xworm | 59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd.exe
Size 779KB
Sample260702-vhdmwsfv2m
SHA256 59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd
MD5 6695bc02e32d5b7c076ab8bae9ca2693
SHA1 538d28fbaaa65cb7c69652b0e54e154e431fe8f8
SHA512 1b85dba9b98e780483d4c44281bc41f875ee688ec932ed1097a4fd62fd782c37d4b850c6dac8da670f7d9c2f8441ba45f64eef68dcd8b163fca2907b55620b03
SSDEEP 12288:wAqNLt1wt4g5yk5uSjr4SaeQaADJJFGs/33Fic0nG4J6iJoFtXeHvbzV:wlVt1wt4g5iretAbcMcc0VGuPbh
TLSH
T135050164335AEE01D4DB47B44860E3B462381E49E802C3039FFBFDDBBA7A64665497D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

204.10.160.167:443

Mutex

iNfb7ashTLGD8bky

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1984-16-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
620	powershell.exe
4896	powershell.exe
4288	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3944	PGtWaKCjBdD.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Windows\CurrentVersion\Run\PGtWaKCjBdD = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\0l4jjualosq.ps1\""	59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 6108 set thread context of 1984	6108	59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd.exe	90
PID 3944 set thread context of 3468	3944	PGtWaKCjBdD.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PGtWaKCjBdD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6108	59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd.exe
6108	59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd.exe
4896	powershell.exe
4896	powershell.exe
4288	powershell.exe
4288	powershell.exe
3944	PGtWaKCjBdD.exe
3944	PGtWaKCjBdD.exe
620	powershell.exe
620	powershell.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	6108	59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd.exe
Token: SeDebugPrivilege	4896	powershell.exe
Token: SeDebugPrivilege	1984	MSBuild.exe
Token: SeDebugPrivilege	4288	powershell.exe
Token: SeIncreaseQuotaPrivilege	4896	powershell.exe
Token: SeSecurityPrivilege	4896	powershell.exe
Token: SeTakeOwnershipPrivilege	4896	powershell.exe
Token: SeLoadDriverPrivilege	4896	powershell.exe
Token: SeSystemProfilePrivilege	4896	powershell.exe
Token: SeSystemtimePrivilege	4896	powershell.exe
Token: SeProfSingleProcessPrivilege	4896	powershell.exe
Token: SeIncBasePriorityPrivilege	4896	powershell.exe
Token: SeCreatePagefilePrivilege	4896	powershell.exe
Token: SeBackupPrivilege	4896	powershell.exe
Token: SeRestorePrivilege	4896	powershell.exe
Token: SeShutdownPrivilege	4896	powershell.exe
Token: SeDebugPrivilege	4896	powershell.exe
Token: SeSystemEnvironmentPrivilege	4896	powershell.exe
Token: SeRemoteShutdownPrivilege	4896	powershell.exe
Token: SeUndockPrivilege	4896	powershell.exe
Token: SeManageVolumePrivilege	4896	powershell.exe
Token: 33	4896	powershell.exe
Token: 34	4896	powershell.exe
Token: 35	4896	powershell.exe
Token: 36	4896	powershell.exe
Token: SeDebugPrivilege	3944	PGtWaKCjBdD.exe
Token: SeDebugPrivilege	620	powershell.exe
Token: SeDebugPrivilege	3468	MSBuild.exe
Token: SeIncreaseQuotaPrivilege	620	powershell.exe
Token: SeSecurityPrivilege	620	powershell.exe
Token: SeTakeOwnershipPrivilege	620	powershell.exe
Token: SeLoadDriverPrivilege	620	powershell.exe
Token: SeSystemProfilePrivilege	620	powershell.exe
Token: SeSystemtimePrivilege	620	powershell.exe
Token: SeProfSingleProcessPrivilege	620	powershell.exe
Token: SeIncBasePriorityPrivilege	620	powershell.exe
Token: SeCreatePagefilePrivilege	620	powershell.exe
Token: SeBackupPrivilege	620	powershell.exe
Token: SeRestorePrivilege	620	powershell.exe
Token: SeShutdownPrivilege	620	powershell.exe
Token: SeDebugPrivilege	620	powershell.exe
Token: SeSystemEnvironmentPrivilege	620	powershell.exe
Token: SeRemoteShutdownPrivilege	620	powershell.exe
Token: SeUndockPrivilege	620	powershell.exe
Token: SeManageVolumePrivilege	620	powershell.exe
Token: 33	620	powershell.exe
Token: 34	620	powershell.exe
Token: 35	620	powershell.exe
Token: 36	620	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 6108 wrote to memory of 4896	6108	59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd.exe	88
PID 6108 wrote to memory of 1984	6108	59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd.exe	90
PID 6108 wrote to memory of 1984	6108	59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd.exe	90
PID 6108 wrote to memory of 1984	6108	59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd.exe	90
PID 6108 wrote to memory of 1984	6108	59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd.exe	90
PID 6108 wrote to memory of 1984	6108	59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd.exe	90
PID 4288 wrote to memory of 3944	4288	powershell.exe	93
PID 3944 wrote to memory of 620	3944	PGtWaKCjBdD.exe	96
PID 3944 wrote to memory of 3468	3944	PGtWaKCjBdD.exe	98
PID 3944 wrote to memory of 3468	3944	PGtWaKCjBdD.exe	98
PID 3944 wrote to memory of 3468	3944	PGtWaKCjBdD.exe	98
PID 3944 wrote to memory of 3468	3944	PGtWaKCjBdD.exe	98
PID 3944 wrote to memory of 3468	3944	PGtWaKCjBdD.exe	98

C:\Users\Admin\AppData\Local\Temp\59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd.exe
"C:\Users\Admin\AppData\Local\Temp\59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6108
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1984

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\0l4jjualosq.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Users\Admin\AppData\Roaming\PGtWaKCjBdD.exe
  "C:\Users\Admin\AppData\Roaming\PGtWaKCjBdD.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PGtWaKCjBdD.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:620
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 e4cc28cbb382333ec25bc8beb188a36e91de77c1a08de7c6ce63c4f1598aa63f
MD5 1966dc988cb8c41eb1bd01d583e54f42
SHA1 cfed88d97975a10a102aa55a55f51af59b1c0a79
SHA512 0063d2f9eb880c2630d7c56ad5156940ce0cd0754444ecb97c2ad6b8860e5561cf884f4c3155795cf76d104f297ea1e8ada773dedae77437e36fcf9796371759
SSDEEP 384:vSEboT1iBGmGW14bPYKqOTHO0FgHrr2PM5IAXr4B+dWoV/sKwUvYbhNaPEWRtrZQ:90Z6GlWisKqcHOl6uIAXrq+torbhNaPS
TLSH
T168A2B478213F6DC7D8D216B010D20AE7FBE4D489DAB651D4BF2BDA2F4C90EB74A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0l4jjualosq.ps1

Path C:\Users\Admin\AppData\Local\Temp\0l4jjualosq.ps1
Size 1KB
SHA256 4b4ba1ee1f1cab9a21b805465c835ae5212e5d599d90a133966eacb1b9b203bd
MD5 51036152143009456a7b8bd74ec771e2
SHA1 57badabfb1244755851525d4d4eb736174e0cd98
SHA512 fdbbe63f0f60467d5a82932b80a0dfc4df75575752a43292cf5958df39a8662bdeea6348c34e657b477d3e619cd8417389bf306e07c765d0ce6995df50379c32
TLSH
T1DF11290B8E8A43C600B407F64A1375CCB56D51CB276F019099ADB4EDB32FE633969CE8
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_i0oxw3qw.nxe.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i0oxw3qw.nxe.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PGtWaKCjBdD.exe

Path C:\Users\Admin\AppData\Roaming\PGtWaKCjBdD.exe
Size 779KB
SHA256 59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd
MD5 6695bc02e32d5b7c076ab8bae9ca2693
SHA1 538d28fbaaa65cb7c69652b0e54e154e431fe8f8
SHA512 1b85dba9b98e780483d4c44281bc41f875ee688ec932ed1097a4fd62fd782c37d4b850c6dac8da670f7d9c2f8441ba45f64eef68dcd8b163fca2907b55620b03
SSDEEP 12288:wAqNLt1wt4g5yk5uSjr4SaeQaADJJFGs/33Fic0nG4J6iJoFtXeHvbzV:wlVt1wt4g5iretAbcMcc0VGuPbh
TLSH
T135050164335AEE01D4DB47B44860E3B462381E49E802C3039FFBFDDBBA7A64665497D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/620-55-0x0000000006890000-0x00000000068DC000-memory.dmp

Download

memory/620-51-0x0000000006240000-0x000000000659B000-memory.dmp

Download

memory/620-56-0x0000000070750000-0x000000007079C000-memory.dmp

Download

memory/620-59-0x0000000007A40000-0x0000000007AE3000-memory.dmp

Download

memory/1984-49-0x0000000074530000-0x0000000074CEC000-memory.dmp

Download

memory/1984-48-0x0000000074530000-0x0000000074CEC000-memory.dmp

Download

memory/1984-16-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/1984-28-0x0000000074530000-0x0000000074CEC000-memory.dmp

Download

memory/1984-18-0x0000000074530000-0x0000000074CEC000-memory.dmp

Download

memory/4288-31-0x0000021FDDC80000-0x0000021FDDCA2000-memory.dmp

Download

memory/4896-40-0x00000000075F0000-0x000000000760A000-memory.dmp

Download

memory/4896-26-0x0000000006290000-0x00000000062AE000-memory.dmp

Download

memory/4896-14-0x0000000074530000-0x0000000074CEC000-memory.dmp

Download

memory/4896-15-0x00000000055A0000-0x0000000005BEA000-memory.dmp

Download

memory/4896-19-0x00000000054B0000-0x00000000054D2000-memory.dmp

Download

memory/4896-23-0x0000000005D10000-0x0000000005D76000-memory.dmp

Download

memory/4896-22-0x0000000005BF0000-0x0000000005C56000-memory.dmp

Download

memory/4896-24-0x0000000005E70000-0x00000000061CB000-memory.dmp

Download

memory/4896-17-0x0000000074530000-0x0000000074CEC000-memory.dmp

Download

memory/4896-39-0x0000000007C30000-0x00000000082AC000-memory.dmp

Download

memory/4896-27-0x0000000006640000-0x000000000668C000-memory.dmp

Download

memory/4896-12-0x0000000002A60000-0x0000000002A96000-memory.dmp

Download

memory/4896-13-0x0000000074530000-0x0000000074CEC000-memory.dmp

Download

memory/4896-47-0x0000000074530000-0x0000000074CEC000-memory.dmp

Download

memory/4896-37-0x0000000007480000-0x00000000074A0000-memory.dmp

Download

memory/4896-42-0x0000000007860000-0x00000000078F6000-memory.dmp

Download

memory/4896-38-0x00000000074B0000-0x0000000007553000-memory.dmp

Download

memory/4896-34-0x0000000074DF0000-0x0000000074E3C000-memory.dmp

Download

memory/4896-33-0x0000000006880000-0x00000000068B6000-memory.dmp

Download

memory/4896-41-0x0000000007660000-0x000000000766A000-memory.dmp

Download

memory/6108-25-0x0000000074530000-0x0000000074CEC000-memory.dmp

Download

memory/6108-0-0x0000000074542000-0x0000000074543000-memory.dmp

Download

memory/6108-9-0x0000000074530000-0x0000000074CEC000-memory.dmp

Download

memory/6108-8-0x0000000074542000-0x0000000074543000-memory.dmp

Download

memory/6108-7-0x0000000005720000-0x000000000573E000-memory.dmp

Download

memory/6108-10-0x0000000007B50000-0x0000000007BF0000-memory.dmp

Download

memory/6108-6-0x0000000074530000-0x0000000074CEC000-memory.dmp

Download

memory/6108-4-0x00000000053D0000-0x00000000053DA000-memory.dmp

Download

memory/6108-5-0x00000000054C0000-0x000000000555C000-memory.dmp

Download

memory/6108-3-0x0000000005320000-0x00000000053B2000-memory.dmp

Download

memory/6108-2-0x00000000059C0000-0x0000000005F7A000-memory.dmp

Download

memory/6108-1-0x0000000000750000-0x0000000000818000-memory.dmp

Download