xworm | 1aac2b57e4ed91e927b60a6da86016cb106c04acd72ba7e386df014b3af04ec7 | Triage

Analysis

max time kernel
15s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
07/03/2025, 01:46

Sharing

Report Analysis Logs

General

Target

DeadClient.exe
Size

37KB
MD5

1c0a4077a966af9b9b0af7a084aa60cc
SHA1

0df30cab99c8b2fd971f029ffe153de7b2cd7a56
SHA256

1aac2b57e4ed91e927b60a6da86016cb106c04acd72ba7e386df014b3af04ec7
SHA512

cb7942f59e5c3f7bc436049b393b1ea10438175975b6d660b731fb0c0c2fc8f35e7a48c50d4dc65330edf507c886b5d4c0aceb97e33415a85992ad167faa1323
SSDEEP

768:+50cTBA33MkL9ZT953d9bN+LJtO/hWcc+zs:RQAp9ZT939bN+LXO/DTA

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

xCySIM09xZdOLFxm

Attributes

Install_directory
%Public%
install_file
DeadClient.exe
pastebin_url
https://pastebin.com/raw/wkyMd4PG

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1952-1-0x0000000001020000-0x0000000001030000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 804	1952	DeadClient.exe	30
PID 1952 wrote to memory of 804	1952	DeadClient.exe	30
PID 1952 wrote to memory of 804	1952	DeadClient.exe	30

C:\Users\Admin\AppData\Local\Temp\DeadClient.exe
"C:\Users\Admin\AppData\Local\Temp\DeadClient.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1952 -s 528
  2⤵
  PID:804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1952-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/1952-1-0x0000000001020000-0x0000000001030000-memory.dmp

Filesize
64KB

Download