xworm | 7addb34dad06f900bbad59cbb549c85b3991a7e71e2a0d5d58b02ebae9ac8c66

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/02/2026, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.exe
Size 37KB
Sample260202-abss1shv7f
SHA256 7addb34dad06f900bbad59cbb549c85b3991a7e71e2a0d5d58b02ebae9ac8c66
MD5 6aeedfbf816d43bdc872a2332a51269c
SHA1 fca4621c30309f5661af4d59df8593ad821441bc
SHA512 385147aea8622399b8da65b34461e3c95a3f0052dd39675cd19bd6f9d98b591f2a49f82d9d2ae6733b4e7d566edd0e4f3661a356576741be5087136e7bf024cb
SSDEEP 384:rhBALokG6Qj+BFbrbvvuyFGxLvUPC5PbTT3rzMurARQaKgO0/pkFMAzNLTAZwY3k:VBW3WyC5PTdsRFOTFQ9YXOMhI43
TLSH
T185036D483BE48216D9FE7FFA3A7366061370EA0B5903E74E1CD4865A6B77BC085407D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

UnknownRazer-39100.portmap.host:39100

Mutex

xsED28l0m7BgEWgJ

Attributes

Install_directory
%AppData%
install_file
Realtek Audio Manager.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3544-0-0x0000000000030000-0x0000000000040000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Realtek Audio Manager.lnk	test.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Realtek Audio Manager.lnk	test.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3544	test.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3544	test.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3544	test.exe

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3544-0-0x0000000000030000-0x0000000000040000-memory.dmp

Download

memory/3544-5-0x000000001C2D0000-0x000000001C2E0000-memory.dmp

Download

memory/3544-6-0x000000001C2D0000-0x000000001C2E0000-memory.dmp

Download