xworm | 45f3b2a158163f09cfbf248a2fa76f2b3b011b8abc35835230ab81597db43802

Analysis

user interaction
yes
max time kernel
219s
max time network
214s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/07/2026, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
123645.exe
Size 84KB
Sample260705-sc6elsc12x
SHA256 45f3b2a158163f09cfbf248a2fa76f2b3b011b8abc35835230ab81597db43802
MD5 e3a5cb4262f94dd45dab2d497cb49adb
SHA1 df7c2195fffccc1cdbecaabd883151d32ff9d67d
SHA512 708e8d68674b734aa9ddf95514476a2c72eb780efa506155fcf197aeed7f8e1babd7d34c48c3df4315553a0c9fe85de9f673c5ce67a0387a1adc4a8159e9618c
SSDEEP 1536:jLOhmFlCRUh1sLJVQr9rcYTJzQ5f/sksVQgUnH85CDxQ+vD7N2up1jSic:X/X14wJrcY2/hUxUnHuCMhic
TLSH
T1A783023F3B012A31EAE656760BE2E1B825B4C7469D6C8EEDC8D3751BBC980CC7C4515A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm rat trojan

Malware Config

Extracted

Family

xworm

7326.info:2686

Attributes

install_file
USB.exe
localhost
127.0.0.1

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5800-9-0x0000000000400000-0x0000000000418000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5716	powershell.exe
5292	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2768 set thread context of 5800	2768	123645.exe	89

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	123645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5800	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5716	powershell.exe
5716	powershell.exe
5292	powershell.exe
5292	powershell.exe
5800	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	5800	RegSvcs.exe
Token: SeDebugPrivilege	5716	powershell.exe
Token: SeIncreaseQuotaPrivilege	5716	powershell.exe
Token: SeSecurityPrivilege	5716	powershell.exe
Token: SeTakeOwnershipPrivilege	5716	powershell.exe
Token: SeLoadDriverPrivilege	5716	powershell.exe
Token: SeSystemProfilePrivilege	5716	powershell.exe
Token: SeSystemtimePrivilege	5716	powershell.exe
Token: SeProfSingleProcessPrivilege	5716	powershell.exe
Token: SeIncBasePriorityPrivilege	5716	powershell.exe
Token: SeCreatePagefilePrivilege	5716	powershell.exe
Token: SeBackupPrivilege	5716	powershell.exe
Token: SeRestorePrivilege	5716	powershell.exe
Token: SeShutdownPrivilege	5716	powershell.exe
Token: SeDebugPrivilege	5716	powershell.exe
Token: SeSystemEnvironmentPrivilege	5716	powershell.exe
Token: SeRemoteShutdownPrivilege	5716	powershell.exe
Token: SeUndockPrivilege	5716	powershell.exe
Token: SeManageVolumePrivilege	5716	powershell.exe
Token: 33	5716	powershell.exe
Token: 34	5716	powershell.exe
Token: 35	5716	powershell.exe
Token: 36	5716	powershell.exe
Token: SeDebugPrivilege	5292	powershell.exe
Token: SeIncreaseQuotaPrivilege	5292	powershell.exe
Token: SeSecurityPrivilege	5292	powershell.exe
Token: SeTakeOwnershipPrivilege	5292	powershell.exe
Token: SeLoadDriverPrivilege	5292	powershell.exe
Token: SeSystemProfilePrivilege	5292	powershell.exe
Token: SeSystemtimePrivilege	5292	powershell.exe
Token: SeProfSingleProcessPrivilege	5292	powershell.exe
Token: SeIncBasePriorityPrivilege	5292	powershell.exe
Token: SeCreatePagefilePrivilege	5292	powershell.exe
Token: SeBackupPrivilege	5292	powershell.exe
Token: SeRestorePrivilege	5292	powershell.exe
Token: SeShutdownPrivilege	5292	powershell.exe
Token: SeDebugPrivilege	5292	powershell.exe
Token: SeSystemEnvironmentPrivilege	5292	powershell.exe
Token: SeRemoteShutdownPrivilege	5292	powershell.exe
Token: SeUndockPrivilege	5292	powershell.exe
Token: SeManageVolumePrivilege	5292	powershell.exe
Token: 33	5292	powershell.exe
Token: 34	5292	powershell.exe
Token: 35	5292	powershell.exe
Token: 36	5292	powershell.exe
Token: SeDebugPrivilege	5800	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5800	RegSvcs.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 5800	2768	123645.exe	89
PID 2768 wrote to memory of 5800	2768	123645.exe	89
PID 2768 wrote to memory of 5800	2768	123645.exe	89
PID 2768 wrote to memory of 5800	2768	123645.exe	89
PID 2768 wrote to memory of 5800	2768	123645.exe	89
PID 5800 wrote to memory of 5716	5800	RegSvcs.exe	90
PID 5800 wrote to memory of 5292	5800	RegSvcs.exe	94

C:\Users\Admin\AppData\Local\Temp\123645.exe
"C:\Users\Admin\AppData\Local\Temp\123645.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5800
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5716
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegSvcs.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 730aff8c9e430a9f9e5e44f1c376e57f42fa5adc744824df2f69855009473592
MD5 f811272c20ff6decbbd16ff364334427
SHA1 cb31be66c972daa61d45920fa2fa824c1dfb194d
SHA512 5c68bf3a41c3607cad5abe94f2bb3816f3e69426fa7d43bf7c9787c4e9ce6660b1843a2e505a22a93d7008b76fc564078513fe9ef47051e5b6fc344ab9d0a528
TLSH
T14F417B303131B4D84D826F0215286EC5A3EF878AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 8cfac8a70dd886497c33be46dae035a4fb5aa1998e2fd2de209b34fb1ed50108
MD5 3fb5a71fdbda18147f8d30683ef5c9be
SHA1 9b9fcb90305ae9ed27266316ca54eedc2c290d93
SHA512 3aa4078e7971319a65b2d592c6e79df9344cbaf8fc384cdb8c82fef24eb7d86ac235479811125c89c93c821fadf25cbb8232ba175b5007230caf1b4e1ae40c8a
SSDEEP 384:7hQD3MuaX2CGV9bJEB9cs2dk4UcnRXcxNiRZfv21J8CXtb5CogDMQ2SVHIMF:lgMuA2TbJO2eVcnyemcCXvt+
TLSH
T1BCA2C83520B79DE9DAC515B0569D0AEEFFD0D8419BB872CCE72DFA1D4CE2D364620064
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ghnx3hfl.jwx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ghnx3hfl.jwx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2768-6-0x0000000004F80000-0x0000000004F90000-memory.dmp

Download

memory/2768-4-0x0000000004D40000-0x0000000004D4A000-memory.dmp

Download

memory/2768-5-0x0000000004EB0000-0x0000000004F26000-memory.dmp

Download

memory/2768-3-0x0000000004F80000-0x0000000004F90000-memory.dmp

Download

memory/2768-7-0x0000000004D50000-0x0000000004D6A000-memory.dmp

Download

memory/2768-8-0x0000000004F50000-0x0000000004F6E000-memory.dmp

Download

memory/2768-2-0x0000000004D90000-0x0000000004E22000-memory.dmp

Download

memory/2768-1-0x00000000052A0000-0x0000000005846000-memory.dmp

Download

memory/2768-0-0x0000000000330000-0x000000000034C000-memory.dmp

Download

memory/5292-59-0x000000006FA10000-0x000000006FA5C000-memory.dmp

Download

memory/5292-57-0x0000000005910000-0x0000000005C67000-memory.dmp

Download

memory/5716-34-0x0000000005350000-0x0000000005360000-memory.dmp

Download

memory/5716-12-0x0000000005210000-0x0000000005246000-memory.dmp

Download

memory/5716-17-0x00000000061E0000-0x0000000006246000-memory.dmp

Download

memory/5716-15-0x0000000005A30000-0x00000000060FA000-memory.dmp

Download

memory/5716-18-0x0000000006250000-0x00000000062B6000-memory.dmp

Download

memory/5716-26-0x00000000062C0000-0x0000000006617000-memory.dmp

Download

memory/5716-27-0x0000000006870000-0x000000000688E000-memory.dmp

Download

memory/5716-28-0x0000000006910000-0x000000000695C000-memory.dmp

Download

memory/5716-29-0x000000007EF00000-0x000000007EF10000-memory.dmp

Download

memory/5716-30-0x0000000007A30000-0x0000000007A62000-memory.dmp

Download

memory/5716-31-0x000000006FA10000-0x000000006FA5C000-memory.dmp

Download

memory/5716-38-0x0000000005350000-0x0000000005360000-memory.dmp

Download

memory/5716-41-0x0000000007A70000-0x0000000007A8E000-memory.dmp

Download

memory/5716-16-0x0000000006140000-0x0000000006162000-memory.dmp

Download

memory/5716-42-0x0000000007AA0000-0x0000000007B43000-memory.dmp

Download

memory/5716-43-0x0000000008220000-0x000000000889A000-memory.dmp

Download

memory/5716-44-0x0000000007BD0000-0x0000000007BEA000-memory.dmp

Download

memory/5716-45-0x0000000007C30000-0x0000000007C3A000-memory.dmp

Download

memory/5716-46-0x0000000007E50000-0x0000000007EE6000-memory.dmp

Download

memory/5716-14-0x0000000005350000-0x0000000005360000-memory.dmp

Download

memory/5716-13-0x0000000005350000-0x0000000005360000-memory.dmp

Download

memory/5800-11-0x00000000053B0000-0x000000000544C000-memory.dmp

Download

memory/5800-9-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/5800-68-0x00000000055E0000-0x00000000055F0000-memory.dmp

Download

memory/5800-69-0x00000000055E0000-0x00000000055F0000-memory.dmp

Download