xworm | de11cef9ceb63860790e0c0f4618b4292d2121bdc07db3887303e59cbd429c1d

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 12:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xde11cef9ceb63860790e0c0f4618b4292d2121bdc07db3887303e59cbd429c1d.exe
Size 324KB
Sample260530-pwejfset2j
SHA256 de11cef9ceb63860790e0c0f4618b4292d2121bdc07db3887303e59cbd429c1d
MD5 d9afc4022877fa12bf445e8cbe12e266
SHA1 c89181fbf352f609e0d426664fc4d8d3dfe1240c
SHA512 d67988de289a8f08a278b3f1b53f783c9b7ded898d1375f23a0016734175eef801b053c4f4748dd0d785743ab4ea6d5b252bcaa21f8e93548cc0ee95837ff7ec
SSDEEP 6144:SsR4WOpwO6Wp4IRQPnQd02FM21r0BC2+GXiYI4k:Se4P1sNM2rXi/
TLSH
T19B645C21BA955CECD46BC038C2568B73753274CA1B22EAFB019542393F6AEF56E3C354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V6.5 by c3lestial.fun

77.83.242.171:1431

Attributes

install_file
USB.exe

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x001c00000002b380-4.dat	family_xworm
behavioral2/memory/768-5-0x0000000000A10000-0x0000000000A24000-memory.dmp	family_xworm

Executes dropped EXE 1 IoCs

pid	Process
768	mscorsvw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4288	cmd.exe
388	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
388	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	768	mscorsvw.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 768	2588	xde11cef9ceb63860790e0c0f4618b4292d2121bdc07db3887303e59cbd429c1d.exe	81
PID 2588 wrote to memory of 4288	2588	xde11cef9ceb63860790e0c0f4618b4292d2121bdc07db3887303e59cbd429c1d.exe	82
PID 4288 wrote to memory of 388	4288	cmd.exe	84
PID 4288 wrote to memory of 5232	4288	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\xde11cef9ceb63860790e0c0f4618b4292d2121bdc07db3887303e59cbd429c1d.exe
"C:\Users\Admin\AppData\Local\Temp\xde11cef9ceb63860790e0c0f4618b4292d2121bdc07db3887303e59cbd429c1d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\mscorsvw.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\mscorsvw.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 3 127.0.0.1 > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\xde11cef9ceb63860790e0c0f4618b4292d2121bdc07db3887303e59cbd429c1d.exe" & reg add "HKCU/Software/Microsoft/Windows/CurrentVersion/Run" /v "SysCacheSvc" /d "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\mscorsvw.exe" /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:388
- - C:\Windows\system32\reg.exe
    reg add "HKCU/Software/Microsoft/Windows/CurrentVersion/Run" /v "SysCacheSvc" /d "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\mscorsvw.exe" /f
    3⤵
    PID:5232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mscorsvw.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\mscorsvw.exe
Size 52KB
SHA256 34c1c4c7ffade58f858d97421b121acacf141f5b8b1e8c49fc6461ebe2db7770
MD5 b24909504d291d6ed78d274b7f2c1e89
SHA1 0d6d908f88f328f1f53fd7a12a18017492fa1e13
SHA512 b5550bd711672b64eeca9f4eefaae42560a8520145aadbcd9d66dfd48725b72e8efcc0e4b28d783079a1e3e807608bde6f06736711c4aa8b5b292f89141875ca
SSDEEP 768:dNC51X6+KSXZor7Lzbjr+idbwLT/+Dr7gkbYODYXMBMByOUtk3uOSht2RS:dNyCuIf3jldCCrkkbfU1qVOSWS
TLSH
T1B8337D197BE74139E1FE9FB419F23163DA7AE21359039A5F28C442871B13AC9CD902F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/768-5-0x0000000000A10000-0x0000000000A24000-memory.dmp

Download

memory/768-6-0x0000000002B20000-0x0000000002B30000-memory.dmp

Download

memory/768-7-0x0000000002B20000-0x0000000002B30000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads