xworm | 8d0ffcb69cefff7f66be5248e7714549bdaccab163842a86f8baebf7a341ea5d

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/04/2026, 15:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ps_iY3D5NwRZMLv_1776240671633.ps1
Size 266KB
Sample260427-skgffset3t
SHA256 8d0ffcb69cefff7f66be5248e7714549bdaccab163842a86f8baebf7a341ea5d
MD5 b8660b994e264671f61f1b23507d954b
SHA1 8364d8c19e33c580f6b4acf005015a4c6f2594d6
SHA512 9bcf4a14f088964f83514a0a626ef1641efe55fc5ef6af587fb066c18292e5c565c5b336e56eb3c877f5e4b0941effd4b144104d883f99ad316b3e94cbea836b
SSDEEP 6144:ek9WwTjncCsWK0QTD+LgeX/bajbUgnLHtatvuAWWXO8h:t+CM0Q/4gevejb3Lc1uADXv
TLSH
T11A4423306B2D5FB80648A3A941E6F55917F0381FCD89B6AD6AC25EC28C37DE86F1580C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

172.245.244.81:1412

Mutex

QkJeyMye9HuylQnt

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/3156-13-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4212	powershell.exe
2376	powershell.exe
1060	powershell.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/memory/4212-10-0x0000015459760000-0x0000015459772000-memory.dmp	ConfuserEx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4212 set thread context of 3156	4212	powershell.exe	96

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
2376	powershell.exe
2376	powershell.exe
4212	powershell.exe
1060	powershell.exe
1060	powershell.exe
3156	aspnet_compiler.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4212	powershell.exe
Token: SeDebugPrivilege	3156	aspnet_compiler.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	1060	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3156	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 5040	4212	powershell.exe	87
PID 4212 wrote to memory of 4496	4212	powershell.exe	88
PID 4212 wrote to memory of 444	4212	powershell.exe	89
PID 4212 wrote to memory of 2984	4212	powershell.exe	90
PID 4212 wrote to memory of 2496	4212	powershell.exe	91
PID 4212 wrote to memory of 3156	4212	powershell.exe	96
PID 4212 wrote to memory of 3156	4212	powershell.exe	96
PID 4212 wrote to memory of 3156	4212	powershell.exe	96
PID 4212 wrote to memory of 3156	4212	powershell.exe	96
PID 4212 wrote to memory of 3156	4212	powershell.exe	96
PID 3156 wrote to memory of 2376	3156	aspnet_compiler.exe	97
PID 3156 wrote to memory of 1060	3156	aspnet_compiler.exe	102

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ps_iY3D5NwRZMLv_1776240671633.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:444
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2376
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'aspnet_compiler.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 b302ba9f63b9b37d30f57b4b43e0b178d0f3270e326c4e4a7ea58777ce0cd6b3
MD5 5709f90eb2208e43a7db5c4a434b398e
SHA1 8b549d10b74c4796b51ec6b34ed63f0c68d8a5d3
SHA512 d865add51c05ec1c50c867cd35ba63959e9769db8adb9909523263010514894abbfde4b3c62e9e2a2974bd7575c0dfba86d6e1ea843a81ac865bd9e9e71cd968
SSDEEP 384:Ysf+BI9i+r+OIN/pH3oizJk+o9o2TVK6seYwME/l03SoZNfYSgcjEDkyQ0gdEtk6:1fhK/VXejo2TVNfrOSIWCED/Ce3
TLSH
T1BD82E76E611F16C3C49613B8E11B051FE8F2DD8D531A13D8BB1E9F3B8AAC69E903D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_xpcbnxdm.n0p.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xpcbnxdm.n0p.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1060-76-0x0000000004C20000-0x0000000004CA9000-memory.dmp

Download

memory/1060-67-0x000000006FB80000-0x000000006FBCC000-memory.dmp

Download

memory/2376-35-0x000000006FB80000-0x000000006FBCC000-memory.dmp

Download

memory/2376-46-0x0000000007610000-0x000000000762A000-memory.dmp

Download

memory/2376-57-0x0000000004F00000-0x0000000004F89000-memory.dmp

Download

memory/2376-54-0x0000000007B40000-0x0000000007B48000-memory.dmp

Download

memory/2376-53-0x0000000007B60000-0x0000000007B7A000-memory.dmp

Download

memory/2376-16-0x0000000004EC0000-0x0000000004EF6000-memory.dmp

Download

memory/2376-17-0x0000000005610000-0x0000000005C38000-memory.dmp

Download

memory/2376-18-0x0000000005420000-0x0000000005442000-memory.dmp

Download

memory/2376-19-0x0000000005C40000-0x0000000005CA6000-memory.dmp

Download

memory/2376-20-0x0000000005CB0000-0x0000000005D16000-memory.dmp

Download

memory/2376-28-0x0000000005FB0000-0x0000000006304000-memory.dmp

Download

memory/2376-29-0x00000000064F0000-0x000000000650E000-memory.dmp

Download

memory/2376-52-0x0000000007A60000-0x0000000007A74000-memory.dmp

Download

memory/2376-31-0x0000000006530000-0x000000000657C000-memory.dmp

Download

memory/2376-51-0x0000000007A50000-0x0000000007A5E000-memory.dmp

Download

memory/2376-49-0x0000000007A20000-0x0000000007A31000-memory.dmp

Download

memory/2376-34-0x0000000006AB0000-0x0000000006AE2000-memory.dmp

Download

memory/2376-48-0x0000000007AA0000-0x0000000007B36000-memory.dmp

Download

memory/2376-43-0x0000000006AF0000-0x0000000006B0E000-memory.dmp

Download

memory/2376-44-0x00000000074D0000-0x0000000007573000-memory.dmp

Download

memory/2376-45-0x0000000007EF0000-0x000000000856A000-memory.dmp

Download

memory/2376-47-0x0000000007890000-0x000000000789A000-memory.dmp

Download

memory/3156-77-0x0000000005790000-0x00000000057A0000-memory.dmp

Download

memory/3156-84-0x0000000005790000-0x00000000057A0000-memory.dmp

Download

memory/3156-82-0x0000000001400000-0x000000000147B000-memory.dmp

Download

memory/3156-81-0x00000000016D0000-0x00000000017AC000-memory.dmp

Download

memory/3156-80-0x0000000006440000-0x000000000644A000-memory.dmp

Download

memory/3156-79-0x0000000006460000-0x00000000064F2000-memory.dmp

Download

memory/3156-78-0x0000000006800000-0x0000000006DA4000-memory.dmp

Download

memory/3156-14-0x0000000005880000-0x000000000591C000-memory.dmp

Download

memory/3156-13-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4212-30-0x0000015459250000-0x0000015459260000-memory.dmp

Download

memory/4212-10-0x0000015459760000-0x0000015459772000-memory.dmp

Download

memory/4212-9-0x0000015459250000-0x0000015459260000-memory.dmp

Download

memory/4212-6-0x00000154593D0000-0x00000154593F2000-memory.dmp

Download

memory/4212-11-0x0000015459770000-0x0000015459776000-memory.dmp

Download

memory/4212-15-0x0000015459250000-0x0000015459260000-memory.dmp

Download

memory/4212-12-0x0000015459250000-0x0000015459260000-memory.dmp

Download

memory/4212-32-0x000001543F4D0000-0x000001543F4DC000-memory.dmp

Download

memory/4212-50-0x0000015459250000-0x0000015459260000-memory.dmp

Download

memory/4212-33-0x0000015459250000-0x0000015459260000-memory.dmp

Download

memory/4212-0-0x0000015459250000-0x0000015459260000-memory.dmp

Download