xworm | 28fa1c04ae1ce4ec30392f4aad72ab2369d660cc342d3009aa191ba631570f58

Analysis

max time kernel
829s
max time network
876s
platform
windows11-21h2_x64
resource
win11-20250218-en
resource tags

arch:x64arch:x86image:win11-20250218-enlocale:en-usos:windows11-21h2-x64system
submitted
08/03/2025, 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient.exe
Size

73KB
MD5

09b9adb8a73969977b88cf69ad4b5fe4
SHA1

6267e45323ebffeee2cf59f52b3f12796113dc81
SHA256

28fa1c04ae1ce4ec30392f4aad72ab2369d660cc342d3009aa191ba631570f58
SHA512

425d6999de16c8247e4d8bdb55620a288b071d4ae9defdba01b355c04cedf20110fe8150b4f5e379aac28445bd00b58a5f8106cc1e98ef252dafd09c3d02147f
SSDEEP

1536:FucJ+68zJ3bukiutltZotEZb+38aihGZ762OEK1:8cJmEkiutzZHb0NZfOEK1

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

agreement-uploaded.gl.at.ply.gg:26791

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral4/memory/1832-1-0x00000000006C0000-0x00000000006D8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ip-api.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1832	XClient.exe

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=3856,i,6925591690600939166,85426131164229687,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:14
1⤵
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4080,i,6925591690600939166,85426131164229687,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
1⤵
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4804,i,6925591690600939166,85426131164229687,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
1⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=3788,i,6925591690600939166,85426131164229687,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:14
1⤵
PID:3960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-0-0x00007FFBE8D23000-0x00007FFBE8D25000-memory.dmp

Filesize
8KB

Download
memory/1832-1-0x00000000006C0000-0x00000000006D8000-memory.dmp

Filesize
96KB

Download
memory/1832-2-0x00007FFBE8D20000-0x00007FFBE97E2000-memory.dmp

Filesize
10.8MB

Download
memory/1832-3-0x00007FFBE8D20000-0x00007FFBE97E2000-memory.dmp

Filesize
10.8MB

Download