xworm | d26e302476bfd00956880bcd349b20e9f482c23944f085cf2a0d64eaebc2185c

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xd26e302476bfd00956880bcd349b20e9f482c23944f085cf2a0d64eaebc2185c.exe
Size 664KB
Sample260417-ebjmkahw4x
SHA256 d26e302476bfd00956880bcd349b20e9f482c23944f085cf2a0d64eaebc2185c
MD5 8626bfc4bce3fc0f1801891a9db0d1ca
SHA1 f63f2a9895fe9675599695a40503f19ccedd2e10
SHA512 7a1815a5a6c09ff83e6cdc8c40b8cab6493a0e35bfaa5c4e92d791895944f0c10326c58e40f3aa3e57057eb6a7dce8cccdb8d9f04aaf688ef4ab42ea4dbbb4a4
SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/E/msuaGlsSYymh7vagm:6yvggGLIh7Cz
TLSH
T12FE46B09F3A904E8E5B7863489664152CA3678661B31EADF13D4C13E5F33BE4AE38F51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V5.6

Attributes

Install_directory
%LocalAppData%
install_file
USB.exe
pastebin_url
https://pastebin.com/raw/Fxzr3jeT

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024479-3.dat	family_xworm
behavioral1/memory/5876-12-0x0000000000B80000-0x0000000000B96000-memory.dmp	family_xworm

Executes dropped EXE 1 IoCs

pid	Process
5876	audiodg.exe

Modifies system executable filetype association 2 TTPs 3 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	xd26e302476bfd00956880bcd349b20e9f482c23944f085cf2a0d64eaebc2185c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	xd26e302476bfd00956880bcd349b20e9f482c23944f085cf2a0d64eaebc2185c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	xd26e302476bfd00956880bcd349b20e9f482c23944f085cf2a0d64eaebc2185c.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	xd26e302476bfd00956880bcd349b20e9f482c23944f085cf2a0d64eaebc2185c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	xd26e302476bfd00956880bcd349b20e9f482c23944f085cf2a0d64eaebc2185c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	xd26e302476bfd00956880bcd349b20e9f482c23944f085cf2a0d64eaebc2185c.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 5876	3456	xd26e302476bfd00956880bcd349b20e9f482c23944f085cf2a0d64eaebc2185c.exe	85

C:\Users\Admin\AppData\Local\Temp\xd26e302476bfd00956880bcd349b20e9f482c23944f085cf2a0d64eaebc2185c.exe
"C:\Users\Admin\AppData\Local\Temp\xd26e302476bfd00956880bcd349b20e9f482c23944f085cf2a0d64eaebc2185c.exe"
1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Users\Admin\Documents\diagnostics\audiodg.exe
  "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
  2⤵
  - Executes dropped EXE
  PID:5876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

audiodg.exe

Path C:\Users\Admin\Documents\diagnostics\audiodg.exe
Size 62KB
SHA256 97f641759f6f6d64ce8a8795a7e8ef12657b571428db765a2c636c858776ef2e
MD5 37d611f76e259d8d50dfd398f67d8cb2
SHA1 0b0d64723cdac80358a438e957c315859eadfeb4
SHA512 eb0cface87cff66a1f65ef50cc546c0589f49a724dbc12c36442a2bbdfd266b345c627125208942d8e32af2dc9263bfd90f78f49105eaacf87ca0f5b5c15ff99
SSDEEP 1536:QAw5A/msOFA3asSkD6nFHbAVecYp5waExJO1EA+Bdd:QE/msHasdDOFHbAMuaExJO1Ebdd
TLSH
T19E537C18BBE54129E1BF6FB159F53276DB39F7635903862F28C5028B1A23E85CD006F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5876-12-0x0000000000B80000-0x0000000000B96000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads