xworm | 40863b0157641aa9ebee9b83c94c5ee008bf98f7180b3ddbf1c8bba50d326416

Analysis

user interaction
yes
max time kernel
28s
max time network
29s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
29/04/2026, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
explorer.exe
Size 96KB
Sample260429-a264bsbv5j
SHA256 40863b0157641aa9ebee9b83c94c5ee008bf98f7180b3ddbf1c8bba50d326416
MD5 12dde285c67be423aa369c8a7392e87b
SHA1 0aea9c353b3c78fcbdcb2a26a73782bd60b7644d
SHA512 78146568a1d0c6494ccf937b831e848dacf71757920b74161f9b1bb71d652a3c9dfb97d0aae4c08286bebe446ebbe33d4a6d2d61b87cd37d67c6467cceff9749
SSDEEP 1536:E61HCe522QOpRJpAzJhhD2HTYwfoTbjab4jl+8ARJn66Ql/OTDQi6CoqtUNvDDDG:E61HCe52eRcz3hqfkab4jQJRJncxOTU8
TLSH
T191A37C4437F64226F1BEAEF254E17BE7DA39FD231502963B18C1B56B2E13884CD40AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

uncofig.com:5555

Attributes

Install_directory
%ProgramData%
install_file
explorer.exe

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4436-0-0x0000000000D50000-0x0000000000D6E000-memory.dmp	family_xworm
behavioral2/files/0x000c0000000283ee-48.dat	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4336	powershell.exe
4680	powershell.exe
3036	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3579476765-2645189491-1706875375-1000\Control Panel\International\Geo\Nation	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
4236	explorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3579476765-2645189491-1706875375-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\ProgramData\\explorer.exe"	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3432	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4436	explorer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4336	powershell.exe
4336	powershell.exe
4680	powershell.exe
4680	powershell.exe
3036	powershell.exe
3036	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4436	explorer.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeIncreaseQuotaPrivilege	4336	powershell.exe
Token: SeSecurityPrivilege	4336	powershell.exe
Token: SeTakeOwnershipPrivilege	4336	powershell.exe
Token: SeLoadDriverPrivilege	4336	powershell.exe
Token: SeSystemProfilePrivilege	4336	powershell.exe
Token: SeSystemtimePrivilege	4336	powershell.exe
Token: SeProfSingleProcessPrivilege	4336	powershell.exe
Token: SeIncBasePriorityPrivilege	4336	powershell.exe
Token: SeCreatePagefilePrivilege	4336	powershell.exe
Token: SeBackupPrivilege	4336	powershell.exe
Token: SeRestorePrivilege	4336	powershell.exe
Token: SeShutdownPrivilege	4336	powershell.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeSystemEnvironmentPrivilege	4336	powershell.exe
Token: SeRemoteShutdownPrivilege	4336	powershell.exe
Token: SeUndockPrivilege	4336	powershell.exe
Token: SeManageVolumePrivilege	4336	powershell.exe
Token: 33	4336	powershell.exe
Token: 34	4336	powershell.exe
Token: 35	4336	powershell.exe
Token: 36	4336	powershell.exe
Token: SeDebugPrivilege	4680	powershell.exe
Token: SeIncreaseQuotaPrivilege	4680	powershell.exe
Token: SeSecurityPrivilege	4680	powershell.exe
Token: SeTakeOwnershipPrivilege	4680	powershell.exe
Token: SeLoadDriverPrivilege	4680	powershell.exe
Token: SeSystemProfilePrivilege	4680	powershell.exe
Token: SeSystemtimePrivilege	4680	powershell.exe
Token: SeProfSingleProcessPrivilege	4680	powershell.exe
Token: SeIncBasePriorityPrivilege	4680	powershell.exe
Token: SeCreatePagefilePrivilege	4680	powershell.exe
Token: SeBackupPrivilege	4680	powershell.exe
Token: SeRestorePrivilege	4680	powershell.exe
Token: SeShutdownPrivilege	4680	powershell.exe
Token: SeDebugPrivilege	4680	powershell.exe
Token: SeSystemEnvironmentPrivilege	4680	powershell.exe
Token: SeRemoteShutdownPrivilege	4680	powershell.exe
Token: SeUndockPrivilege	4680	powershell.exe
Token: SeManageVolumePrivilege	4680	powershell.exe
Token: 33	4680	powershell.exe
Token: 34	4680	powershell.exe
Token: 35	4680	powershell.exe
Token: 36	4680	powershell.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeIncreaseQuotaPrivilege	3036	powershell.exe
Token: SeSecurityPrivilege	3036	powershell.exe
Token: SeTakeOwnershipPrivilege	3036	powershell.exe
Token: SeLoadDriverPrivilege	3036	powershell.exe
Token: SeSystemProfilePrivilege	3036	powershell.exe
Token: SeSystemtimePrivilege	3036	powershell.exe
Token: SeProfSingleProcessPrivilege	3036	powershell.exe
Token: SeIncBasePriorityPrivilege	3036	powershell.exe
Token: SeCreatePagefilePrivilege	3036	powershell.exe
Token: SeBackupPrivilege	3036	powershell.exe
Token: SeRestorePrivilege	3036	powershell.exe
Token: SeShutdownPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeSystemEnvironmentPrivilege	3036	powershell.exe
Token: SeRemoteShutdownPrivilege	3036	powershell.exe
Token: SeUndockPrivilege	3036	powershell.exe
Token: SeManageVolumePrivilege	3036	powershell.exe
Token: 33	3036	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4336	4436	explorer.exe	82
PID 4436 wrote to memory of 4680	4436	explorer.exe	85
PID 4436 wrote to memory of 3036	4436	explorer.exe	87
PID 4436 wrote to memory of 3432	4436	explorer.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\explorer.exe
"C:\Users\Admin\AppData\Local\Temp\explorer.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\ProgramData\explorer.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3432

C:\ProgramData\explorer.exe
"C:\ProgramData\explorer.exe"
1⤵
- Executes dropped EXE
PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

explorer.exe

Path C:\ProgramData\explorer.exe
Size 96KB
SHA256 40863b0157641aa9ebee9b83c94c5ee008bf98f7180b3ddbf1c8bba50d326416
MD5 12dde285c67be423aa369c8a7392e87b
SHA1 0aea9c353b3c78fcbdcb2a26a73782bd60b7644d
SHA512 78146568a1d0c6494ccf937b831e848dacf71757920b74161f9b1bb71d652a3c9dfb97d0aae4c08286bebe446ebbe33d4a6d2d61b87cd37d67c6467cceff9749
SSDEEP 1536:E61HCe522QOpRJpAzJhhD2HTYwfoTbjab4jl+8ARJn66Ql/OTDQi6CoqtUNvDDDG:E61HCe52eRcz3hqfkab4jQJRJncxOTU8
TLSH
T191A37C4437F64226F1BEAEF254E17BE7DA39FD231502963B18C1B56B2E13884CD40AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
MD5 3eb3833f769dd890afc295b977eab4b4
SHA1 e857649b037939602c72ad003e5d3698695f436f
SHA512 c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
TLSH
T13A51EE313375B0D4C95A7F07193819C063BF8386E698AF58B65C521ED92751B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6950574e7597f774781a13434de76da7722ead3ad8ba79b61c7d0b2ad9859820
MD5 781d8d7d0c958641e4b67490bbad0717
SHA1 aec2fd5008f9b66ff21dc7364b49527636210702
SHA512 b2b779041fb2b5de7d91c55f470ddd8cea458f4f329c5ae93df5f9e6006a15918e68ed3c7133c74467c6f19b1bfdd92f0b3b7b56cb6048d339a03569c4f340f1
TLSH
T126215323B3DDC850DC99423A609C9DA076B6D7C781DEDF9B3EC4C216A17FA99CB111A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 79afb5effdf990463f18b7a137a537b9dc38f44af7e7f6f25127659021ef50c0
MD5 17778af19fc59e0d1837565339d38967
SHA1 86e7dc5ef03b9e0fc8de825bca0c813e1d0c51ea
SHA512 844084d3f9969c9d3031b2335d2f7622d83561f32b054a18bf5f74665ea2b41b89324b4123bc0c18afb1935267c372cdb1b40c168ad53d00f1f5264d10cafeea
TLSH
T18D215763B3DDC850DCD9423A609C9D9076B6D7C780DEDF9B2EC4C216917FA99CB111A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vhj40y3j.c4d.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vhj40y3j.c4d.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3036-38-0x0000012B5D610000-0x0000012B5D665000-memory.dmp

Download

memory/3036-39-0x0000012B5D6D0000-0x0000012B5D6DC000-memory.dmp

Download

memory/4236-51-0x00000000020F0000-0x00000000020FC000-memory.dmp

Download

memory/4336-10-0x0000017A5EE90000-0x0000017A5EEB2000-memory.dmp

Download

memory/4336-11-0x0000017A5ED50000-0x0000017A5ED60000-memory.dmp

Download

memory/4336-12-0x0000017A5ED50000-0x0000017A5ED60000-memory.dmp

Download

memory/4336-16-0x0000017A44F90000-0x0000017A44F9C000-memory.dmp

Download

memory/4336-1-0x0000017A5ED50000-0x0000017A5ED60000-memory.dmp

Download

memory/4336-2-0x0000017A5ED50000-0x0000017A5ED60000-memory.dmp

Download

memory/4336-15-0x0000017A44F10000-0x0000017A44F65000-memory.dmp

Download

memory/4436-44-0x000000001D000000-0x000000001D06B000-memory.dmp

Download

memory/4436-42-0x0000000002E30000-0x0000000002E40000-memory.dmp

Download

memory/4436-43-0x0000000001500000-0x000000000150C000-memory.dmp

Download

memory/4436-0-0x0000000000D50000-0x0000000000D6E000-memory.dmp

Download

memory/4436-45-0x0000000002E30000-0x0000000002E40000-memory.dmp

Download

memory/4436-47-0x000000001D000000-0x000000001D06B000-memory.dmp

Download

memory/4680-28-0x00000220E5080000-0x00000220E508C000-memory.dmp

Download

memory/4680-27-0x00000220E4D00000-0x00000220E4E9F000-memory.dmp

Download