xworm | 653e3256514f0d2021f0d3bfa9a28c5f48dfb93b8b915987089799d91fdd8721

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
my_loader.exe
Size 370KB
Sample260527-2d8e2acx2v
SHA256 653e3256514f0d2021f0d3bfa9a28c5f48dfb93b8b915987089799d91fdd8721
MD5 eda4c621b86c93d3c9ec3e533c3c3268
SHA1 ccb362f04963b8f94ced1ec97f0f21558af95bef
SHA512 32032177194d5b73366529127455ebd6fc77dd1ade2f038f4a1006100f7e8d83821f63f661eaf5ca070d5bf9008ca9fc1d3bc3071cfeba4325cfb40b48492be9
SSDEEP 6144:33u9+VMuHCuRSgEfqjzHQvD9t1u4xwl71eJ9YVaEoJjkWBg/Rbg5qa:usVXRxEfqjzwLb1Oe77TVg/Mq
TLSH
T125848D47BBD555BCD16EC038835B9673B633B48A0231BDBF02E992302F16E555F18B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm rat trojan

Malware Config

Extracted

Family

xworm

7326.info:2686

Attributes

install_file
USB.exe
localhost
127.0.0.1

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/files/0x000400000001dbe7-3.dat	family_xworm
behavioral1/memory/1716-2-0x000001EF4D620000-0x000001EF4D631000-memory.dmp	family_xworm
behavioral1/memory/2268-5-0x00000000002E0000-0x00000000002F8000-memory.dmp	family_xworm
behavioral1/memory/1264-31-0x00007FF776B70000-0x00007FF776BD3000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4636	powershell.exe
1276	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2268	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2268	svchost.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4636	powershell.exe
4636	powershell.exe
1276	powershell.exe
1276	powershell.exe
2268	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2268	svchost.exe
Token: SeDebugPrivilege	4636	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	2268	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2268	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 2268	1264	my_loader.exe	88
PID 1264 wrote to memory of 1716	1264	my_loader.exe	89
PID 1264 wrote to memory of 1716	1264	my_loader.exe	89
PID 2268 wrote to memory of 4636	2268	svchost.exe	95
PID 2268 wrote to memory of 1276	2268	svchost.exe	97

C:\Users\Admin\AppData\Local\Temp\my_loader.exe
"C:\Users\Admin\AppData\Local\Temp\my_loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\Temp\svchost.exe
  "C:\Windows\Temp\svchost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Temp\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1276
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 d0cc04ed0b546b1d7f405da38b5c1addd1fbc26591027e76b9745a9c1daf584e
MD5 a1a5cd54a073fcc6f996c5bf8eae9ab4
SHA1 f51b3b1fe5ec1ace8641c99d2769a0f9f93f640f
SHA512 6804bc8a338f7727396b107ee58e418dae2c086aa85c8edb4d4a90f7398963dc63bab06574ed8b3c593e76d7740ecacec63d1643c6f26058a5d947caafb7673c
TLSH
T14A112223F38C8920CC96163A509DAC5172B586CB81AEDF9F7FC0C210A5BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_i04p3z4q.0cw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i04p3z4q.0cw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Windows\Temp\svchost.exe
Size 67KB
SHA256 520b7d4a21ea1e619b0d3be1e2d7e7242ea6f1be3b7546de6e2e1db088e055c1
MD5 354b11ca3fabc986c4bbadff0f82c332
SHA1 19e220b76bb756ffed2c16f2a89a0279ec8439be
SHA512 49ffbe4f327d7db9c31e9e3d6c1f1768b4d139a4d3395b425d9f375311ef3db1058788d38adb99f919b7d14f83982bcb477f710f4b184c61036da6f4c87a48ab
SSDEEP 1536:kjkWtq4CHrFlYKCRFsoApVT9bMQ0xY5OwU6Viq/tOtm0/h:kjkWtq4CLFKKKtA7T9bMbytOtm8h
TLSH
T1DE637D1C7BE50525E9FE9FB508B37152CB3AB6036913D75F28E9018A1213ECCCA516FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1264-31-0x00007FF776B70000-0x00007FF776BD3000-memory.dmp

Download

memory/1276-30-0x00000136CA570000-0x00000136CA78C000-memory.dmp

Download

memory/1716-2-0x000001EF4D620000-0x000001EF4D631000-memory.dmp

Download

memory/2268-5-0x00000000002E0000-0x00000000002F8000-memory.dmp

Download

memory/4636-8-0x000001BADC6C0000-0x000001BADC6D0000-memory.dmp

Download

memory/4636-7-0x000001BADC6C0000-0x000001BADC6D0000-memory.dmp

Download

memory/4636-16-0x000001BADC640000-0x000001BADC662000-memory.dmp

Download

memory/4636-19-0x000001BADC6D0000-0x000001BADC8EC000-memory.dmp

Download