xworm | 5f45b1ee165a750cae48dea599b7ed585fe28b44f4a7e215e62486efa6480513

Analysis

user interaction
yes
max time kernel
598s
max time network
598s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sipariş - 05.04.2026.vbs
Size 2.4MB
Sample260604-mem36acw21
SHA256 5f45b1ee165a750cae48dea599b7ed585fe28b44f4a7e215e62486efa6480513
MD5 ee002fb541b6e60d3568e1e482c31364
SHA1 837a659b96badf23d5005224ae68ddcba6d01195
SHA512 c57e77ff14986e3c5a47192ffef212c181e38317d7483dc8ab5de24392bdc712ba49670f6e2016357300ec001638fda4c9f8e1fc32d051e9eae0e0d7cd70c767
SSDEEP 768:giiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiio:Mir
TLSH
T1B6C520794D99D76D3EFD0D0BF26567882718B90B6BC664F745ED2DDD2E2ECA8008008E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

203.202.232.132:2828

Mutex

BHbzRLXXV6MmhGaf

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3260-23-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	3328	powershell.exe	84

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2204	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2416	powershell.exe
2204	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2204 set thread context of 3260	2204	powershell.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2416	powershell.exe
2416	powershell.exe
2204	powershell.exe
2204	powershell.exe
2204	powershell.exe
2204	powershell.exe
2204	powershell.exe
2204	powershell.exe
2204	powershell.exe
2204	powershell.exe
2204	powershell.exe
2204	powershell.exe
2204	powershell.exe
2204	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	3260	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 2416	3272	WScript.exe	82
PID 2204 wrote to memory of 2032	2204	powershell.exe	87
PID 2204 wrote to memory of 3688	2204	powershell.exe	88
PID 2204 wrote to memory of 3260	2204	powershell.exe	89
PID 2204 wrote to memory of 3260	2204	powershell.exe	89
PID 2204 wrote to memory of 3260	2204	powershell.exe	89
PID 2204 wrote to memory of 3260	2204	powershell.exe	89
PID 2204 wrote to memory of 3260	2204	powershell.exe	89

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Sipariş - 05.04.2026.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Sipariş - 05.04.2026.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sipariş - 05.04.2026.vbs' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2416

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& ([ScriptBlock]::Create(${env:INTERNAL_DB_CACHE}))"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3688
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c2f3cc0f90a4df89d42271c578ed6c71699c5a0bc1368ff4ab4d2d3668793ba0
MD5 f3bf7aa73f7e7ea25e7604c42b5615aa
SHA1 268850d53e8f7a17f20dd0d2a0ff3a29280e2f27
SHA512 8b2d55e4b57d15e2e5c6fd0facd0d5ca4dfd610f417d2e3bfb6f4a679fa5d4968ee24ead918b30f35bef5ba3e3677ce20c540479f6e2d482288f727f449d5e62
TLSH
T156217833B79CC135C89A117A148DAD01B1B5C3CB009FCECB7A84C518D57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vxzdirfe.xq2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vxzdirfe.xq2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2204-27-0x0000029F8E550000-0x0000029F8F012000-memory.dmp

Download

memory/2204-21-0x0000029FA9A10000-0x0000029FA9AC4000-memory.dmp

Download

memory/2204-22-0x0000029FA9AC0000-0x0000029FA9ACA000-memory.dmp

Download

memory/2416-8-0x000001FC20600000-0x000001FC210C2000-memory.dmp

Download

memory/2416-20-0x000001FC20600000-0x000001FC210C2000-memory.dmp

Download

memory/2416-10-0x000001FC20600000-0x000001FC210C2000-memory.dmp

Download

memory/2416-9-0x000001FC20600000-0x000001FC210C2000-memory.dmp

Download

memory/2416-1-0x000001FC201E0000-0x000001FC20202000-memory.dmp

Download

memory/2416-0-0x000001FC20DCA000-0x000001FC20DCB000-memory.dmp

Download

memory/3260-23-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3260-28-0x00000000059B0000-0x0000000005A4C000-memory.dmp

Download

memory/3260-29-0x0000000006080000-0x00000000060E6000-memory.dmp

Download

memory/3260-30-0x0000000006CB0000-0x0000000006D42000-memory.dmp

Download

memory/3260-31-0x0000000007300000-0x00000000078A6000-memory.dmp

Download