xworm | be8fd5daf40b87257c42f4712b8879c65833e34f0b872b17d603258261854352

Analysis

max time kernel
33s
max time network
36s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
04/05/2026, 05:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity.exe
Size 33.0MB
Sample260504-fs3mfacv6w
SHA256 be8fd5daf40b87257c42f4712b8879c65833e34f0b872b17d603258261854352
MD5 de7f14b7e94f49a12325ace54b3f811b
SHA1 09d50ab1c8cff44f88b301430e3397d93a349c5e
SHA512 77904e060358a0ee81b9593b0967df72ca2708c2d9a9663e0301fa438b2ab33309213717dafd81fd12c64804215c9b1f6189f6de42edcc9b3055d295a8eafc27
SSDEEP 786432:u649elQ+knSh3QQu3V2Va0Pa+MXlupvkUcZLqBMPsjp:u6fuNnS9QQ7cXXlupDcZSqUp
TLSH
T13A7712C2BB7B9144D94690F094BF122F1ABC5AEF419F5A1A934CBCC1BB7E95482670C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral5/files/0x00080000000284be-27.dat	family_xworm
behavioral5/memory/2436-31-0x0000000000F50000-0x0000000000F6E000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1544	powershell.exe
984	powershell.exe
5096	powershell.exe
4504	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	Runtime Broker.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	Runtime Broker.exe

Executes dropped EXE 3 IoCs

pid	Process
5112	Velocity.exe
2436	Runtime Broker.exe
3412	Runtime Broker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "C:\\Users\\Admin\\AppData\\Roaming\\Runtime Broker.exe"	Runtime Broker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4504	powershell.exe
4504	powershell.exe
1544	powershell.exe
1544	powershell.exe
984	powershell.exe
984	powershell.exe
5096	powershell.exe
5096	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2436	Runtime Broker.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeIncreaseQuotaPrivilege	4504	powershell.exe
Token: SeSecurityPrivilege	4504	powershell.exe
Token: SeTakeOwnershipPrivilege	4504	powershell.exe
Token: SeLoadDriverPrivilege	4504	powershell.exe
Token: SeSystemProfilePrivilege	4504	powershell.exe
Token: SeSystemtimePrivilege	4504	powershell.exe
Token: SeProfSingleProcessPrivilege	4504	powershell.exe
Token: SeIncBasePriorityPrivilege	4504	powershell.exe
Token: SeCreatePagefilePrivilege	4504	powershell.exe
Token: SeBackupPrivilege	4504	powershell.exe
Token: SeRestorePrivilege	4504	powershell.exe
Token: SeShutdownPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeSystemEnvironmentPrivilege	4504	powershell.exe
Token: SeRemoteShutdownPrivilege	4504	powershell.exe
Token: SeUndockPrivilege	4504	powershell.exe
Token: SeManageVolumePrivilege	4504	powershell.exe
Token: 33	4504	powershell.exe
Token: 34	4504	powershell.exe
Token: 35	4504	powershell.exe
Token: 36	4504	powershell.exe
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeIncreaseQuotaPrivilege	1544	powershell.exe
Token: SeSecurityPrivilege	1544	powershell.exe
Token: SeTakeOwnershipPrivilege	1544	powershell.exe
Token: SeLoadDriverPrivilege	1544	powershell.exe
Token: SeSystemProfilePrivilege	1544	powershell.exe
Token: SeSystemtimePrivilege	1544	powershell.exe
Token: SeProfSingleProcessPrivilege	1544	powershell.exe
Token: SeIncBasePriorityPrivilege	1544	powershell.exe
Token: SeCreatePagefilePrivilege	1544	powershell.exe
Token: SeBackupPrivilege	1544	powershell.exe
Token: SeRestorePrivilege	1544	powershell.exe
Token: SeShutdownPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeSystemEnvironmentPrivilege	1544	powershell.exe
Token: SeRemoteShutdownPrivilege	1544	powershell.exe
Token: SeUndockPrivilege	1544	powershell.exe
Token: SeManageVolumePrivilege	1544	powershell.exe
Token: 33	1544	powershell.exe
Token: 34	1544	powershell.exe
Token: 35	1544	powershell.exe
Token: 36	1544	powershell.exe
Token: SeDebugPrivilege	984	powershell.exe
Token: SeIncreaseQuotaPrivilege	984	powershell.exe
Token: SeSecurityPrivilege	984	powershell.exe
Token: SeTakeOwnershipPrivilege	984	powershell.exe
Token: SeLoadDriverPrivilege	984	powershell.exe
Token: SeSystemProfilePrivilege	984	powershell.exe
Token: SeSystemtimePrivilege	984	powershell.exe
Token: SeProfSingleProcessPrivilege	984	powershell.exe
Token: SeIncBasePriorityPrivilege	984	powershell.exe
Token: SeCreatePagefilePrivilege	984	powershell.exe
Token: SeBackupPrivilege	984	powershell.exe
Token: SeRestorePrivilege	984	powershell.exe
Token: SeShutdownPrivilege	984	powershell.exe
Token: SeDebugPrivilege	984	powershell.exe
Token: SeSystemEnvironmentPrivilege	984	powershell.exe
Token: SeRemoteShutdownPrivilege	984	powershell.exe
Token: SeUndockPrivilege	984	powershell.exe
Token: SeManageVolumePrivilege	984	powershell.exe
Token: 33	984	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 5112	3512	Velocity.exe	83
PID 3512 wrote to memory of 2436	3512	Velocity.exe	84
PID 2436 wrote to memory of 4504	2436	Runtime Broker.exe	86
PID 2436 wrote to memory of 1544	2436	Runtime Broker.exe	89
PID 2436 wrote to memory of 984	2436	Runtime Broker.exe	91
PID 2436 wrote to memory of 5096	2436	Runtime Broker.exe	93
PID 2436 wrote to memory of 2460	2436	Runtime Broker.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Users\Admin\AppData\Roaming\Velocity.exe
  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5112
- C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
  "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Runtime Broker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Runtime Broker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5096
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2460

C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
1⤵
- Executes dropped EXE
PID:3412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
MD5 3eb3833f769dd890afc295b977eab4b4
SHA1 e857649b037939602c72ad003e5d3698695f436f
SHA512 c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
TLSH
T13A51EE313375B0D4C95A7F07193819C063BF8386E698AF58B65C521ED92751B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0fca944120eed3109bc8e63df9bf4cc73a57e33e21ee4feffdcff5776f206d1f
MD5 7654feec4c9b169dac9e8ee654c5268a
SHA1 b1725c8712a447ca705f228679d529211c5f3781
SHA512 e48ee0d052e1a2b5936c944a1b2aee1e22ef095fbaf9dcea2f84cbda3041c5c4c38e1daa79fab91196d4e9b55498a46ea18c57cb0d423c5f38e4022fce1ee1c1
TLSH
T1FC219723B3DDC850CC99063A609C9C9076B6D7C780DEDF9B3EC4C211917FA89CB101A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1cf4b698e3120b83ce7b04f5582a430d04c4a47e0bd8fe1d1b136eb7ea141117
MD5 c89671578badca1980abd30ee08c6ef4
SHA1 79cc06f7e038f551be97625c3c5ea0255b89ee25
SHA512 d330c8848fff27bf98f880e58541d08f59a1d8e27ffe1bd6392a65d8057c402eae642f92305303a0a370803f9adba6d5e350e1aeb0f4cea65769d7adc93edf65
TLSH
T175219323B3DDC850CC99023A609C9CA076B6D7C780DEDF9B2EC0C212A07FA89CB101A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6c040aa37326b1490a81680367d627442685327f974e34afb08ca45ca0681276
MD5 e4115b6aec6e8175d5ba82ea5d6814e4
SHA1 c5f4b102a89d96e4e3d42184d14faf2d5ea25791
SHA512 1883d7153e86c5a9df2d5bcd579034208225706f40f544ffb7692cb3fa625cfea992105e551486ce23a12ee905c60b133783324d3604563da7371cd54c9a598e
TLSH
T1B0215323B7DDC850DC99423A609C9DA076B6D7C780DEDF9B2EC4C216A17FA99CB111A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_gahfobkz.vl1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gahfobkz.vl1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Runtime Broker.exe

Path C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
Size 92KB
SHA256 10ceecbe7e7d356c8ef502a071bcaed45bdffd381ad3d39ad6665dbef9ffedc0
MD5 f94a20bb7a69cfd228b2037530caad9a
SHA1 90d0bdff5a60093e1474cba66cea96d239e95ad8
SHA512 6e3037cf821b792be990f2470a607d4351b66f4c022c323e4a8cd64e8be7400c29856738cfe76c8e2d63baa7a81f27434e4a2467a82bb7b24983972099ae265b
SSDEEP 1536:0Dz6w3mClAABp+Ou+xsosUNF/3Xe5qAJCPtQzbgwj9bg/Sk:nc1d1F/Xe4AJC4j9bgp
TLSH
T11A936B4EFB44D65DC26C0E7385A3A04841BAE067B637FB7B24CC9EE11D318E8894F955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Velocity.exe

Path C:\Users\Admin\AppData\Roaming\Velocity.exe
Size 32.9MB
SHA256 873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0
MD5 83da367e14fe39262fcf57c39dc3180b
SHA1 a0d2655ceff2d35b7eceb55e2be1058b966970e2
SHA512 8ce8b77b95640a111d43b75ff76bdfdacfd8680a39c5d5c6a97fdef7aef18bd7470a4df4716fd3c67a51cfed69a710d6c33086c864a0b91ea0c03966b8a97df5
SSDEEP 196608:ktQ56WdpH6emXAro0JTToUgmwh8qZYOCu51ZTAFLzbjblIjvT7CThIPPBrYjPWDx:kt6pHxmXf0J9A8qCFqAFLKnCTMGPWl
TLSH
T1A9779E22A3A44E3DC99F5773E4B603254335CA06AF43939E581CA69C1F933860B59BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/984-64-0x000001F2C7960000-0x000001F2C796C000-memory.dmp

Download

memory/1544-54-0x00000211F5920000-0x00000211F592C000-memory.dmp

Download

memory/2436-31-0x0000000000F50000-0x0000000000F6E000-memory.dmp

Download

memory/2436-81-0x0000000001710000-0x000000000171C000-memory.dmp

Download

memory/2436-82-0x000000001BD10000-0x000000001BD20000-memory.dmp

Download

memory/2436-76-0x000000001BD10000-0x000000001BD20000-memory.dmp

Download

memory/3412-79-0x00000000013A0000-0x00000000013AC000-memory.dmp

Download

memory/3512-0-0x00000000008B0000-0x00000000029BC000-memory.dmp

Download

memory/3512-30-0x0000000004A70000-0x0000000004A7C000-memory.dmp

Download

memory/4504-32-0x000001E679150000-0x000001E679172000-memory.dmp

Download

memory/4504-42-0x000001E65EFA0000-0x000001E65F050000-memory.dmp

Download

memory/4504-43-0x000001E65F2C0000-0x000001E65F2CC000-memory.dmp

Download

memory/5096-74-0x00000218C59E0000-0x00000218C59EC000-memory.dmp

Download

memory/5112-80-0x0000000003AB0000-0x0000000003AF5000-memory.dmp

Download