xworm | 71e41c8267f4978572b6539c1c4c783be8f9aa0757be466d5465b37e3d2cf9f1

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
10/12/2025, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 69KB
Sample251210-hfjpxawkar
SHA256 71e41c8267f4978572b6539c1c4c783be8f9aa0757be466d5465b37e3d2cf9f1
MD5 0ec60477388b737dbc0e5a7c7a7ceb2b
SHA1 c0d5f447e174eb605d2d016604dd9a440940dda3
SHA512 052a9755ee96156cfcb793215380ba28c723770bd84430cc36e906ed063064ea29acf2005db262f68d569246e7004f36789dc8c13c6f1f7d2287e7a22efe8047
SSDEEP 1536:sQbaDQ+nPyrFBo0xJkw4hXVyEA9bVBBkPhJXo68aO2H5wNSoQjCVEvr:scaDiimJkPyj9bVBBuJX5OxVKCVED
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

73.236.91.227:8808
:8808

Attributes

Install_directory
%Public%
install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2888-0-0x00000000009D0000-0x00000000009E6000-memory.dmp	family_xworm
behavioral2/files/0x002200000002b126-78.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1116	powershell.exe
5140	powershell.exe
2452	powershell.exe
4192	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NobleWebHelper.lnk	Loader.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NobleWebHelper.lnk	Loader.exe

Executes dropped EXE 2 IoCs

pid	Process
4976	NobleWebHelper
5420	NobleWebHelper

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3261906842-2611857369-1513979305-1000\Software\Microsoft\Windows\CurrentVersion\Run\NobleWebHelper = "C:\\Users\\Public\\NobleWebHelper"	Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2576	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2888	Loader.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1116	powershell.exe
1116	powershell.exe
5140	powershell.exe
5140	powershell.exe
2452	powershell.exe
2452	powershell.exe
4192	powershell.exe
4192	powershell.exe
2888	Loader.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2888	Loader.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	5140	powershell.exe
Token: SeDebugPrivilege	2452	powershell.exe
Token: SeDebugPrivilege	4192	powershell.exe
Token: SeDebugPrivilege	2888	Loader.exe
Token: SeDebugPrivilege	4976	NobleWebHelper
Token: SeDebugPrivilege	5420	NobleWebHelper

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2888	Loader.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1116	2888	Loader.exe	78
PID 2888 wrote to memory of 5140	2888	Loader.exe	80
PID 2888 wrote to memory of 2452	2888	Loader.exe	82
PID 2888 wrote to memory of 4192	2888	Loader.exe	84
PID 2888 wrote to memory of 2576	2888	Loader.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Loader.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Loader.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\NobleWebHelper'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'NobleWebHelper'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4192
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "NobleWebHelper" /tr "C:\Users\Public\NobleWebHelper"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2576

C:\Users\Public\NobleWebHelper
C:\Users\Public\NobleWebHelper
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4976

C:\Users\Public\NobleWebHelper
C:\Users\Public\NobleWebHelper
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NobleWebHelper.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NobleWebHelper.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 87b0c970e8d5fce5c168b70336a5d974a198c14dcc0c7fd1f49d6bcc503e63cf
MD5 0a88df6beda14c39a652330cdbadf0f7
SHA1 d988cce1dc5efd40a914b08ab899915eea976f0a
SHA512 a301d13b95738b73560c973142ff9f9f3db6dd13889b126a0a44602ce9d2002d61a13ec061b2842207a168e6e88c4df03c4dd94e2f3a671a26317fa1cc4ea9a3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f2a6df0e450d82b5553f8d45eb98b9f1216c86e5bbd39e64b5bc2f31a0d4972a
MD5 de9dfa930a37c995e22f8b16750cb60b
SHA1 98d8428af277f5260fb00af8b2ff51b03674e593
SHA512 f9b9b7d704e6fad241b8aa0847e444a006bc8e629151dce16761d61522a112239563e840316a75525971d7b41d671ae79777fe9f6ca751585acd0713668d29b4
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 48fab079f87743db47f4a77913ded28a29f890e2c54d6155bab59e7d6e3077b7
MD5 0b23098f177267be4246d62d65e6fe2a
SHA1 654d8a965052aa79841297429b82576491294c31
SHA512 1b9026fd1bed96b065f2c55246ef15bc4dc3f14f2b33ceaf20dca758cbddb8d036705814a803dfffac82769c8399a3c2af9982b81030360d2a2a81eeb6979299
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_r4cmxt2w.a33.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r4cmxt2w.a33.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

NobleWebHelper

Path C:\Users\Public\NobleWebHelper
Size 69KB
SHA256 71e41c8267f4978572b6539c1c4c783be8f9aa0757be466d5465b37e3d2cf9f1
MD5 0ec60477388b737dbc0e5a7c7a7ceb2b
SHA1 c0d5f447e174eb605d2d016604dd9a440940dda3
SHA512 052a9755ee96156cfcb793215380ba28c723770bd84430cc36e906ed063064ea29acf2005db262f68d569246e7004f36789dc8c13c6f1f7d2287e7a22efe8047
SSDEEP 1536:sQbaDQ+nPyrFBo0xJkw4hXVyEA9bVBBkPhJXo68aO2H5wNSoQjCVEvr:scaDiimJkPyj9bVBBuJX5OxVKCVED
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1116-17-0x00007FF412340000-0x00007FF412350000-memory.dmp

Download

memory/1116-27-0x000001D46CBA0000-0x000001D46CBB0000-memory.dmp

Download

memory/1116-20-0x000001D46D050000-0x000001D46D05A000-memory.dmp

Download

memory/1116-21-0x000001D46D2F0000-0x000001D46D30C000-memory.dmp

Download

memory/1116-22-0x000001D46D060000-0x000001D46D06A000-memory.dmp

Download

memory/1116-23-0x000001D46D310000-0x000001D46D32A000-memory.dmp

Download

memory/1116-24-0x000001D46D2D0000-0x000001D46D2D8000-memory.dmp

Download

memory/1116-25-0x000001D46D2E0000-0x000001D46D2E6000-memory.dmp

Download

memory/1116-26-0x000001D46D330000-0x000001D46D33A000-memory.dmp

Download

memory/1116-19-0x000001D46CF90000-0x000001D46D043000-memory.dmp

Download

memory/1116-18-0x000001D46CF70000-0x000001D46CF8C000-memory.dmp

Download

memory/1116-1-0x000001D46CBA0000-0x000001D46CBB0000-memory.dmp

Download

memory/1116-10-0x000001D46CBA0000-0x000001D46CBB0000-memory.dmp

Download

memory/1116-8-0x000001D46CCB0000-0x000001D46CCD2000-memory.dmp

Download

memory/1116-2-0x000001D46CBA0000-0x000001D46CBB0000-memory.dmp

Download

memory/2888-77-0x000000001CD40000-0x000000001CD50000-memory.dmp

Download

memory/2888-76-0x000000001CD40000-0x000000001CD50000-memory.dmp

Download

memory/2888-0-0x00000000009D0000-0x00000000009E6000-memory.dmp

Download