xworm | 8cc3b44c1e1ada4e94a1cccd5035d725bef8711aadb99e8eaaa59a78d12bf441

Analysis

user interaction
yes
max time kernel
298s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zdasysClient.rar
Size 5.3MB
Sample260425-2cefkacv2n
SHA256 8cc3b44c1e1ada4e94a1cccd5035d725bef8711aadb99e8eaaa59a78d12bf441
MD5 033b181e257c522fe39df837d335d1cc
SHA1 ec59da43e86520519b2f9a9097719669b18c6fba
SHA512 b3963d527130993baca7b89e3e7a78cb17d8744683f9ee818cfd289d1e4c9da2ea5ba3e91228891bc802f01d6be2be6e50c0508da0c6dca26f3f0b11d9edbaba
SSDEEP 98304:6uPrXnGvBat69ROWNSj9KxIrGEl8YWNHhFK6790r6s++1H4ny:6cDrt6bONj9D8VhjjGH4y
TLSH
T1B846334486ABFD5074A7A6BFD4020700C9ECF3A87724103B577FAA7C9D88D6055B7E68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xworm rat trojan

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000700000002449a-14.dat	family_xworm
behavioral1/memory/2564-16-0x00000000000F0000-0x000000000010E000-memory.dmp	family_xworm

Executes dropped EXE 3 IoCs

pid	Process
2564	client.dll
2180	client.dll
1260	client.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	ip-api.com

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4132	7zFM.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	4132	7zFM.exe
Token: 35	4132	7zFM.exe
Token: SeSecurityPrivilege	4132	7zFM.exe
Token: SeDebugPrivilege	2564	client.dll
Token: SeDebugPrivilege	2180	client.dll
Token: SeDebugPrivilege	1260	client.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4132	7zFM.exe
4132	7zFM.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5764 wrote to memory of 2788	5764	cmd.exe	96
PID 5764 wrote to memory of 2564	5764	cmd.exe	97
PID 3232 wrote to memory of 5816	3232	cmd.exe	107
PID 3232 wrote to memory of 2180	3232	cmd.exe	108

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\zdasysClient.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4132

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\zdasysclient\Start.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:5764
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
  javaw -jar "ZdasysIntaller.jar"
  2⤵
  PID:2788
- C:\Users\Admin\Desktop\zdasysclient\client.dll
  client.dll
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\zdasysclient\Start.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
  javaw -jar "ZdasysIntaller.jar"
  2⤵
  PID:5816
- C:\Users\Admin\Desktop\zdasysclient\client.dll
  client.dll
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2180

C:\Users\Admin\Desktop\zdasysclient\client.exe
"C:\Users\Admin\Desktop\zdasysclient\client.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Start.bat

Path C:\Users\Admin\Desktop\zdasysclient\Start.bat
Size 69B
SHA256 74ec92c8c33a785f55ffa9af6118755a70f4175cc053fa86ebf2bc7f49c4fac3
MD5 ce77c24efb35ffe563b9f6f6c176ce58
SHA1 48664a06074f598fe2543f77193a4aed4bfdef90
SHA512 7dc32e43018818b244267091fdccaa0df7029111bf3f70922f8f25bd05f80f54bbe0b6b4b9f6b2c8fbb636eb6ace20cc5348f274fa6d9223042a56cc9967d703
TLSH
T150A00296BA000D7109930E9EE155A6ACF266327D8005A57404819CDDBC6B885B7BC801
MD5 SHA1 SHA512 TLSH

Submit Download

client.dll

Path C:\Users\Admin\Desktop\zdasysclient\client.dll
Size 96KB
SHA256 8defb662f90a60b89e5c1234040d6ce7878921b8cd6ac3bbf1603d95fdebf6c9
MD5 474da3df4b04baa6fd682f1e04ba32e4
SHA1 fd9b5c97d9c00d8e6d5dd4619b916b2527632383
SHA512 5f6c33acad29639b213cb73c5a5d27844f36f4c73366421aa9d1d604df64956ab50183149a19c022c65336b61c5b2ab22c89292a668a5dbea49c4085fc74ba98
SSDEEP 1536:mH3eUDikjRFWRaOrwfofD9ALnjbaZVm5zWQsci79xgoaIelbRaynyA:UuSX3gLauZVmziBxL/elb5nL
TLSH
T1ADA36C4EF7A19545C61C0EB78973644802F9C8B770E3FB7E24CA5EE19D298CD888F548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1260-21-0x0000000002960000-0x000000000296C000-memory.dmp

Download

memory/2180-19-0x00000000011D0000-0x00000000011DC000-memory.dmp

Download

memory/2564-16-0x00000000000F0000-0x000000000010E000-memory.dmp

Download

memory/2564-17-0x00000000008C0000-0x00000000008CC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads