xworm | 88766b00b80c8282be986de16c623ca4b3c84d4fbb1b1b22cf461ca96326258e

Analysis

user interaction
yes
max time kernel
30s
max time network
33s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
15/04/2026, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xMIC.exe
Size 57KB
Sample260415-md1ymaby3p
SHA256 88766b00b80c8282be986de16c623ca4b3c84d4fbb1b1b22cf461ca96326258e
MD5 1180935e36c30a78c2313adf246bc966
SHA1 90a047e5a17fcbecb76a50dffb7d285a1f38bb2c
SHA512 628d85dadcb44ceec6d30794191c2d7969fbc7e98b4555f4b18ea6c7c638686add363350c8735b31679404aca4d216d240058ab3b41ae615a1af008a425a0dd5
SSDEEP 1536:3PAedHd02OspPuf3ccegWkbpH7U3gtrb6DZOuvdyJy:fAsHUsdu0uWkbpqgQZOeoJy
TLSH
T1D3437D8877E64132D2FE4FB518F27222DB79E2239C13D72F18D9418A1B27A89CD507E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Mh0-44853.portmap.host:44853

Attributes

Install_directory
%AppData%
install_file
Myrralis.exe

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/memory/4428-0-0x00000000004A0000-0x00000000004B4000-memory.dmp	family_xworm
behavioral1/files/0x000d0000000283dc-52.dat	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4960	powershell.exe
3088	powershell.exe
4904	powershell.exe
2840	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Control Panel\International\Geo\Nation	xMIC.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Myrralis.lnk	xMIC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Myrralis.lnk	xMIC.exe

Executes dropped EXE 1 IoCs

pid	Process
1200	Myrralis.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Myrralis = "C:\\Users\\Admin\\AppData\\Roaming\\Myrralis.exe"	xMIC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2840	powershell.exe
2840	powershell.exe
4960	powershell.exe
4960	powershell.exe
3088	powershell.exe
3088	powershell.exe
4904	powershell.exe
4904	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4428	xMIC.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeIncreaseQuotaPrivilege	2840	powershell.exe
Token: SeSecurityPrivilege	2840	powershell.exe
Token: SeTakeOwnershipPrivilege	2840	powershell.exe
Token: SeLoadDriverPrivilege	2840	powershell.exe
Token: SeSystemProfilePrivilege	2840	powershell.exe
Token: SeSystemtimePrivilege	2840	powershell.exe
Token: SeProfSingleProcessPrivilege	2840	powershell.exe
Token: SeIncBasePriorityPrivilege	2840	powershell.exe
Token: SeCreatePagefilePrivilege	2840	powershell.exe
Token: SeBackupPrivilege	2840	powershell.exe
Token: SeRestorePrivilege	2840	powershell.exe
Token: SeShutdownPrivilege	2840	powershell.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeSystemEnvironmentPrivilege	2840	powershell.exe
Token: SeRemoteShutdownPrivilege	2840	powershell.exe
Token: SeUndockPrivilege	2840	powershell.exe
Token: SeManageVolumePrivilege	2840	powershell.exe
Token: 33	2840	powershell.exe
Token: 34	2840	powershell.exe
Token: 35	2840	powershell.exe
Token: 36	2840	powershell.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeIncreaseQuotaPrivilege	4960	powershell.exe
Token: SeSecurityPrivilege	4960	powershell.exe
Token: SeTakeOwnershipPrivilege	4960	powershell.exe
Token: SeLoadDriverPrivilege	4960	powershell.exe
Token: SeSystemProfilePrivilege	4960	powershell.exe
Token: SeSystemtimePrivilege	4960	powershell.exe
Token: SeProfSingleProcessPrivilege	4960	powershell.exe
Token: SeIncBasePriorityPrivilege	4960	powershell.exe
Token: SeCreatePagefilePrivilege	4960	powershell.exe
Token: SeBackupPrivilege	4960	powershell.exe
Token: SeRestorePrivilege	4960	powershell.exe
Token: SeShutdownPrivilege	4960	powershell.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeSystemEnvironmentPrivilege	4960	powershell.exe
Token: SeRemoteShutdownPrivilege	4960	powershell.exe
Token: SeUndockPrivilege	4960	powershell.exe
Token: SeManageVolumePrivilege	4960	powershell.exe
Token: 33	4960	powershell.exe
Token: 34	4960	powershell.exe
Token: 35	4960	powershell.exe
Token: 36	4960	powershell.exe
Token: SeDebugPrivilege	3088	powershell.exe
Token: SeIncreaseQuotaPrivilege	3088	powershell.exe
Token: SeSecurityPrivilege	3088	powershell.exe
Token: SeTakeOwnershipPrivilege	3088	powershell.exe
Token: SeLoadDriverPrivilege	3088	powershell.exe
Token: SeSystemProfilePrivilege	3088	powershell.exe
Token: SeSystemtimePrivilege	3088	powershell.exe
Token: SeProfSingleProcessPrivilege	3088	powershell.exe
Token: SeIncBasePriorityPrivilege	3088	powershell.exe
Token: SeCreatePagefilePrivilege	3088	powershell.exe
Token: SeBackupPrivilege	3088	powershell.exe
Token: SeRestorePrivilege	3088	powershell.exe
Token: SeShutdownPrivilege	3088	powershell.exe
Token: SeDebugPrivilege	3088	powershell.exe
Token: SeSystemEnvironmentPrivilege	3088	powershell.exe
Token: SeRemoteShutdownPrivilege	3088	powershell.exe
Token: SeUndockPrivilege	3088	powershell.exe
Token: SeManageVolumePrivilege	3088	powershell.exe
Token: 33	3088	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 2840	4428	xMIC.exe	84
PID 4428 wrote to memory of 4960	4428	xMIC.exe	87
PID 4428 wrote to memory of 3088	4428	xMIC.exe	89
PID 4428 wrote to memory of 4904	4428	xMIC.exe	91
PID 4428 wrote to memory of 2532	4428	xMIC.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\xMIC.exe
"C:\Users\Admin\AppData\Local\Temp\xMIC.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\xMIC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'xMIC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Myrralis.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Myrralis.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Myrralis" /tr "C:\Users\Admin\AppData\Roaming\Myrralis.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2532

C:\Users\Admin\AppData\Roaming\Myrralis.exe
C:\Users\Admin\AppData\Roaming\Myrralis.exe
1⤵
- Executes dropped EXE
PID:1200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
MD5 3eb3833f769dd890afc295b977eab4b4
SHA1 e857649b037939602c72ad003e5d3698695f436f
SHA512 c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
TLSH
T13A51EE313375B0D4C95A7F07193819C063BF8386E698AF58B65C521ED92751B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 13508707da49597d3fe3596f8500782f5f21f183475ffd835c96cccb3d9bc8ac
MD5 9cc2bcbd96127773d2929bf3477e704b
SHA1 233f620efe24cc007e69b1602ed58522dc54c57c
SHA512 9ecdbc615089975c13bb46f119ba6b4e6d56fd7cc71d4dbb981b0835ea9e9ad1e3c1797704f6b4857b7c54f91eb440bd88d1565def50771400fea6bba6c5c5cb
TLSH
T1B7219723B3DDC850CC99063A609C9C9076B6D7C780DEDF9B3EC4C212907FA89CB101A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9c8e8ad7812ea3227948a93354a723c9b1d208e2c62d9344bc9626d20b67891d
MD5 6982e7085a1044c56aa9a47aad756bab
SHA1 dc81d7686dd299a58541835697c2715dfad6d83b
SHA512 b954ceff6e29544dc1972d45d69eaf2b26cf9c1994297c6dcbccca24dc6cd73ef2bbae4b5225fad4b18bc0a9007a535b96cf21ce68c4118b28632de17eb3b59b
TLSH
T1F7215363B3DDC850DC99423A609C9DA076B6D7C780DEDF9B2EC4C216A17FA99CB111A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 498d9b9375169848c6221dc908a40afd2512f4b66f22a5871763a8d5995bbf6b
MD5 e102878dd56c7b0fddc2ed084f0b2d88
SHA1 a704eafaaf91f679b940a8808815a05500cd7ea3
SHA512 97b0a87301be15ad1cb3679864c5c8b0855b813c5d4e67e0672fafd09a17761ce7473fd135c0554de39b126bf3c8b4245a9eaa1f4cc0cc4a2cd36a19096adadc
TLSH
T1C8217423B3DD8850CC99023A609C9C9076B697C780DE9F9B2EC0C216907FA89CB111A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_pf4cdlqt.a41.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pf4cdlqt.a41.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Myrralis.exe

Path C:\Users\Admin\AppData\Roaming\Myrralis.exe
Size 57KB
SHA256 88766b00b80c8282be986de16c623ca4b3c84d4fbb1b1b22cf461ca96326258e
MD5 1180935e36c30a78c2313adf246bc966
SHA1 90a047e5a17fcbecb76a50dffb7d285a1f38bb2c
SHA512 628d85dadcb44ceec6d30794191c2d7969fbc7e98b4555f4b18ea6c7c638686add363350c8735b31679404aca4d216d240058ab3b41ae615a1af008a425a0dd5
SSDEEP 1536:3PAedHd02OspPuf3ccegWkbpH7U3gtrb6DZOuvdyJy:fAsHUsdu0uWkbpqgQZOeoJy
TLSH
T1D3437D8877E64132D2FE4FB518F27222DB79E2239C13D72F18D9418A1B27A89CD507E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1200-57-0x0000000002740000-0x000000000274C000-memory.dmp

Download

memory/2840-3-0x0000028F09B20000-0x0000028F09B42000-memory.dmp

Download

memory/2840-15-0x0000028F081B0000-0x0000028F081BC000-memory.dmp

Download

memory/2840-12-0x0000028F221D0000-0x0000028F221E0000-memory.dmp

Download

memory/2840-11-0x0000028F221D0000-0x0000028F221E0000-memory.dmp

Download

memory/2840-1-0x0000028F221D0000-0x0000028F221E0000-memory.dmp

Download

memory/2840-2-0x0000028F221D0000-0x0000028F221E0000-memory.dmp

Download

memory/3088-36-0x000001D0E0980000-0x000001D0E098C000-memory.dmp

Download

memory/4428-51-0x0000000002520000-0x0000000002530000-memory.dmp

Download

memory/4428-0-0x00000000004A0000-0x00000000004B4000-memory.dmp

Download

memory/4428-54-0x0000000002500000-0x000000000250C000-memory.dmp

Download

memory/4428-55-0x000000001B930000-0x000000001BA44000-memory.dmp

Download

memory/4904-46-0x0000022D05EA0000-0x0000022D05EAC000-memory.dmp

Download

memory/4960-26-0x0000015716CC0000-0x0000015716CCC000-memory.dmp

Download