xworm | a2c79ed9e8c6f6f143182b72bc6524c8d62a7af1efb6973af5ece46fac88eb5a

Analysis

max time kernel
149s
max time network
133s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
29/11/2025, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
37xk8o44.exe
Size 406KB
Sample251129-er24vavpen
SHA256 a2c79ed9e8c6f6f143182b72bc6524c8d62a7af1efb6973af5ece46fac88eb5a
MD5 10772936db74d8871f828ba83497890c
SHA1 f1181dbc0a9134dfdda43dbacd498eb89aba002a
SHA512 80df153e0a89568850d2372adf5d90f8cb7327eb4eb6ac7339ad413cfc88c14f44c664c57669873054f2b4250c4e0ac8fa15a683f9fba625bb49f7ee295029f6
SSDEEP 6144:P+GYnA0zeWiDi5eJHQ8kV3f+RysMFZzN/EOtbMrtE8sNrwY:/YkDi5eJQ7uysMFZzN/dmBm11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm persistence rat trojan

Malware Config

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b15c-3.dat	family_xworm
behavioral2/memory/2900-13-0x0000000000FC0000-0x0000000000FD6000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 1 IoCs

pid	Process
2900	audiodg.exe

Modifies system executable filetype association 2 TTPs 3 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	37xk8o44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	37xk8o44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	37xk8o44.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	37xk8o44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	37xk8o44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	37xk8o44.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2900	1336	37xk8o44.exe	78
PID 1336 wrote to memory of 2900	1336	37xk8o44.exe	78

C:\Users\Admin\AppData\Local\Temp\37xk8o44.exe
"C:\Users\Admin\AppData\Local\Temp\37xk8o44.exe"
1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Users\Admin\Documents\diagnostics\audiodg.exe
  "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
  2⤵
  - Executes dropped EXE
  PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

audiodg.exe

Path C:\Users\Admin\Documents\diagnostics\audiodg.exe
Size 62KB
SHA256 8b7e5402ef6a77a783a3f85fba0bc3a9ad60ac1ff56ad7172e3f96b9a60e3e6f
MD5 8887d55cb4b87cb60053aad9f813910b
SHA1 ffccc4bfa81bdb0e46d19d3b4119f45545891a95
SHA512 a96f87c29868a26639cf0a1ad9200050524ec8bfc84b46158d7a635ece7b9f82a64e917ef0a23c6d20843e304e16c21a66903a847cce39615d98619b18d17678
SSDEEP 1536:QnA3asSkD6nFHbAVecYpVwaExJO1EA+Bdd:QYasdDOFHbAMCaExJO1Ebdd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2900-13-0x0000000000FC0000-0x0000000000FD6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads