xworm | aae197391ddb79b9e81d8f92712bf4d7d4c76a8b934673cc082c2af42eee936c

Resubmissions

08/07/2026, 11:32

260708-nnrclsez6v

23/06/2026, 15:54

260623-tcf1dses31

23/06/2026, 15:52

260623-ta25vad14m10

23/06/2026, 15:47

260623-s77adsd13l10

Analysis

user interaction
yes
max time kernel
8s
max time network
21s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ion‮gnp‮gpj..scr
Size 440KB
Sample260623-s77adsd13l
SHA256 aae197391ddb79b9e81d8f92712bf4d7d4c76a8b934673cc082c2af42eee936c
MD5 178b5ec485b48bc08acf1102ad7299a4
SHA1 38d35a5ff292f326ad508309688a6ae4b73872cf
SHA512 19882dbbb357ee7e0a6fce1aa14b86694769302c762f2a0b45bdb072e9fa1606b690cad8f4475a0d80a5249af91e7b8a26c2b68148ef71271e598221c6a2c6ca
SSDEEP 12288:TDStU+xRITp4bX4pJZ47GT75znhMGn3EX3:TF+xRXbX4pj5pzhMs343
TLSH
T119A4F104B7ABC72BC79F0B3415F294FD7176ADDA8713974A0AD1F25B6A0A3D08903672
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

r321ad-39946.portmap.host:5521

Mutex

dyfG4fFAnORwPtCc

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000c000000019cb4-8.dat	family_xworm
behavioral2/memory/5372-13-0x0000000000770000-0x0000000000780000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5068	powershell.exe
2816	powershell.exe
2948	powershell.exe
2184	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5372	LocalbSnqGWaiXX.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings	ion‮gnp‮gpj..scr

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3348	mspaint.exe
3348	mspaint.exe
5068	powershell.exe
5068	powershell.exe
2816	powershell.exe
2816	powershell.exe
2948	powershell.exe
2948	powershell.exe
2948	powershell.exe
2184	powershell.exe
2184	powershell.exe
2184	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5372	LocalbSnqGWaiXX.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeIncreaseQuotaPrivilege	5068	powershell.exe
Token: SeSecurityPrivilege	5068	powershell.exe
Token: SeTakeOwnershipPrivilege	5068	powershell.exe
Token: SeLoadDriverPrivilege	5068	powershell.exe
Token: SeSystemProfilePrivilege	5068	powershell.exe
Token: SeSystemtimePrivilege	5068	powershell.exe
Token: SeProfSingleProcessPrivilege	5068	powershell.exe
Token: SeIncBasePriorityPrivilege	5068	powershell.exe
Token: SeCreatePagefilePrivilege	5068	powershell.exe
Token: SeBackupPrivilege	5068	powershell.exe
Token: SeRestorePrivilege	5068	powershell.exe
Token: SeShutdownPrivilege	5068	powershell.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeSystemEnvironmentPrivilege	5068	powershell.exe
Token: SeRemoteShutdownPrivilege	5068	powershell.exe
Token: SeUndockPrivilege	5068	powershell.exe
Token: SeManageVolumePrivilege	5068	powershell.exe
Token: 33	5068	powershell.exe
Token: 34	5068	powershell.exe
Token: 35	5068	powershell.exe
Token: 36	5068	powershell.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeIncreaseQuotaPrivilege	2816	powershell.exe
Token: SeSecurityPrivilege	2816	powershell.exe
Token: SeTakeOwnershipPrivilege	2816	powershell.exe
Token: SeLoadDriverPrivilege	2816	powershell.exe
Token: SeSystemProfilePrivilege	2816	powershell.exe
Token: SeSystemtimePrivilege	2816	powershell.exe
Token: SeProfSingleProcessPrivilege	2816	powershell.exe
Token: SeIncBasePriorityPrivilege	2816	powershell.exe
Token: SeCreatePagefilePrivilege	2816	powershell.exe
Token: SeBackupPrivilege	2816	powershell.exe
Token: SeRestorePrivilege	2816	powershell.exe
Token: SeShutdownPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeSystemEnvironmentPrivilege	2816	powershell.exe
Token: SeRemoteShutdownPrivilege	2816	powershell.exe
Token: SeUndockPrivilege	2816	powershell.exe
Token: SeManageVolumePrivilege	2816	powershell.exe
Token: 33	2816	powershell.exe
Token: 34	2816	powershell.exe
Token: 35	2816	powershell.exe
Token: 36	2816	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeIncreaseQuotaPrivilege	2948	powershell.exe
Token: SeSecurityPrivilege	2948	powershell.exe
Token: SeTakeOwnershipPrivilege	2948	powershell.exe
Token: SeLoadDriverPrivilege	2948	powershell.exe
Token: SeSystemProfilePrivilege	2948	powershell.exe
Token: SeSystemtimePrivilege	2948	powershell.exe
Token: SeProfSingleProcessPrivilege	2948	powershell.exe
Token: SeIncBasePriorityPrivilege	2948	powershell.exe
Token: SeCreatePagefilePrivilege	2948	powershell.exe
Token: SeBackupPrivilege	2948	powershell.exe
Token: SeRestorePrivilege	2948	powershell.exe
Token: SeShutdownPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeSystemEnvironmentPrivilege	2948	powershell.exe
Token: SeRemoteShutdownPrivilege	2948	powershell.exe
Token: SeUndockPrivilege	2948	powershell.exe
Token: SeManageVolumePrivilege	2948	powershell.exe
Token: 33	2948	powershell.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3348	mspaint.exe
3348	mspaint.exe
3348	mspaint.exe
3348	mspaint.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5772 wrote to memory of 5372	5772	ion‮gnp‮gpj..scr	88
PID 5772 wrote to memory of 3348	5772	ion‮gnp‮gpj..scr	89
PID 5372 wrote to memory of 5068	5372	LocalbSnqGWaiXX.exe	91
PID 5372 wrote to memory of 2816	5372	LocalbSnqGWaiXX.exe	97
PID 5372 wrote to memory of 2948	5372	LocalbSnqGWaiXX.exe	99
PID 5372 wrote to memory of 2184	5372	LocalbSnqGWaiXX.exe	101

C:\Users\Admin\AppData\Local\Temp\ion‮gnp‮gpj..scr
"C:\Users\Admin\AppData\Local\Temp\ion‮gnp‮gpj..scr" /S
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Users\Admin\AppData\LocalbSnqGWaiXX.exe
  "C:\Users\Admin\AppData\LocalbSnqGWaiXX.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\LocalbSnqGWaiXX.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'LocalbSnqGWaiXX.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\icon'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'icon'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2184
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "icon" /tr "C:\Users\Admin\AppData\Roaming\icon"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1092
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\LocalhicrSMfbQB..jpg"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:1244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a97f45fa5ee5d0e5d22ee78d88dd14e2397504a6f5a59fb18a528cd46088e524
MD5 e1a315ce915c4115ba2a98affe448e8a
SHA1 3c3be0e24b2571bf8213f49b49b9d745ed2d7bc5
SHA512 e44ea9f4cd5709c5232735f2f962289da8c241e74448b889cfb6102b73d9f7dc0ca9b8d4cfb81bd699e8c8f8aa8c7d3936ec33ee71c1c01cd1cabf58ce76c3c3
TLSH
T1E3216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 32ae08cb5a638def0465d834677b544c113ab269b0e1d378e1aef2860fcc4c12
MD5 87ad159014af1aa7a5be99151a374935
SHA1 961a367f03140b24362439572aa8974b42ec78f4
SHA512 e0f16d8de0f9be48a001110b723317c02e601f543dabc5da27cf51ed4edb2cdab2f951fc694b17d15a973eb5190f3137db8a197fc5b5fcd47b8392f440c92cbe
TLSH
T175216837B3DD8614CC9A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5w4uqutw.jv3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5w4uqutw.jv3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LocalbSnqGWaiXX.exe

Path C:\Users\Admin\AppData\LocalbSnqGWaiXX.exe
Size 38KB
SHA256 825ccbe70aa116767212fe44386548512bc2e8ccdd4c711a7e06fab77eee188c
MD5 6f5870b6239ea833afdf086035d0b74a
SHA1 81248d31c97fb73df4d0b5ee97e53033f800be09
SHA512 2f0975a3a4ac030706c26ce17c45397a8f4d4c90397020b53725ccae1c4951ecbd755173f7d381339b00d39097da3756c05aae80a0a08fe1ad8a1b67f3de65d4
SSDEEP 768:+7JxdHKnjf6HrGzze7yFZl9x+sp6ROhhGW:+txdH6CH63FT9x+sp6ROh7
TLSH
T177033904BB918626C9FD5FB419B362060674E617EA23FF8E0CE494DE1B67BC08D117E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalhicrSMfbQB..jpg

Path C:\Users\Admin\AppData\LocalhicrSMfbQB..jpg
Size 348KB
SHA256 bf457b4d997ec4b3054b2d9101971ed2565bdd408deec571379a6ea501f746ac
MD5 a36d78a197951c5ba4ec0a7b60d4416f
SHA1 2cca8731d1b89da48a9e5a3eebf52ef37ea28396
SHA512 96f36340f36f19cf7d41f48358c8ec89cbda7d346879d54f634742d6e46c63c0ecd794ead3402ec516b2b2fb5e2ffd581ba6721374c8ac3e85418618e1dbce9a
SSDEEP 6144:fXDS44U+xRPmPTp4nLnX5Cy3kjtV/4Q47P/+3sjXgBVRiWPbnnmTUmWwGBd3Ec:vDStU+xRITp4bX4pJZ47GT75znhMGn3N
TLSH
T12B74230DDABDDDA4CA042C34599B18FEF5B70261C428825B5F03A77AF94C2B2E665F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5068-27-0x0000024056E30000-0x0000024056E52000-memory.dmp

Download

memory/5068-33-0x000002406F310000-0x000002406F31A000-memory.dmp

Download

memory/5068-31-0x000002406F230000-0x000002406F24E000-memory.dmp

Download

memory/5068-32-0x000002406F250000-0x000002406F302000-memory.dmp

Download

memory/5372-23-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/5372-22-0x00007FFD69BA0000-0x00007FFD69BA1000-memory.dmp

Download

memory/5372-55-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/5372-54-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/5372-26-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp

Download

memory/5372-13-0x0000000000770000-0x0000000000780000-memory.dmp

Download

memory/5772-14-0x00007FFD68520000-0x00007FFD68F58000-memory.dmp

Download

memory/5772-15-0x00007FFD68520000-0x00007FFD68F58000-memory.dmp

Download

memory/5772-20-0x00007FFD68520000-0x00007FFD68F58000-memory.dmp

Download

memory/5772-4-0x00007FFD68520000-0x00007FFD68F58000-memory.dmp

Download

memory/5772-3-0x00007FFD68520000-0x00007FFD68F58000-memory.dmp

Download

memory/5772-2-0x00007FFD68520000-0x00007FFD68F58000-memory.dmp

Download

memory/5772-21-0x00007FFD68520000-0x00007FFD68F58000-memory.dmp

Download

memory/5772-0-0x00007FFD6881A000-0x00007FFD6881B000-memory.dmp

Download