xworm | 0b5754b8860c324ba6e5b732f8f4462b528c1dbbde450d3a7c2a3adfb5b5df02

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x0b5754b8860c324ba6e5b732f8f4462b528c1dbbde450d3a7c2a3adfb5b5df02.exe
Size 86KB
Sample260523-c8faasbw9k
SHA256 0b5754b8860c324ba6e5b732f8f4462b528c1dbbde450d3a7c2a3adfb5b5df02
MD5 6b2b850e5dddac2c56e91c756b46f629
SHA1 22ef39d61f4745df7ea102b787998d337b5f599d
SHA512 bceb7f51864e38d56ecf099f34e9c0c25652b2f099d5cfc15c1ad11dbe72edfd599de15eda48a0bf8d6a90981550d93f7be31eb3a2c218d8078c1fe251e7ab72
SSDEEP 1536:p/bkSyZx2ASdeYp+9r9odp3dunhLOtWByZtR/hsxr26rpFAFWF:p/0ZxXghchydunk4ByNhsxr2ceI
TLSH
T16483AE0FA60AACBDC67551B0B4EF627DD732E91A0B6997351205C43CADC08CFBC98AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V5.6

nightfall-59475.portmap.host:4
10.9.222.222:4
31.57.97.169:4

Attributes

Install_directory
%Temp%
install_file
ShellHost.exe
localhost
127.0.0.1

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024595-2.dat	family_xworm
behavioral1/memory/1500-4-0x00000000008D0000-0x00000000008E6000-memory.dmp	family_xworm
behavioral1/memory/4992-9-0x00007FF742FC0000-0x00007FF742FDC000-memory.dmp	family_xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShellHost.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShellHost.lnk	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1500	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1500	svchost.exe
Token: SeDebugPrivilege	1500	svchost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 1500	4992	x0b5754b8860c324ba6e5b732f8f4462b528c1dbbde450d3a7c2a3adfb5b5df02.exe	87

C:\Users\Admin\AppData\Local\Temp\x0b5754b8860c324ba6e5b732f8f4462b528c1dbbde450d3a7c2a3adfb5b5df02.exe
"C:\Users\Admin\AppData\Local\Temp\x0b5754b8860c324ba6e5b732f8f4462b528c1dbbde450d3a7c2a3adfb5b5df02.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\ProgramData\WindowsUpdate\svchost.exe
  "C:\ProgramData\WindowsUpdate\svchost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\ProgramData\WindowsUpdate\svchost.exe
Size 66KB
SHA256 83c6dd2dc54900d749a9903e5e7776e547fd9f517d7a12a8e29ca63a31ac3960
MD5 58d8e590465320689826452bae138588
SHA1 4a121310ac0853188447252fb98568b029444e8d
SHA512 97b41d52eed49b693eca9fe7606f0c49b9f41b4f45d741b7d8db168f216d1063bd02a7790c2ec54135120d21b550d235eae77590d7f6ba18628720d1d65e2ac5
SSDEEP 1536:ZGwWvclhlYHokHugPjxi16kbeZiO2RpvQkQOdtf60nFt:OK+NPjwkkbe38hQObf9Ft
TLSH
T107636C187BE10125F1FFAFF46DE17266CA79F3222913965F14C901860613ACACE926F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1500-4-0x00000000008D0000-0x00000000008E6000-memory.dmp

Download

memory/4992-9-0x00007FF742FC0000-0x00007FF742FDC000-memory.dmp