xworm | f259428898724d766ddfc70b5822595f89638e9951d5aadd683eda82d2b90009

Analysis

max time kernel
42s
max time network
45s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/06/2026, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
MasonRAT.exe
Size 17.6MB
Sample260625-yvanjsfv2m
SHA256 f259428898724d766ddfc70b5822595f89638e9951d5aadd683eda82d2b90009
MD5 df9aecbb660bd283cc4a3574b5a9f3db
SHA1 3364393967f08eef69c167d1700648225adc1667
SHA512 4dec850d7f657829643bc6753d878d77fe1fcfe0864f4d32c53b8172634a5b31504d9f172de1863554015e5db1b5f80b1a848d62a599a8734a1faa309bac647c
SSDEEP 393216:1i1Y7k3MSW5AxiQaGiIDT0QQ+y2G8lhT/n9a7/hlEh847kZcHeWGE2wx:1LI7i8ieT0QJzhT/nEo8byI2
TLSH
T14C0733E3CA1A95FACF0011BF621C09316608B896764AB93737E52CF7BBB3955C8119D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xworm rat trojan

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00080000000285e0-17.dat	family_xworm
behavioral2/memory/4912-31-0x0000000000180000-0x000000000019C000-memory.dmp	family_xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\International\Geo\Nation	MasonRAT.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
2864	MasonRAT.exe
4912	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1532	2864	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonRAT.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "67"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4912	svchost.exe
Token: SeDebugPrivilege	4912	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
656	LogonUI.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 2864	5092	MasonRAT.exe	82
PID 5092 wrote to memory of 4912	5092	MasonRAT.exe	83

C:\Users\Admin\AppData\Local\Temp\MasonRAT.exe
"C:\Users\Admin\AppData\Local\Temp\MasonRAT.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Users\Admin\AppData\Roaming\MasonRAT.exe
  "C:\Users\Admin\AppData\Roaming\MasonRAT.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 1268
    3⤵
    - Program crash
    PID:1532
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2864 -ip 2864
1⤵
PID:5312

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a34055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MasonRAT.exe

Path C:\Users\Admin\AppData\Roaming\MasonRAT.exe
Size 17.5MB
SHA256 8c24c948353d4449b451f7832fba4b8bb44b18711a83d589544c13142d4f326e
MD5 deff6a06ee2b318d924a89328527cfd9
SHA1 00be42dba0e257fe1aaaebac462be88b0120d15d
SHA512 699211a290219f7a8b89ada51f79c5ce02b4f35ef348b8f717301d6da3b9e6d582255720bc17bf70741e96e7948268f2341a90f12a4f6846e77bb5a311b42d9b
SSDEEP 393216:eyuW9Z89ePbmJY+7HgYw7Tb2p82QoHQTfUpF/ewVa/RTX6D:edaaemO+TH22prQIOspF7SRb6
TLSH
T105071248B03EBEFDFDADDB3B41881F069BF917B3871886DA7944229977E1241640921F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 90KB
SHA256 f27d850d8d2517bd766e5204e134cf467d67ca7625a6a7996c6110fdd7a3821f
MD5 f2c9864b28f9c376c1111095dc4cf6b0
SHA1 92a93ef50fa75ed09fcc00b2404eaaf80c25ffdd
SHA512 efa3f01a83e314e524d2f3d164dd634ea69cafdb373fde14663c3e804a05814056701b74d964423436368ad0c6d4aba3d152f996d49bef8944b4d4d176eefb8c
SSDEEP 1536:+iXIpF5WkdtT9rCw7ZczdBum6uvm1vWqiLm5aRIbJzBPWeP6:VXsF51CnYG6e8aebJzdWB
TLSH
T1EF936B8EFBA14995D1AC4F7385A3910401B9D0A7A833F7BB14DC1EE16CB64D8DB4FA60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2864-33-0x00000000001A0000-0x000000000131E000-memory.dmp

Download

memory/2864-34-0x0000000005B20000-0x0000000005B30000-memory.dmp

Download

memory/2864-36-0x0000000006CE0000-0x0000000007CCC000-memory.dmp

Download

memory/2864-37-0x000000000B610000-0x000000000BBB6000-memory.dmp

Download

memory/2864-38-0x0000000007D70000-0x0000000007E02000-memory.dmp

Download

memory/2864-39-0x0000000007E10000-0x0000000007EAC000-memory.dmp

Download

memory/4912-31-0x0000000000180000-0x000000000019C000-memory.dmp

Download

memory/4912-41-0x000000001C580000-0x000000001C5CE000-memory.dmp

Download

memory/4912-42-0x000000001C5D0000-0x000000001C5D6000-memory.dmp

Download

memory/5092-0-0x0000000000260000-0x00000000013F6000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads