xworm | a1d69bc23107f43907d4f7f958973091104c10cf9a6146dfa3b8e2b1fccdb94d

Analysis

max time kernel
66s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/04/2026, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XWormClient.exe
Size 95KB
Sample260430-sb6c8aaz4m
SHA256 a1d69bc23107f43907d4f7f958973091104c10cf9a6146dfa3b8e2b1fccdb94d
MD5 66f4081e2ee51ff7ff3c77e00496e4e7
SHA1 13d3ca2253c8ccacaafc5c503330ebe49cf5aa5c
SHA512 896df22fd43109c9c284fc97a87e7972624befa21a86299c403b5e8c66fee264c7c1fc3d8e7fb03fdf8fe42ce756795b8ad6ae6fdccf699599bc8bbc3f4d68ac
SSDEEP 1536:/liT6xa4OjZ5b1mdICZCrmLcV2fTfBmVAFxM/BOEP4YOxfFfCcgtb6AT:miaR132I/V2fTfBTHREwFxfFf7gtb6AT
TLSH
T17AA37D0EF76A9A84C35D9F73C963544882B9D4677433F77B10C86DE3AC228E8959F580
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution exploit xworm persistence rat trojan

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4804-0-0x0000000000DB0000-0x0000000000DCE000-memory.dmp	family_xworm
behavioral2/files/0x000b0000000244c0-53.dat	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2984	powershell.exe
5436	powershell.exe
816	powershell.exe
1760	powershell.exe

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
1788	takeown.exe
5628	icacls.exe
3368	takeown.exe
5556	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	XWormClient.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YapYap.lnk	XWormClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YapYap.lnk	XWormClient.exe

Executes dropped EXE 2 IoCs

pid	Process
636	YapYap.exe
4924	YapYap.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3368	takeown.exe
5556	icacls.exe
1788	takeown.exe
5628	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YapYap = "C:\\Users\\Admin\\AppData\\Local\\YapYap.exe"	XWormClient.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2984	powershell.exe
2984	powershell.exe
5436	powershell.exe
5436	powershell.exe
816	powershell.exe
816	powershell.exe
1760	powershell.exe
1760	powershell.exe
4804	XWormClient.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	XWormClient.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	5436	powershell.exe
Token: SeDebugPrivilege	816	powershell.exe
Token: SeDebugPrivilege	1760	powershell.exe
Token: SeDebugPrivilege	4804	XWormClient.exe
Token: SeDebugPrivilege	636	YapYap.exe
Token: SeDebugPrivilege	4924	YapYap.exe
Token: SeShutdownPrivilege	4804	XWormClient.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 2984	4804	XWormClient.exe	93
PID 4804 wrote to memory of 5436	4804	XWormClient.exe	95
PID 4804 wrote to memory of 816	4804	XWormClient.exe	97
PID 4804 wrote to memory of 1760	4804	XWormClient.exe	99
PID 4804 wrote to memory of 1620	4804	XWormClient.exe	101
PID 4804 wrote to memory of 5308	4804	XWormClient.exe	109
PID 5308 wrote to memory of 1816	5308	csc.exe	111
PID 4804 wrote to memory of 1788	4804	XWormClient.exe	112
PID 4804 wrote to memory of 5628	4804	XWormClient.exe	114
PID 4804 wrote to memory of 3368	4804	XWormClient.exe	116
PID 4804 wrote to memory of 5556	4804	XWormClient.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XWormClient.exe
"C:\Users\Admin\AppData\Local\Temp\XWormClient.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWormClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\YapYap.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'YapYap.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1760
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "YapYap" /tr "C:\Users\Admin\AppData\Local\YapYap.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1620
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\XWormClient.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_bf57d4c350f243b0b1a0e8ddee185444.cs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5308
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEF7C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB4A232E4F48E4C2FBBECAEDBD683A1B.TMP"
    3⤵
    PID:1816
- C:\Windows\SYSTEM32\takeown.exe
  "takeown" /f "C:\Recovery" /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1788
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Recovery" /grant *S-1-5-18:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5628
- C:\Windows\SYSTEM32\takeown.exe
  "takeown" /f "C:\Recovery\OEM" /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3368
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Recovery\OEM" /grant *S-1-5-18:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5556

C:\Users\Admin\AppData\Local\YapYap.exe
C:\Users\Admin\AppData\Local\YapYap.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:636

C:\Users\Admin\AppData\Local\YapYap.exe
C:\Users\Admin\AppData\Local\YapYap.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YapYap.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\YapYap.exe.log
Size 871B
SHA256 7caf8779608c167ab6fa570df00c973aff6dee850bb63439770889a68c7cdae0
MD5 386677f585908a33791517dfc2317f88
SHA1 2e6853b4560a9ac8a74cdd5c3124a777bc0d874e
SHA512 876d2269e25a4b2754bdf2c7e3c410050f885d7e6bd8abce41c5fc74ae1f8c549b2266dd1588c750f614063f36c8a8e5008cea610505897d04e4ef5c3adc52d9
TLSH
T10911C8312231E1C889223F122C2C298452BF0796A690EE0C719092AED9321275F202E7
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 c695bd38b90537e2862d2f2e90f3401b9dc14af0792251ee897df2d0b0dc9467
MD5 3c99ea4e015d0033c75a3c50304499b1
SHA1 594e0bedf19484deec3202fd44225ea7d52cd888
SHA512 4b0c1d820db21868ec5885f11b6c5986d6ae691f5fda350b8004f8e8972da7b404b9a4cbcb4ed6bb5cf9a03829c99879cb484f7a857339d0c9fb4f9fffb2d46b
TLSH
T181112223F38C8920CC96163A509DAC5172B586DB81AEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 5f936c252c9ed7d08d4a73b86230d9877173b44c36544f0b24eae3eb38617401
MD5 0093819c829dd30c13746f256efba97f
SHA1 f095cbb1d10a54a91d7d341c4098d44973d3ec50
SHA512 72aac852de41473494d2263aa44dbabfb1f318f8a21ebdfe080c4a98b9288db07e9641a935d9a640b5e879f28a0560cae53bd4191ac94d315b87746e57e69af2
TLSH
T1C5112223F38C8920CC96153A509DAC5176B587CB81AFDE9F7FC0D210A5BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 cab7944d29e0501dc0db904ac460ca7a87700e0ec7eb62298b7b97cbf40c424c
MD5 dd1d0b083fedf44b482a028fb70b96e8
SHA1 dc9c027937c9f6d52268a1504cbae42a39c8d36a
SHA512 96bec38bfda176292ae65dcf735103e7888baa212038737c1d1e215fcb76e4c0355e4a827a1934303e7aecae91012fa412f13e38f382b732758bae985cc67973
TLSH
T11E112223F78C8920CC961539509DAC5172B586CB81AFDE9F7FC0C210E1BF584CBA21D4
MD5 SHA1 SHA512 TLSH

Submit Download

RESEF7C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEF7C.tmp
Size 1KB
SHA256 b39d9c9b61489fedc04d7a744907b4cde7721e0453ea82e954db50eee67810cb
MD5 299a4e86566963c6deb2bd89d6504cba
SHA1 1ad1c086043f8f3e9e96915a767c7a7210628801
SHA512 8217304166c9838d0ed5a9c750055fce65c2190c1ce47193cf671bda1e176e6678349e5c5b46de5b4d3934cec99ed462a9801ebabade8e94d214b9a777fe9746
TLSH
T12441330083EC4B1FF172433129F79729A674FE95AFAA475EB084523D1E52744CD836B1
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_n4lrmr3h.sat.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n4lrmr3h.sat.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

YapYap.exe

Path C:\Users\Admin\AppData\Local\YapYap.exe
Size 95KB
SHA256 a1d69bc23107f43907d4f7f958973091104c10cf9a6146dfa3b8e2b1fccdb94d
MD5 66f4081e2ee51ff7ff3c77e00496e4e7
SHA1 13d3ca2253c8ccacaafc5c503330ebe49cf5aa5c
SHA512 896df22fd43109c9c284fc97a87e7972624befa21a86299c403b5e8c66fee264c7c1fc3d8e7fb03fdf8fe42ce756795b8ad6ae6fdccf699599bc8bbc3f4d68ac
SSDEEP 1536:/liT6xa4OjZ5b1mdICZCrmLcV2fTfBmVAFxM/BOEP4YOxfFfCcgtb6AT:miaR132I/V2fTfBTHREwFxfFf7gtb6AT
TLSH
T17AA37D0EF76A9A84C35D9F73C963544882B9D4677433F77B10C86DE3AC228E8959F580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCB4A232E4F48E4C2FBBECAEDBD683A1B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCB4A232E4F48E4C2FBBECAEDBD683A1B.TMP
Size 1KB
SHA256 0cf540b82be6603b2d8291544c0a4e678e143d5349c3babd11a7fb1ec20c3886
MD5 84311251a0b196ef2fdc0c111796601e
SHA1 dffd4472ec2b258d6b000c077fe1b10e22313206
SHA512 3082aa11504014a432cbb81a1efb4afe2008c8e43df9215950e4192e0ed05cb13d1e7d017201ca6993da62395bb8351fb318163fbacb242ed7c8ff8e94a6f69a
TLSH
T1F021EB85A3EC521EF2F3477079F2D3639168BE669D7A83EC3488171F1F25A048483AB1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_bf57d4c350f243b0b1a0e8ddee185444.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_bf57d4c350f243b0b1a0e8ddee185444.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/636-56-0x00000000012B0000-0x00000000012BC000-memory.dmp

Download

memory/816-38-0x000001D92F8C0000-0x000001D92F8CC000-memory.dmp

Download

memory/1760-48-0x00000285C0F10000-0x00000285C0F1C000-memory.dmp

Download

memory/1816-76-0x000002CB816B0000-0x000002CB816BC000-memory.dmp

Download

memory/2984-17-0x0000018279220000-0x000001827922C000-memory.dmp

Download

memory/2984-5-0x000001827B1F0000-0x000001827B200000-memory.dmp

Download

memory/2984-6-0x000001827B1F0000-0x000001827B200000-memory.dmp

Download

memory/2984-14-0x000001827B100000-0x000001827B122000-memory.dmp

Download

memory/4804-68-0x000000001D420000-0x000000001D43C000-memory.dmp

Download

memory/4804-1-0x000000001B940000-0x000000001B950000-memory.dmp

Download

memory/4804-62-0x000000001CCD0000-0x000000001CCD6000-memory.dmp

Download

memory/4804-58-0x000000001C670000-0x000000001C785000-memory.dmp

Download

memory/4804-86-0x0000000002D50000-0x0000000002D58000-memory.dmp

Download

memory/4804-85-0x000000001D440000-0x000000001D4B6000-memory.dmp

Download

memory/4804-69-0x000000001CCE0000-0x000000001CCE6000-memory.dmp

Download

memory/4804-0-0x0000000000DB0000-0x0000000000DCE000-memory.dmp

Download

memory/4804-3-0x000000001B940000-0x000000001B950000-memory.dmp

Download

memory/4804-2-0x0000000001580000-0x000000000158C000-memory.dmp

Download

memory/4804-61-0x000000001D270000-0x000000001D2B4000-memory.dmp

Download

memory/4924-65-0x00000000011A0000-0x00000000011AC000-memory.dmp

Download

memory/5308-78-0x0000021AE31E0000-0x0000021AE31EC000-memory.dmp

Download

memory/5436-28-0x000001C5166B0000-0x000001C5166BC000-memory.dmp

Download