xworm | 4f2fa8e298e3febc9ef49f9d73127c74e9e68f44beb7856fbd3830ea7f37b9d5

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
revoltV2.4.exe
Size 1.0MB
Sample260606-d2ntjaaz2j
SHA256 4f2fa8e298e3febc9ef49f9d73127c74e9e68f44beb7856fbd3830ea7f37b9d5
MD5 0c293ca46fb21110df846b9730b7b8e9
SHA1 03abe617885bf3c4c6dae56ce25cbf7456cf1b16
SHA512 1acf14afe1fb59191f294d9e3fc73c0e86665a47a3b1c61bf14377b8744c5f8bc85f5a8fd06de8a7ce2a5220006ec80a8843336bd6631475a1fd343129449cf1
SSDEEP 24576:xVPbsguiiwITJBuk3somBjzlIznZ2dNayHaUcrYDC9vxUi0ktI631:xdYguiFITJSoEjhIzMoyHaZYm9vyMthl
TLSH
T1353523E5B57E0324EAE51B31FFE30BB03BBBD6440291D7716B866FD01A910A71916B70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura discovery execution xworm packer persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V5.6

31.214.245.116:666

Attributes

Install_directory
%AppData%
install_file
Services.exe

Extracted

Family

xworm

Version

194.26.192.105:666

Mutex

NO6deKdmo6HQOQrU

Attributes

Install_directory
%AppData%
install_file
xboxGamespass.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 6 IoCs

resource	yara_rule
behavioral2/files/0x00130000000270df-5.dat	family_xworm
behavioral2/memory/904-20-0x0000000000B10000-0x0000000000B28000-memory.dmp	family_xworm
behavioral2/files/0x001900000002b4f1-30.dat	family_xworm
behavioral2/memory/3392-50-0x0000000000010000-0x0000000000024000-memory.dmp	family_xworm
behavioral2/files/0x001900000002b4f7-86.dat	family_xworm
behavioral2/memory/2640-88-0x0000000000330000-0x000000000033E000-memory.dmp	family_xworm

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Services.lnk	SteamUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Services.lnk	SteamUpdate.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Services.lnk	services.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xboxGamespass.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xboxGamespass.lnk	XClient.exe

Executes dropped EXE 12 IoCs

pid	Process
904	SteamUpdate.exe
656	Output.exe
3392	services.exe
3136	Newupdate.exe
2924	Services.exe
1924	Revolt.exe
2324	VoidRelic.exe
2640	XClient.exe
432	services.exe
4408	xboxGamespass.exe
4804	Services.exe
3252	Services.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\Services.exe"	SteamUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\Services.exe"	services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xboxGamespass = "C:\\Users\\Admin\\AppData\\Roaming\\xboxGamespass.exe"	XClient.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x001900000002b4f6-83.dat	costura

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoidRelic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	VoidRelic.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	VoidRelic.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	VoidRelic.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4848	schtasks.exe
3112	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
904	SteamUpdate.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	904	SteamUpdate.exe
Token: SeDebugPrivilege	3392	services.exe
Token: SeDebugPrivilege	2924	Services.exe
Token: SeDebugPrivilege	2640	XClient.exe
Token: SeDebugPrivilege	904	SteamUpdate.exe
Token: SeDebugPrivilege	3392	services.exe
Token: SeDebugPrivilege	432	services.exe
Token: SeDebugPrivilege	4408	xboxGamespass.exe
Token: SeDebugPrivilege	4804	Services.exe
Token: SeDebugPrivilege	3252	Services.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 904	2576	revoltV2.4.exe	81
PID 2576 wrote to memory of 656	2576	revoltV2.4.exe	82
PID 656 wrote to memory of 3392	656	Output.exe	83
PID 656 wrote to memory of 3136	656	Output.exe	84
PID 3136 wrote to memory of 2924	3136	Newupdate.exe	85
PID 3136 wrote to memory of 1924	3136	Newupdate.exe	86
PID 1924 wrote to memory of 2324	1924	Revolt.exe	87
PID 1924 wrote to memory of 2640	1924	Revolt.exe	88
PID 904 wrote to memory of 3112	904	SteamUpdate.exe	90
PID 3392 wrote to memory of 4848	3392	services.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\revoltV2.4.exe
"C:\Users\Admin\AppData\Local\Temp\revoltV2.4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Users\Admin\AppData\Roaming\SteamUpdate.exe
  "C:\Users\Admin\AppData\Roaming\SteamUpdate.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Services" /tr "C:\Users\Admin\AppData\Roaming\Services.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3112
- C:\Users\Admin\AppData\Roaming\Output.exe
  "C:\Users\Admin\AppData\Roaming\Output.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Users\Admin\AppData\Roaming\services.exe
    "C:\Users\Admin\AppData\Roaming\services.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Services" /tr "C:\Users\Admin\AppData\Roaming\Services.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4848
- - C:\Users\Admin\AppData\Roaming\Newupdate.exe
    "C:\Users\Admin\AppData\Roaming\Newupdate.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3136
  - - C:\Users\Admin\AppData\Roaming\Services.exe
      "C:\Users\Admin\AppData\Roaming\Services.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2924
  - - C:\Users\Admin\AppData\Roaming\Revolt.exe
      "C:\Users\Admin\AppData\Roaming\Revolt.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1924
    - - C:\Users\Admin\AppData\Roaming\VoidRelic.exe
        
        "C:\Users\Admin\AppData\Roaming\VoidRelic.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:2324
    - - C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640

C:\Users\Admin\AppData\Roaming\services.exe
C:\Users\Admin\AppData\Roaming\Services.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:432

C:\Users\Admin\AppData\Roaming\xboxGamespass.exe
C:\Users\Admin\AppData\Roaming\xboxGamespass.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Users\Admin\AppData\Roaming\Services.exe
C:\Users\Admin\AppData\Roaming\Services.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4804

C:\Users\Admin\AppData\Roaming\Services.exe
C:\Users\Admin\AppData\Roaming\Services.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Services.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Services.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
TLSH
T119F0A2302371E1C8C9263F422C0D2A4966AF474A7B50FE0C7694635DD825167AF313F3
MD5 SHA1 SHA512 TLSH

Submit Download

Services.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Services.lnk
Size 778B
SHA256 ebdec97610c5d1932207243b3517ffd4c1053319a81929496c0a51842819b7bd
MD5 529e73720d1f0d5cc304e3d5a55cc4bc
SHA1 b63cf5f3b42310d55e4cb858c898e58b9fc72e15
SHA512 200079c2f2071f87187f4f30b7101087af634d8efcc175c8fa178ab86c5649c00dbec82c5f14c17d6b9cfe2b4b954370890b0e2e8238ff41833e9f31938a2752
TLSH
T16301DD0907C74F25E2B440B161764774DA32FC42EAE4BB8C9240A5592DA1A01D87CD0F
MD5 SHA1 SHA512 TLSH

Submit Download

Newupdate.exe

Path C:\Users\Admin\AppData\Roaming\Newupdate.exe
Size 912KB
SHA256 52c375baa2bde72e8805813e491e7eb7aa7d161eeded717481bd2560ed1b9b73
MD5 7475dfd67fef7878e9c284a75814ec80
SHA1 98be050cdb87ff9d56963b4d889427411d57f248
SHA512 c94b1df96b14ca1187af87a58fa98f3d9709698e70f4b08b97aad1da02551bc363a9d681240c1f5e1e01999ed23d7b8f2d6bee657f83cc0ed0638c7ea7cdaf87
SSDEEP 24576:rNLtUpSHfiVbH0t23VRWnUV1YU0598+ep7:p5aVbUt23VgnRx98+
TLSH
T16C1523699905C42ACCCADEFB698E1E846496F40DFB0CE72137F6B5B80917C6D3CD1628
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Output.exe

Path C:\Users\Admin\AppData\Roaming\Output.exe
Size 974KB
SHA256 ec1836edcb236a578368142b67ef8fb21d2fc6276a504468b19a63767980484b
MD5 1041c3a1c5639f3f446b9745ea188b3c
SHA1 a3018dee879318788e09d7832a42ead11bee56cb
SHA512 67cb3a55ce679e843c42cbc4b3390be7ed01a9057556bc9673f3ef2d4ba47417f6844c578a8978b0048fd1d135c196ec3c93c6c19449fa434f2a33dd1f6bd56b
SSDEEP 24576:lDrqgftjpa1V2s6yLnKy7wW2clOqKYXaPQ:lDrRljpa1V258nPd8Q
TLSH
T17C2523F2F3D0983BF02D99B2C4E7440123FA85775A8EC53A9366452BD12B67A0BF5C85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Revolt.exe

Path C:\Users\Admin\AppData\Roaming\Revolt.exe
Size 867KB
SHA256 c22221dcaa276e266b2c7434b32b6569ef8ab661e5f7f0e78ef8c718e7b6dc54
MD5 435b3c88cc47914a19920c3e6537d3e8
SHA1 e96835584de82c809e8ca66111241c1263d261da
SHA512 c8d47ec39714f2540e8249092167c5c73766752fcb2690bc9f9fa129d2b214476ceb0587a8912ee5e36c8916614d5b9094d8142414836308eb208aed13ef2f18
SSDEEP 12288:zTXDtin17dYHqi1ABUuxShmOz4XSplod+vUBMk9Haj+mUy16vXpmSTY0zGLt:HXD8n1ZiqiIUZhr4iplodNjUz6v5mF
TLSH
T12D1523048BCDB46AD33E5CB446782D4DD2B21F295621DE8CECC9D9C9AF0B1D9FEA1214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamUpdate.exe

Path C:\Users\Admin\AppData\Roaming\SteamUpdate.exe
Size 67KB
SHA256 bf3bc9435e6c2f92b74a09a0bd36985605c88d0e898e2e93743dcdefbe3c908c
MD5 639d91b46f91c1a7698d687d936d2127
SHA1 7bb9bc33ae8e9974f418694349eb4d23f19004c5
SHA512 25d2895538731086d93ee65a34a7403ebe91a5fa673a0a622d4e4e227e4d703bbba82a0d3a6046dfaf2d778eb6c4ab27a5124b13a21a61968974a04d66c1cf34
SSDEEP 1536:yQ80DDh7HauvHhfDk8AO4mmybCvb634LViYaoOtB3+L:yF0DD3HWZR3ybC2IZXOtB3+L
TLSH
T10B636C283BE64221E1FF6FF519F27112CB75A3236913925F14D8429B0B23989CD917EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoidRelic.exe

Path C:\Users\Admin\AppData\Roaming\VoidRelic.exe
Size 822KB
SHA256 3d0ba206237293d6b531f9ddd2c286bf8d8ff633cb80b3b3f2b23af955f86324
MD5 efb84451921c172b776096d0cd62fa9e
SHA1 2bc88367f95ea653608e2bf32d7b72bf8639a2b5
SHA512 bf069266b3fb34f4dd069c86ccb27354effeb59a4d539ae9c987d293359d1722c664f4b3b1d50a039c854908a3450d91cea68293f68f01c0d86d66b522bc1165
SSDEEP 24576:fLf+50SHgbuO0MjdM8yfAPnqOTmciow1Pmq:TglH20MjmfeqOTmcNwdm
TLSH
T17D052301A71C199DC3AB2D76CE208158A7A21A523639EF9ECC34C5CA59737C64E33E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XClient.exe

Path C:\Users\Admin\AppData\Roaming\XClient.exe
Size 34KB
SHA256 1d3defbee2613ef705b4c5fb061352429c6cba245e54e5bfc581541a5c3d0cc7
MD5 f5ae9e7b596b9c8a9a6ff48cc7af0280
SHA1 f28d0988029a5e23733dcdc04da8288bae803012
SHA512 7f1e5436683ac428e8fe48bbfbf7cf9006551e2f2eb1662af86fb3963e5873237d56ee3e6ae30b1203b162f4b2d81dc8fd54f86514f3e8d61f5ecfbd56337829
SSDEEP 768:JCiFHO8ede9gbL6qBPZa9Fm9Y6OjhT/JUA:JNu8edHimOFm9Y6OjBhUA
TLSH
T13DF24B4877904721CAEE6FF12EB2B1094274F503A917FB5E4CC4899A7F73AC24A017E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

services.exe

Path C:\Users\Admin\AppData\Roaming\services.exe
Size 51KB
SHA256 b15d337503a50016e474a251299356b24d4a78c9797df9f85e3a51d761c671f2
MD5 d3cb0308f2a3f84946965b50a10c9339
SHA1 fc1d6ca16f829ca34f1030ef38ff96c3ba9b552b
SHA512 ba3621f050b9246e30bf97e0b55015714162f0787f62ad7ce169b335ca9134fec45da24911d5d67bcddb9bbaa7cd97f9d167b43ec736bd8468452801d27ba650
SSDEEP 1536:J3L2duUsUq4JKTMlao4kbbDChPC8nO7Tce:J3L2xsUJJLao4kbbuFC8nO7we
TLSH
T1B6336B1C77A24232D2FE5BF468F26152C77AF2139923971F24D8408A1B23A8DCD427E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/656-25-0x00000000008D0000-0x00000000009CA000-memory.dmp

Download

memory/904-20-0x0000000000B10000-0x0000000000B28000-memory.dmp

Download

memory/1924-64-0x0000000000410000-0x00000000004F0000-memory.dmp

Download

memory/2324-89-0x0000000000120000-0x00000000001F4000-memory.dmp

Download

memory/2324-90-0x0000000005270000-0x0000000005816000-memory.dmp

Download

memory/2324-91-0x0000000004BD0000-0x0000000004C62000-memory.dmp

Download

memory/2324-92-0x0000000004DC0000-0x0000000004FDC000-memory.dmp

Download

memory/2324-93-0x00000000050F0000-0x00000000050FA000-memory.dmp

Download

memory/2324-94-0x0000000006D20000-0x0000000006D86000-memory.dmp

Download

memory/2576-0-0x0000000000930000-0x0000000000A3E000-memory.dmp

Download

memory/2640-88-0x0000000000330000-0x000000000033E000-memory.dmp

Download

memory/3136-49-0x0000000000520000-0x000000000060A000-memory.dmp

Download

memory/3392-50-0x0000000000010000-0x0000000000024000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads