xworm | 8f3b98b4b8e8f27a53e7e6219cdcaf78772fdc159f7479bacb6be6f7415c96d8

Analysis

max time kernel
150s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xhs.exe
Size 955KB
Sample260605-xn7t2acy21
SHA256 8f3b98b4b8e8f27a53e7e6219cdcaf78772fdc159f7479bacb6be6f7415c96d8
MD5 40e873eadbd8a6cc0d46d0b7d44f476c
SHA1 292e9cc6319415f874b01a15b972e765001cf227
SHA512 04c88f75381e98031c3aa09aa6ad84463f4315e7507508eccc5f2f909b2f3e5d66a2119a16290250837bc287c92a5f0fd3e7de16fe8b22f8cbedcac144ab8564
SSDEEP 24576:3qg3GK/G0bSJt8haVUSxvyvmuea8TtVp:nZ/GhxHxvyvmuea8Tt
TLSH
T15025B3B4C9F04A1CDB2AC1BC65539D5B1BE3DBB4A311C70E15CB6E6CFE021D2B0156AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

129g5egbrl.localto.net:9818

Mutex

KrOifhcbnVNnkQXK

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1032-15-0x00000241BF9A0000-0x00000241BF9AE000-memory.dmp	family_xworm

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4712 created 1032	4712	WerFault.exe	80

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1284 created 1032	1284	svchost.exe	80

Executes dropped EXE 1 IoCs

pid	Process
3972	xslkd00g.qgw.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1780686165"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={195D8024-1AE8-402B-925E-4139DA0669A4}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Fri, 05 Jun 2026 19:02:46 GMT"	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
3972	xslkd00g.qgw.exe
3972	xslkd00g.qgw.exe
3972	xslkd00g.qgw.exe
3972	xslkd00g.qgw.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe
1032	xhs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3216	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	xhs.exe
Token: SeDebugPrivilege	3972	xslkd00g.qgw.exe
Token: SeAssignPrimaryTokenPrivilege	2708	svchost.exe
Token: SeIncreaseQuotaPrivilege	2708	svchost.exe
Token: SeSecurityPrivilege	2708	svchost.exe
Token: SeTakeOwnershipPrivilege	2708	svchost.exe
Token: SeLoadDriverPrivilege	2708	svchost.exe
Token: SeSystemtimePrivilege	2708	svchost.exe
Token: SeBackupPrivilege	2708	svchost.exe
Token: SeRestorePrivilege	2708	svchost.exe
Token: SeShutdownPrivilege	2708	svchost.exe
Token: SeSystemEnvironmentPrivilege	2708	svchost.exe
Token: SeUndockPrivilege	2708	svchost.exe
Token: SeManageVolumePrivilege	2708	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2708	svchost.exe
Token: SeIncreaseQuotaPrivilege	2708	svchost.exe
Token: SeSecurityPrivilege	2708	svchost.exe
Token: SeTakeOwnershipPrivilege	2708	svchost.exe
Token: SeLoadDriverPrivilege	2708	svchost.exe
Token: SeSystemtimePrivilege	2708	svchost.exe
Token: SeBackupPrivilege	2708	svchost.exe
Token: SeRestorePrivilege	2708	svchost.exe
Token: SeShutdownPrivilege	2708	svchost.exe
Token: SeSystemEnvironmentPrivilege	2708	svchost.exe
Token: SeUndockPrivilege	2708	svchost.exe
Token: SeManageVolumePrivilege	2708	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2708	svchost.exe
Token: SeIncreaseQuotaPrivilege	2708	svchost.exe
Token: SeSecurityPrivilege	2708	svchost.exe
Token: SeTakeOwnershipPrivilege	2708	svchost.exe
Token: SeLoadDriverPrivilege	2708	svchost.exe
Token: SeSystemtimePrivilege	2708	svchost.exe
Token: SeBackupPrivilege	2708	svchost.exe
Token: SeRestorePrivilege	2708	svchost.exe
Token: SeShutdownPrivilege	2708	svchost.exe
Token: SeSystemEnvironmentPrivilege	2708	svchost.exe
Token: SeUndockPrivilege	2708	svchost.exe
Token: SeManageVolumePrivilege	2708	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2708	svchost.exe
Token: SeIncreaseQuotaPrivilege	2708	svchost.exe
Token: SeSecurityPrivilege	2708	svchost.exe
Token: SeTakeOwnershipPrivilege	2708	svchost.exe
Token: SeLoadDriverPrivilege	2708	svchost.exe
Token: SeSystemtimePrivilege	2708	svchost.exe
Token: SeBackupPrivilege	2708	svchost.exe
Token: SeRestorePrivilege	2708	svchost.exe
Token: SeShutdownPrivilege	2708	svchost.exe
Token: SeSystemEnvironmentPrivilege	2708	svchost.exe
Token: SeUndockPrivilege	2708	svchost.exe
Token: SeManageVolumePrivilege	2708	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2708	svchost.exe
Token: SeIncreaseQuotaPrivilege	2708	svchost.exe
Token: SeSecurityPrivilege	2708	svchost.exe
Token: SeTakeOwnershipPrivilege	2708	svchost.exe
Token: SeLoadDriverPrivilege	2708	svchost.exe
Token: SeSystemtimePrivilege	2708	svchost.exe
Token: SeBackupPrivilege	2708	svchost.exe
Token: SeRestorePrivilege	2708	svchost.exe
Token: SeShutdownPrivilege	2708	svchost.exe
Token: SeSystemEnvironmentPrivilege	2708	svchost.exe
Token: SeUndockPrivilege	2708	svchost.exe
Token: SeManageVolumePrivilege	2708	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2708	svchost.exe
Token: SeIncreaseQuotaPrivilege	2708	svchost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE
3216	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3768	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 3972	1032	xhs.exe	81
PID 3972 wrote to memory of 636	3972	xslkd00g.qgw.exe	5
PID 3972 wrote to memory of 700	3972	xslkd00g.qgw.exe	7
PID 3972 wrote to memory of 904	3972	xslkd00g.qgw.exe	11
PID 3972 wrote to memory of 396	3972	xslkd00g.qgw.exe	13
PID 3972 wrote to memory of 716	3972	xslkd00g.qgw.exe	14
PID 3972 wrote to memory of 896	3972	xslkd00g.qgw.exe	15
PID 3972 wrote to memory of 1044	3972	xslkd00g.qgw.exe	16
PID 3972 wrote to memory of 1120	3972	xslkd00g.qgw.exe	17
PID 3972 wrote to memory of 1140	3972	xslkd00g.qgw.exe	18
PID 3972 wrote to memory of 1220	3972	xslkd00g.qgw.exe	19
PID 3972 wrote to memory of 1268	3972	xslkd00g.qgw.exe	21
PID 3972 wrote to memory of 1312	3972	xslkd00g.qgw.exe	22
PID 3972 wrote to memory of 1340	3972	xslkd00g.qgw.exe	23
PID 3972 wrote to memory of 1376	3972	xslkd00g.qgw.exe	24
PID 3972 wrote to memory of 1564	3972	xslkd00g.qgw.exe	25
PID 3972 wrote to memory of 1620	3972	xslkd00g.qgw.exe	26
PID 3972 wrote to memory of 1676	3972	xslkd00g.qgw.exe	27
PID 3972 wrote to memory of 1764	3972	xslkd00g.qgw.exe	28
PID 3972 wrote to memory of 1780	3972	xslkd00g.qgw.exe	29
PID 3972 wrote to memory of 1884	3972	xslkd00g.qgw.exe	30
PID 3972 wrote to memory of 1912	3972	xslkd00g.qgw.exe	31
PID 3972 wrote to memory of 1920	3972	xslkd00g.qgw.exe	32
PID 3972 wrote to memory of 2000	3972	xslkd00g.qgw.exe	33
PID 3972 wrote to memory of 2044	3972	xslkd00g.qgw.exe	34
PID 3972 wrote to memory of 1960	3972	xslkd00g.qgw.exe	35
PID 3972 wrote to memory of 2056	3972	xslkd00g.qgw.exe	36
PID 3972 wrote to memory of 2108	3972	xslkd00g.qgw.exe	37
PID 3972 wrote to memory of 2236	3972	xslkd00g.qgw.exe	38
PID 3972 wrote to memory of 2268	3972	xslkd00g.qgw.exe	39
PID 3972 wrote to memory of 2412	3972	xslkd00g.qgw.exe	41
PID 3972 wrote to memory of 2572	3972	xslkd00g.qgw.exe	42
PID 3972 wrote to memory of 2580	3972	xslkd00g.qgw.exe	43
PID 3972 wrote to memory of 2612	3972	xslkd00g.qgw.exe	44
PID 3972 wrote to memory of 2652	3972	xslkd00g.qgw.exe	45
PID 3972 wrote to memory of 2700	3972	xslkd00g.qgw.exe	46
PID 3972 wrote to memory of 2708	3972	xslkd00g.qgw.exe	47
PID 3972 wrote to memory of 2720	3972	xslkd00g.qgw.exe	48
PID 3972 wrote to memory of 2872	3972	xslkd00g.qgw.exe	49
PID 3972 wrote to memory of 2844	3972	xslkd00g.qgw.exe	51
PID 3972 wrote to memory of 672	3972	xslkd00g.qgw.exe	52
PID 3972 wrote to memory of 2672	3972	xslkd00g.qgw.exe	53
PID 3972 wrote to memory of 3216	3972	xslkd00g.qgw.exe	54
PID 3972 wrote to memory of 3344	3972	xslkd00g.qgw.exe	55
PID 3972 wrote to memory of 3396	3972	xslkd00g.qgw.exe	56
PID 3972 wrote to memory of 3704	3972	xslkd00g.qgw.exe	59
PID 3972 wrote to memory of 3768	3972	xslkd00g.qgw.exe	60
PID 3972 wrote to memory of 3844	3972	xslkd00g.qgw.exe	61
PID 3972 wrote to memory of 3916	3972	xslkd00g.qgw.exe	62
PID 3972 wrote to memory of 4148	3972	xslkd00g.qgw.exe	63
PID 3972 wrote to memory of 4388	3972	xslkd00g.qgw.exe	64
PID 3972 wrote to memory of 948	3972	xslkd00g.qgw.exe	68
PID 3972 wrote to memory of 2536	3972	xslkd00g.qgw.exe	69
PID 3972 wrote to memory of 4056	3972	xslkd00g.qgw.exe	71
PID 3972 wrote to memory of 1952	3972	xslkd00g.qgw.exe	72
PID 3972 wrote to memory of 4360	3972	xslkd00g.qgw.exe	73
PID 3972 wrote to memory of 3568	3972	xslkd00g.qgw.exe	74
PID 3972 wrote to memory of 1776	3972	xslkd00g.qgw.exe	75
PID 3972 wrote to memory of 460	3972	xslkd00g.qgw.exe	76
PID 3972 wrote to memory of 3564	3972	xslkd00g.qgw.exe	77
PID 3972 wrote to memory of 2368	3972	xslkd00g.qgw.exe	78
PID 3972 wrote to memory of 1032	3972	xslkd00g.qgw.exe	80
PID 3972 wrote to memory of 1060	3972	xslkd00g.qgw.exe	82
PID 3972 wrote to memory of 1284	3972	xslkd00g.qgw.exe	83

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:636
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:716

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:700

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c5009ee4-9b18-46f1-a5c8-1aa5fd27776e -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e5dedb3c-0223-4053-bd7d-07efb3634292 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-45cceaac-99e1-4e40-84b7-9dc365415872 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-16559f80-68a1-4330-b87c-d7550a8fff96 -LifetimeId:03b4a64b-16de-4c00-9755-89c50eb75540 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1268
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1312

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1564
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1884

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2236

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:672

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3216
- C:\Users\Admin\AppData\Local\Temp\xhs.exe
  "C:\Users\Admin\AppData\Local\Temp\xhs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Users\Admin\AppData\Local\Temp\xslkd00g.qgw.exe
    "C:\Users\Admin\AppData\Local\Temp\xslkd00g.qgw.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3972
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 1032 -s 1812
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:2316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3396

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3704

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:3768

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3916

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1952

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3568

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:460

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2368

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Enumerates system info in registry
PID:1060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:1284
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 452 -p 1032 -ip 1032
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WER.ed65c28d-7640-4387-8047-db305866e4d3.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.ed65c28d-7640-4387-8047-db305866e4d3.tmp.txt
Size 13KB
SHA256 378dfddf49e48a316df5c4e73507d1c0cfb350b4854f0cf132835ccd6d1d5fe5
MD5 bcdd881b16c9d190f05e40a105263033
SHA1 ffe175fd34086418fd4128a56809d962f8139d90
SHA512 393ce2d5b1a2f6119cdaf32e5291774f76ab2fa6fb44c690d9bdcb8609a65f91702a974140d4999310c9428d2bb9eb046dae27197379afc63289e86d0a027005
SSDEEP 96:4iefWmMcY0oaYuYeWNHsYEZ0NRtoiDFyc3wBkogaWYacMitSImt3:Nef1pIKOaWFcMit1mt3
TLSH
T12252625616E80359F6F75E48A5F020A58773F872AE39CA4D00DE130E87E3E41E865FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.f58b9a6e-1502-4dbb-986b-0aa936b59e2c.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.f58b9a6e-1502-4dbb-986b-0aa936b59e2c.tmp.csv
Size 35KB
SHA256 b70fd1094543648b47bc432f1bfaf64416051616e65f4ad80cb15b1c6cb644ef
MD5 5c95864ef1bced6bbcc4d807b9776c85
SHA1 40876cd56eef0950716707ca928888de9b671f34
SHA512 24b9a6a11cb8cae56cf5c7926e1c0ed8ee69d379ac0ff49c56ba2a1ef02b86bf3bb382f898053810fdc297d1cd339761fc0a0baca284598f07c43b1ff1fc577b
SSDEEP 768:TQLUpCaSo9SggSOeygBoeKR/AyXJqe6dfI7KRVBzmaXgZE:TQLUHSo9BOeygBoeK55qZIqHgZE
TLSH
T1FFF2553ECEEC063FC2B6DA1CC4E64607F895A993361DED4A94C3678A4457583BCD122E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xslkd00g.qgw.exe

Path C:\Users\Admin\AppData\Local\Temp\xslkd00g.qgw.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/396-286-0x000001C955520000-0x000001C95554B000-memory.dmp

Download

memory/396-36-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/396-35-0x000001C955520000-0x000001C95554B000-memory.dmp

Download

memory/396-40-0x000001C955520000-0x000001C95554B000-memory.dmp

Download

memory/636-17-0x000002D943C00000-0x000002D943C2B000-memory.dmp

Download

memory/636-18-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/636-16-0x000002D9439B0000-0x000002D9439D5000-memory.dmp

Download

memory/636-24-0x000002D943C00000-0x000002D943C2B000-memory.dmp

Download

memory/700-25-0x00000207270C0000-0x00000207270EB000-memory.dmp

Download

memory/700-21-0x00000207270C0000-0x00000207270EB000-memory.dmp

Download

memory/700-22-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/716-38-0x00000137F2980000-0x00000137F29AB000-memory.dmp

Download

memory/716-29-0x00000137F2980000-0x00000137F29AB000-memory.dmp

Download

memory/716-30-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/896-42-0x0000014C14A90000-0x0000014C14ABB000-memory.dmp

Download

memory/896-43-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/896-45-0x0000014C14A90000-0x0000014C14ABB000-memory.dmp

Download

memory/896-297-0x0000014C14A90000-0x0000014C14ABB000-memory.dmp

Download

memory/904-39-0x0000023906EA0000-0x0000023906ECB000-memory.dmp

Download

memory/904-32-0x0000023906EA0000-0x0000023906ECB000-memory.dmp

Download

memory/904-285-0x0000023906EA0000-0x0000023906ECB000-memory.dmp

Download

memory/904-33-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/1032-66-0x00000241A5900000-0x00000241A5910000-memory.dmp

Download

memory/1032-4-0x00000241A5910000-0x00000241A593C000-memory.dmp

Download

memory/1032-88-0x00000241A5900000-0x00000241A5910000-memory.dmp

Download

memory/1032-3-0x00000241BFA00000-0x00000241BFBC2000-memory.dmp

Download

memory/1032-15-0x00000241BF9A0000-0x00000241BF9AE000-memory.dmp

Download

memory/1032-1-0x00000241A5900000-0x00000241A5910000-memory.dmp

Download

memory/1032-2-0x00000241A5900000-0x00000241A5910000-memory.dmp

Download

memory/1032-0-0x00000241A3AB0000-0x00000241A3BA4000-memory.dmp

Download

memory/1044-51-0x0000020BA32F0000-0x0000020BA331B000-memory.dmp

Download

memory/1044-328-0x0000020BA32F0000-0x0000020BA331B000-memory.dmp

Download

memory/1044-52-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/1044-67-0x0000020BA32F0000-0x0000020BA331B000-memory.dmp

Download

memory/1120-54-0x0000028E1AF40000-0x0000028E1AF6B000-memory.dmp

Download

memory/1120-329-0x0000028E1AF40000-0x0000028E1AF6B000-memory.dmp

Download

memory/1120-68-0x0000028E1AF40000-0x0000028E1AF6B000-memory.dmp

Download

memory/1120-55-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/1140-69-0x000002A0BBB00000-0x000002A0BBB2B000-memory.dmp

Download

memory/1140-57-0x000002A0BBB00000-0x000002A0BBB2B000-memory.dmp

Download

memory/1140-58-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/1140-330-0x000002A0BBB00000-0x000002A0BBB2B000-memory.dmp

Download

memory/1220-331-0x0000021D345D0000-0x0000021D345FB000-memory.dmp

Download

memory/1220-70-0x0000021D345D0000-0x0000021D345FB000-memory.dmp

Download

memory/1220-60-0x0000021D345D0000-0x0000021D345FB000-memory.dmp

Download

memory/1220-61-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/1268-64-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/1268-332-0x000002129CBB0000-0x000002129CBDB000-memory.dmp

Download

memory/1268-63-0x000002129CBB0000-0x000002129CBDB000-memory.dmp

Download

memory/1268-71-0x000002129CBB0000-0x000002129CBDB000-memory.dmp

Download

memory/1312-89-0x00000161B4DA0000-0x00000161B4DCB000-memory.dmp

Download

memory/1312-76-0x00000161B4DA0000-0x00000161B4DCB000-memory.dmp

Download

memory/1312-334-0x00000161B4DA0000-0x00000161B4DCB000-memory.dmp

Download

memory/1312-77-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/1340-90-0x000002755F000000-0x000002755F02B000-memory.dmp

Download

memory/1340-335-0x000002755F000000-0x000002755F02B000-memory.dmp

Download

memory/1340-80-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/1340-79-0x000002755F000000-0x000002755F02B000-memory.dmp

Download

memory/1376-82-0x000001937F940000-0x000001937F96B000-memory.dmp

Download

memory/1376-83-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/1376-91-0x000001937F940000-0x000001937F96B000-memory.dmp

Download

memory/1376-336-0x000001937F940000-0x000001937F96B000-memory.dmp

Download

memory/1564-85-0x000001BC1FC60000-0x000001BC1FC8B000-memory.dmp

Download

memory/1564-86-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/1564-92-0x000001BC1FC60000-0x000001BC1FC8B000-memory.dmp

Download

memory/1564-337-0x000001BC1FC60000-0x000001BC1FC8B000-memory.dmp

Download

memory/1620-338-0x000002323B3B0000-0x000002323B3DB000-memory.dmp

Download

memory/1620-115-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/1620-177-0x000002323B3B0000-0x000002323B3DB000-memory.dmp

Download

memory/1620-114-0x000002323B3B0000-0x000002323B3DB000-memory.dmp

Download

memory/1676-117-0x0000021303110000-0x000002130313B000-memory.dmp

Download

memory/1676-178-0x0000021303110000-0x000002130313B000-memory.dmp

Download

memory/1676-118-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/1676-339-0x0000021303110000-0x000002130313B000-memory.dmp

Download

memory/1764-121-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/1764-340-0x000001FC7AA70000-0x000001FC7AA9B000-memory.dmp

Download

memory/1764-179-0x000001FC7AA70000-0x000001FC7AA9B000-memory.dmp

Download

memory/1764-120-0x000001FC7AA70000-0x000001FC7AA9B000-memory.dmp

Download

memory/1780-341-0x00000180D86B0000-0x00000180D86DB000-memory.dmp

Download

memory/1780-123-0x00000180D86B0000-0x00000180D86DB000-memory.dmp

Download

memory/1780-124-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/1780-180-0x00000180D86B0000-0x00000180D86DB000-memory.dmp

Download

memory/1884-342-0x0000013339D10000-0x0000013339D3B000-memory.dmp

Download

memory/1884-181-0x0000013339D10000-0x0000013339D3B000-memory.dmp

Download

memory/1884-126-0x0000013339D10000-0x0000013339D3B000-memory.dmp

Download

memory/1884-127-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/1912-182-0x0000025906340000-0x000002590636B000-memory.dmp

Download

memory/1912-129-0x0000025906340000-0x000002590636B000-memory.dmp

Download

memory/1912-130-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/1912-343-0x0000025906340000-0x000002590636B000-memory.dmp

Download

memory/1920-132-0x000002A898A60000-0x000002A898A8B000-memory.dmp

Download

memory/1920-133-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/1960-142-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/1960-141-0x0000024517F80000-0x0000024517FAB000-memory.dmp

Download

memory/2000-135-0x0000027B00530000-0x0000027B0055B000-memory.dmp

Download

memory/2000-136-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/2044-139-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/2044-138-0x000001BE2BDC0000-0x000001BE2BDEB000-memory.dmp

Download

memory/2056-145-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/2056-144-0x0000015404D30000-0x0000015404D5B000-memory.dmp

Download

memory/2108-148-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/2108-147-0x0000029B3F4E0000-0x0000029B3F50B000-memory.dmp

Download

memory/2236-151-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/2236-150-0x00000162D7740000-0x00000162D776B000-memory.dmp

Download

memory/2268-154-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/2268-153-0x0000000001410000-0x000000000143B000-memory.dmp

Download

memory/2412-157-0x00007FFCFB9B0000-0x00007FFCFB9C0000-memory.dmp

Download

memory/2412-156-0x00000223EED60000-0x00000223EED8B000-memory.dmp

Download

memory/2572-159-0x000001A78CA00000-0x000001A78CA2B000-memory.dmp

Download

memory/3972-14-0x00007FFD39EB0000-0x00007FFD39F6D000-memory.dmp

Download

memory/3972-13-0x00007FFD3B920000-0x00007FFD3BB29000-memory.dmp

Download