Overview

overview

10

Static

static

3

HyWare/HyWare.exe

windows10-2004-x64

10

HyWare/HyWare.exe

windows11-21h2-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    1049s
  • max time network
    1050s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    08/02/2026, 12:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    HyWare/HyWare.exe
  • Size 10.6MB
  • Sample260208-pf446scv8a
  • SHA256 e371777001c7b434b11ece921db891918fbb157a8bdbb2e145d0260f1a94c7f5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionxwormpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

  • xworm

Version

  • XWorm V6.5 by c3lestial.fun

C2

  • penispro8ty2-54766.portmap.host:54766

Mutex

  • 6gxWfC2QEzTQ8WZm

Attributes
  • install_file

    svchost.exe

  • telegram

    https://api.telegram.org/bot8458172172:AAEXvgwkWsHrz9YZkNUanTzyCSc9pDJfFHI/sendMessage?chat_id=7710042824

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Drops startup file 2 IoCs
  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 15 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\HyWare\HyWare.exe
    "C:\Users\Admin\AppData\Local\Temp\HyWare\HyWare.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1324
    • C:\Users\Admin\AppData\Roaming\Nursultan.exe
      "C:\Users\Admin\AppData\Roaming\Nursultan.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2184
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "\svchost.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4568
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:880
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM chrome.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1840
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM firefox.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3680
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM brave.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3988
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM opera.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4248
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM kometa.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:496
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM orbitum.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2128
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM centbrowser.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5048
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM 7star.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1132
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM sputnik.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3172
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM vivaldi.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5244
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM epicprivacybrowser.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2780
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM msedge.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5440
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM uran.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5372
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM yandex.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5480
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM iridium.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5524
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5052
  • C:\svchost.exe
    C:\svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2228
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5668
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2188
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:240
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2720
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5800
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5700
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4640
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3288
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5020
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2532
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1536
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4964
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3088
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5348
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5556
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5628
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5496
  • C:\svchost.exe
    \svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2488

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Browser Information Discovery

        1
        T1217

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        svchost.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log
        • Size 654B
        • SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nursultan.exe
        • Path C:\Users\Admin\AppData\Roaming\Nursultan.exe
        • Size 304KB
        • SHA256 ccd6f3a482b19ac32aae7ef19aca5ed8f820a300ed98c40cf62cfd36d53c9c64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        svchost.exe
        • Path C:\Users\Admin\AppData\Roaming\svchost.exe
        • Size 10.0MB
        • SHA256 f133628ac90ff32edd09868f1cdec9ec436bd53812fe8fe66bc62a243cd038d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1324-0-0x00000000002A0000-0x0000000000D40000-memory.dmp
        Download

        memory/2184-12-0x0000000000A10000-0x0000000000A62000-memory.dmp
        Download

        memory/2184-25-0x000000001CDD0000-0x000000001CDE0000-memory.dmp
        Download

        memory/2184-35-0x000000001CDD0000-0x000000001CDE0000-memory.dmp
        Download