xworm | dd169e611d6b2a33e6b501edf19acd712c1eca095eb46307305595be547d0bc6

Analysis

max time kernel
124s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20250218-en
resource tags

arch:x64arch:x86image:win11-20250218-enlocale:en-usos:windows11-21h2-x64system
submitted
06/03/2025, 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient4.exe
Size

59KB
MD5

26a94e24ca234dfc97dbc916eab37147
SHA1

518727c55401e1aba25b190d73f6a7621a702b0e
SHA256

dd169e611d6b2a33e6b501edf19acd712c1eca095eb46307305595be547d0bc6
SHA512

8a3606cbaabb0f279e15b1ae0e5f166e666816968a3e60003f8efd5ba7bb39c9f314abe360866737911f789f91770634d54577258fef1315997fb96906be03f2
SSDEEP

1536:m/NPNvXQK47xXyQn7ClbCQzeTb8+P1tx4KKouOaOzoEG:M7vm7xXd7CAnb8rKZuOakZG

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

association-lectures.gl.at.ply.gg:32463

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral5/memory/3344-1-0x00000000000C0000-0x00000000000D6000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3344	XClient4.exe

C:\Users\Admin\AppData\Local\Temp\XClient4.exe
"C:\Users\Admin\AppData\Local\Temp\XClient4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=760,i,2269884594570411122,17736042394233610230,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:14
1⤵
PID:248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4088,i,2269884594570411122,17736042394233610230,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
1⤵
PID:1616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3344-0-0x00007FFFFCAA3000-0x00007FFFFCAA5000-memory.dmp

Filesize
8KB

Download
memory/3344-1-0x00000000000C0000-0x00000000000D6000-memory.dmp

Filesize
88KB

Download
memory/3344-2-0x00007FFFFCAA0000-0x00007FFFFD562000-memory.dmp

Filesize
10.8MB

Download
memory/3344-3-0x00007FFFFCAA0000-0x00007FFFFD562000-memory.dmp

Filesize
10.8MB

Download