xworm | 37f387d9d653f5bbb85a74ac4294558b12b4698a5f9925b5e92bbe3af91cd68b

Analysis

max time kernel
146s
max time network
108s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
23/03/2025, 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

checker/checker/generator4l.exe
Size

9.1MB
MD5

435b6a39485acf524aedef5ceb85f435
SHA1

8110a9e1c8143ed8076c734c1e94d3657afba215
SHA256

610a13a7a760cd81ac391350ac055281b343a2649271beb2f7b8f4a6f32df1ed
SHA512

7333692e5676c5706f93d9afa8bd7d9930d6805688387e6e23ad680d69e63f074fe7508b47a9ebe5378547b78c369d0574853ba13ca68fee7a9774c4b80983fd
SSDEEP

196608:Ipgo28iTRZq7p+mLM5nxf8tgIfj5PmlSisMa86ZxG7II6pG9:Ipgo284UpOnxUuIfj5wC86Zx2MG

Score

10^/10

xworm pyinstaller rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:4139

Attributes

install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral10/files/0x000700000002ab4e-6.dat	family_xworm
behavioral10/memory/1452-13-0x0000000000220000-0x0000000000236000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 3 IoCs

pid	Process
1452	XClient.exe
2876	checker.exe
5748	checker.exe

Loads dropped DLL 24 IoCs

pid	Process
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe
5748	checker.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral10/files/0x001900000002b07f-19.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1452	XClient.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 1452	3568	generator4l.exe	81
PID 3568 wrote to memory of 1452	3568	generator4l.exe	81
PID 3568 wrote to memory of 2876	3568	generator4l.exe	83
PID 3568 wrote to memory of 2876	3568	generator4l.exe	83
PID 2876 wrote to memory of 5748	2876	checker.exe	85
PID 2876 wrote to memory of 5748	2876	checker.exe	85
PID 5748 wrote to memory of 4732	5748	checker.exe	86
PID 5748 wrote to memory of 4732	5748	checker.exe	86
PID 5748 wrote to memory of 4984	5748	checker.exe	87
PID 5748 wrote to memory of 4984	5748	checker.exe	87

C:\Users\Admin\AppData\Local\Temp\checker\checker\generator4l.exe
"C:\Users\Admin\AppData\Local\Temp\checker\checker\generator4l.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Users\Admin\AppData\Local\Temp\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1452
- C:\Users\Admin\AppData\Local\Temp\checker.exe
  "C:\Users\Admin\AppData\Local\Temp\checker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Users\Admin\AppData\Local\Temp\checker.exe
    "C:\Users\Admin\AppData\Local\Temp\checker.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:4732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c title Zero Tolerance Username Checker
      4⤵
      PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XClient.exe

Filesize
63KB

MD5
50bd3fe74ab820e6642e625e1d4a9f85

SHA1
8fa03dbfaa6a92caccf80d143fe7897cac562da8

SHA256
1b4d0c1d60ee64acd021c9b67faa008cdbbce15403cead7b9cd0685763b90a80

SHA512
eb6870dd1f7ac65551bf62d700521deaaf48b07b2a8c54b097b7573a5750e7722e7ab7e4ffcb9da179422e7583879e3ac0946c7d234ac892e713c26173063f77

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\VCRUNTIME140.dll

Filesize
117KB

MD5
862f820c3251e4ca6fc0ac00e4092239

SHA1
ef96d84b253041b090c243594f90938e9a487a9a

SHA256
36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

SHA512
2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\VCRUNTIME140_1.dll

Filesize
48KB

MD5
68156f41ae9a04d89bb6625a5cd222d4

SHA1
3be29d5c53808186eba3a024be377ee6f267c983

SHA256
82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd

SHA512
f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\_bz2.pyd

Filesize
84KB

MD5
057325e89b4db46e6b18a52d1a691caa

SHA1
8eab0897d679e223aa0d753f6d3d2119f4d72230

SHA256
5ba872caa7fcee0f4fb81c6e0201ceed9bd92a3624f16828dd316144d292a869

SHA512
6bc7606869ca871b7ee5f2d43ec52ed295fa5c3a7df31dbd7e955ddb98c0748aff58d67f09d82edcde9d727e662d1550c6a9cf82f9cb7be021159d4b410e7cbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\_ctypes.pyd

Filesize
131KB

MD5
2185849bc0423f6641ee30804f475478

SHA1
d37ca3e68f4b2111fc0c0cead9695d598795c780

SHA256
199cd8d7db743c316771ef7bbf414ba9a9cdae1f974e90da6103563b2023538d

SHA512
ba89db9f265a546b331482d779ab30131814e42ad3711a837a3450f375d2910bd41b3b3258db90b29cd5afccdc695318fc8ad8cd921a57ce25f69aea539b26ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\_decimal.pyd

Filesize
273KB

MD5
f465c15e7baceac920dc58a5fb922c1c

SHA1
3a5a0156f5288f14938494609d377ede0b67d993

SHA256
f4a486a0ca6a53659159a404614c7e7edccb6bfbcdeb844f6cee544436a826cb

SHA512
22902c1bcca7f80ed064e1e822c253bc8242b4e15e34a878a623e0a562a11203b45d5ff43904268322a7ef5cebb8e80e5fe1f1f1bcaa972e219348f84a1daf5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\_hashlib.pyd

Filesize
63KB

MD5
cf4120bad9a7f77993dd7a95568d83d7

SHA1
ac477c046d14c5306aa09bb65015330701ef0f89

SHA256
14765e83996fe6d50aedc11bb41d7c427a3e846a6a6293a4a46f7ea7e3f14148

SHA512
f905f9d203f86a7b1fc81be3aba51a82174411878c53fd7a62d17f8e26f5010d195f9371fa7400e2e2dc35fda0db0cbe68367fcaf834dd157542e9ee7a9742b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\_lzma.pyd

Filesize
155KB

MD5
3e73bc69efb418e76d38be5857a77027

SHA1
7bee01096669caa7bec81cdc77d6bb2f2346608c

SHA256
6f48e7eba363cb67f3465a6c91b5872454b44fc30b82710dfa4a4489270ce95c

SHA512
b6850e764c8849058488f7051dcabff096709b002d2f427a49e83455838d62a9d3fc7b65285702de2b995858ed433e35a0c4da93c2d5ae34684bf624eb59fa6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\_queue.pyd

Filesize
33KB

MD5
59c05030e47bde800ad937ccb98802d8

SHA1
f7b830029a9371b4e500c1548597beb8fbc1864f

SHA256
e4956834df819c1758d17c1c42a152306f7c0ea7b457ca24ce2f6466a6cb1caa

SHA512
4f5e7ef0948155db6712e1bd7f4f31cb81602b325ba4e6e199f67693913b4bb70bb2c983393646c0ac0d86ef81071907d04bceb8ab0d506b7c5ac7c389fe692d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\_socket.pyd

Filesize
82KB

MD5
69c4a9a654cf6d1684b73a431949b333

SHA1
3c8886dac45bb21a6b11d25893c83a273ff19e0b

SHA256
8daefaff53e6956f5aea5279a7c71f17d8c63e2b0d54031c3b9e82fcb0fb84db

SHA512
cadcec9a6688b54b36dbd125210d1a742047167dad308907a3c4e976b68483a8c6144e02d5cf26f887744dc41af63b7731551287bb3ef8bd947c38c277783c16

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\_ssl.pyd

Filesize
178KB

MD5
ce19076f6b62292ed66fd06e5ba67bba

SHA1
231f6236bdbbe95c662e860d46e56e42c4e3fe28

SHA256
21ca71b2c1766fc68734cb3d1e7c2c0439b86bcfb95e00b367c5fd48c59e617c

SHA512
7357598bc63195c2fd2ddde0376b3ecf5bd0211a286f4a5c1e72e8c68b6e881e7e617f561e7a859c800fe67bec8f4c376e7a6943cab8dacfeda0056b8e864143

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\_wmi.pyd

Filesize
39KB

MD5
e3213cf44340d7b4cb65f7231a65e3a4

SHA1
815e5809a01905ecaa463f6827f657c11b95d243

SHA256
ab87fe4b0cf5b2b17901905ea86367b9756c44845eb463e77435648f0f719354

SHA512
d32b6cb1c5a286b2ce9837051d099fea98f9e5ad00c15b14ccce02b4556d74c4b703b1c94a59670599bf6a9bfbf84c7c22dac25653af9b455999a5e42cf38b7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\base_library.zip

Filesize
1.3MB

MD5
72df9fd996bb2df190f029505e7bb1be

SHA1
d0fd0befea5191b433914661fe20f38ca397bf61

SHA256
cbe23c68e15cce84e2794ac093597abe95f95e137ba28d94b4d171c5a30f20a4

SHA512
1a8a8feb6531588c67d63b997b6c342ccc0c63d0d417051d04daeff85ec1782dcea61ea4193588d2c3b33757d9f786ee5a955a235b7b9fef3e0941484b49b4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\certifi\cacert.pem

Filesize
290KB

MD5
234d271ecb91165aaec148ad6326dd39

SHA1
d7fccec47f7a5fbc549222a064f3053601400b6f

SHA256
c55b21f907f7f86d48add093552fb5651749ff5f860508ccbb423d6c1fbd80c7

SHA512
69289a9b1b923d89ba6e914ab601c9aee4d03ff98f4ed8400780d4b88df5f4d92a8ca1a458abcfde00c8455d3676aca9ec03f7d0593c64b7a05ed0895701d7ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\charset_normalizer\md.cp313-win_amd64.pyd

Filesize
10KB

MD5
480b5eb45af69a315bd2c3b1b34459d1

SHA1
e056c3e8b3c4d46163e105e6095703d092676b5b

SHA256
1f8a5173d8bfe6c569e81c738b830800307ed4586d2ae9ac5cc13a468c6e1892

SHA512
2aefd6356cf6f9ab773e0c19d828c065b41447b0da24c98d0fa2e14b9580e5e7e8f5d3b707e73f682cad85a199f134c42b103740caf3173e8f29e75dadda6623

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

Filesize
122KB

MD5
501b867c424a8e3a41a9be4ab22dbeed

SHA1
97bf5d2c9fa5bb833e739b183a01ce53d19f4a6c

SHA256
437ceb75e7bc7c72c9090558397ef3598b0bc7bc499434af5827028083d300ca

SHA512
38b2d7f2587d73d2edf9cb685ef920ea4c511b88ae9cc25f7fc65d04a87e07ac03024228b9119adfd6914441089cf13ad9d67ff144cf86576cb37d97946677ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\libcrypto-3.dll

Filesize
5.0MB

MD5
123ad0908c76ccba4789c084f7a6b8d0

SHA1
86de58289c8200ed8c1fc51d5f00e38e32c1aad5

SHA256
4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43

SHA512
80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\libssl-3.dll

Filesize
774KB

MD5
4ff168aaa6a1d68e7957175c8513f3a2

SHA1
782f886709febc8c7cebcec4d92c66c4d5dbcf57

SHA256
2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950

SHA512
c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\python3.dll

Filesize
70KB

MD5
98b008be9834bfc362b4c2eef4e8cdb9

SHA1
a4a50ced1329c3986e3c1576f089b25aff5ffdf2

SHA256
4f93342b59addedbe45ebd973e6449ab85b11c0aab6ad7962124e293c5d03638

SHA512
d594ffd7d44d4d862475711973df87b08fb63a900ddfd87c7771ad27f0cc71e5fbdce92da4d4ad5856fe3cfb803257ce0b71cd8dc24ca5c421ddb1b9b44c7881

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\python313.dll

Filesize
5.8MB

MD5
501080884bed38cb8801a307c9d7b7b4

SHA1
881b250cc8f4fa4f75111ac557a4fde8e1e217af

SHA256
bf68cf819a1e865170430c10e91c18b427aef88db1da1742020443864aa2b749

SHA512
63d74a4871d1c72c2a79ae8a5d380070f9d2128c16949c3ad36c9862fcc4dab738137ed3d51caf0bc46b36655f8bd8a2d425d68200123415ee8d4de0e1cbebc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\select.pyd

Filesize
31KB

MD5
2663e22900ab5791c6687a264473ae1e

SHA1
d8db587b6c632200ae13be880cc824cdc8390df9

SHA256
baee284995b22d495fd12fa8378077e470978db1522c61bfb9af37fb827f33d1

SHA512
5f29ff4288b9db33976f5f79b9fd07c4900a560bb41fe98c93a33da7a36c0981ffd71f460e81e13e4f6a2debafa6d9284bc1a728734752ba5ad5fbd766659e80

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\simplejson\_speedups.cp313-win_amd64.pyd

Filesize
40KB

MD5
fa64b0f51b6422d864fab6609ab95e45

SHA1
a816988c34ad9c0023b093f4bc18f900f1a259a1

SHA256
48078d5e4caf18256b1a91bb2f7e8564a7987c49627f6ed462b6898d9b9cc687

SHA512
87fe2ea0780566cf20105f27a7cd7efff01e47412e1771df766a7efe12a0de13749fd5fb3b74f80f0481543582618d01ffa6ef724574527d6bfe1825bf83ab31

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\unicodedata.pyd

Filesize
694KB

MD5
c0b4c55ce3711af914b2015f707e4452

SHA1
f1c1e9f8a461cfee1199d2100f5c0796733518b6

SHA256
a67eec238162fde20ac24ca7df931792734aad0611be22d1b3a71bc15acf72f3

SHA512
fa6bd9223898ef0c54ca9a67b10207bfce152eadbaec4c91d4e951d0790f455066f5095ed739fa2452aea1420d154beb00bfa9e6e10b46bed687c5d0d7484900

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28762\zstandard\backend_c.cp313-win_amd64.pyd

Filesize
508KB

MD5
23266e25821ce9e162f050db8b81c6f9

SHA1
fd1049338e304d7688562991091d59c310999b23

SHA256
0b494d168a67f2eb2d75593714a4db65fe0f000b66388ab3c721a67515a2fefc

SHA512
e118531a6bf5354bf082d4ceaaf5247fea3305a9add399ecbbe08ab083d39ab760f3ca28a0dd2b4d5d8400f3e88ec3decd696e3987fb9f2264a5b8b16f66a61b

Download Submit
C:\Users\Admin\AppData\Local\Temp\checker.exe

Filesize
9.0MB

MD5
7b9d4a4dbe5e07243b9bdc43dca1531c

SHA1
3047842eb91b44bb36bbe9f42c12c94fa62fc5dc

SHA256
c7f2209903cd49faffa956c21e7d612adb1856a233f0a1dbaef590b46245e574

SHA512
27aaed7a9151ec0f300572af3363c2a84d00785c20186dd9640a87af5f245095bcedd2b5f789d14d2ca3f17d8fa0648f64fbb2261c04966c8f93a00712e48ad4

Download Submit
memory/1452-14-0x00007FFAB13A0000-0x00007FFAB1E62000-memory.dmp

Filesize
10.8MB

Download
memory/1452-13-0x0000000000220000-0x0000000000236000-memory.dmp

Filesize
88KB

Download
memory/1452-104-0x00007FFAB13A0000-0x00007FFAB1E62000-memory.dmp

Filesize
10.8MB

Download
memory/1452-105-0x00007FFAB13A0000-0x00007FFAB1E62000-memory.dmp

Filesize
10.8MB

Download
memory/1452-106-0x00007FFAB13A0000-0x00007FFAB1E62000-memory.dmp

Filesize
10.8MB

Download
memory/3568-0-0x00007FFAB13A3000-0x00007FFAB13A5000-memory.dmp

Filesize
8KB

Download
memory/3568-1-0x0000000000FE0000-0x0000000001902000-memory.dmp

Filesize
9.1MB

Download