time kernel
288s
max time network
296s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
05/03/2025, 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient.exe
Size

32KB
MD5

4e7ac0e0896e7bd51b85e13b7505df10
SHA1

e00a9e53f181fe32e71837674af6658f21e44c9c
SHA256

9f154946c6fa841ab93dba5fd341afb2a0a17f1981c46a84dc1787d85e598282
SHA512

dcc9d612b0464f9c136f5fbed793f913919f22eb455b80627f05249039449267a6f2f111e8db9f07b8c2473cc8d079fe503c303e763cf331f84f0f43b46d8555
SSDEEP

384:sEbmX5Qa+vN1h1+X3v6JFjL+g93Tm2eaFOYKdRApkFTBLTsOZwpGd2v99IkuishB:hVa+vNtg+PB93Tw4xKdVFE9jqOjhjbw

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

25.ip.gl.ply.gg:2263

Mutex

P6gnwHMCWOnD7e7N

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2628-1-0x00000000008E0000-0x00000000008EE000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2250935964-4080446702-2776729278-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2628	XClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2812	MiniSearchHost.exe

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2812

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
25KB

MD5
441f32a00c4bf0b6b6d079277bb85efd

SHA1
2a4089ae7793f8fc22b2d182b15706dd2a069df3

SHA256
08d2b41ac7b3a6af012c43fa64e9033a91af38f409bfe7be47246cc6b31b0b71

SHA512
2eee1eebf8f723dac77cc1b26769443c12918dd42c6355e1fcacdb3bcc8d6d29b9a3f3bc984223ddbfea91c799bf8995cbd62ca01505852db74607da6c875146

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
25KB

MD5
54f7bd3307ac42493f8fd91f44f7c2d8

SHA1
00a701198d75eb7d7460d3f59b2842071d9b6129

SHA256
9b908c6196f1a4f19df70528b0c51699a6662c898b497218c4af5fa1e383fba1

SHA512
f3da806157d9b7bb59b6ded3d1f68fe3ec53818db5e8fa6e13e6bc01a4c2e78a5e4476cf48beb7a1e3655114152cdf9b68df9b2d2c447d5dc5e12075bb7d360b

Download Submit
memory/2628-0-0x00007FFFE7D83000-0x00007FFFE7D85000-memory.dmp

Filesize
8KB

Download
memory/2628-1-0x00000000008E0000-0x00000000008EE000-memory.dmp

Filesize
56KB

Download
memory/2628-2-0x00007FFFE7D80000-0x00007FFFE8842000-memory.dmp

Filesize
10.8MB

Download
memory/2628-3-0x00007FFFE7D83000-0x00007FFFE7D85000-memory.dmp

Filesize
8KB

Download
memory/2628-4-0x00007FFFE7D80000-0x00007FFFE8842000-memory.dmp

Filesize
10.8MB

Download