xworm | cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f.exe
Size 867KB
Sample260707-rtahtsft9w
SHA256 cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f
MD5 c6a8f2766cb25cf806277b1c350d0518
SHA1 3fd3de31cdb4237917137a0c9360cb31f9159b99
SHA512 a3ceb6595de13bb2870dda80243d14a8135f5429cff3e4a35ed7c9bcae32dc5061f7d3e54ef6d3ab6db756d8ec51f89693826f4f24aab54a522d33a7ecd31a5e
SSDEEP 24576:cJxr+LjhK1Xme8k2mpP3zs2E6XLYTawZ8fPSn5:A+Lj+XmLys2KTnZWI5
TLSH
T16C15E058AA5BE803C66403758AE1F07403B95FD9E512D21B1FDE6EEB7A23B824DC4743
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

172.245.244.91:443

Mutex

gBVzdEtsxguIALJ2

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4248-18-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1436	powershell.exe
5564	powershell.exe
5420	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3932	xYnVqDsuWR.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Windows\CurrentVersion\Run\xYnVqDsuWR = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\n1fqir1yajc.ps1\""	cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3336 set thread context of 4248	3336	cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f.exe	90
PID 3932 set thread context of 3216	3932	xYnVqDsuWR.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xYnVqDsuWR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3336	cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f.exe
3336	cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f.exe
1436	powershell.exe
1436	powershell.exe
5420	powershell.exe
5420	powershell.exe
3932	xYnVqDsuWR.exe
3932	xYnVqDsuWR.exe
5564	powershell.exe
5564	powershell.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	3336	cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f.exe
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeDebugPrivilege	4248	MSBuild.exe
Token: SeDebugPrivilege	5420	powershell.exe
Token: SeIncreaseQuotaPrivilege	1436	powershell.exe
Token: SeSecurityPrivilege	1436	powershell.exe
Token: SeTakeOwnershipPrivilege	1436	powershell.exe
Token: SeLoadDriverPrivilege	1436	powershell.exe
Token: SeSystemProfilePrivilege	1436	powershell.exe
Token: SeSystemtimePrivilege	1436	powershell.exe
Token: SeProfSingleProcessPrivilege	1436	powershell.exe
Token: SeIncBasePriorityPrivilege	1436	powershell.exe
Token: SeCreatePagefilePrivilege	1436	powershell.exe
Token: SeBackupPrivilege	1436	powershell.exe
Token: SeRestorePrivilege	1436	powershell.exe
Token: SeShutdownPrivilege	1436	powershell.exe
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeSystemEnvironmentPrivilege	1436	powershell.exe
Token: SeRemoteShutdownPrivilege	1436	powershell.exe
Token: SeUndockPrivilege	1436	powershell.exe
Token: SeManageVolumePrivilege	1436	powershell.exe
Token: 33	1436	powershell.exe
Token: 34	1436	powershell.exe
Token: 35	1436	powershell.exe
Token: 36	1436	powershell.exe
Token: SeDebugPrivilege	3932	xYnVqDsuWR.exe
Token: SeDebugPrivilege	5564	powershell.exe
Token: SeDebugPrivilege	3216	MSBuild.exe
Token: SeIncreaseQuotaPrivilege	5564	powershell.exe
Token: SeSecurityPrivilege	5564	powershell.exe
Token: SeTakeOwnershipPrivilege	5564	powershell.exe
Token: SeLoadDriverPrivilege	5564	powershell.exe
Token: SeSystemProfilePrivilege	5564	powershell.exe
Token: SeSystemtimePrivilege	5564	powershell.exe
Token: SeProfSingleProcessPrivilege	5564	powershell.exe
Token: SeIncBasePriorityPrivilege	5564	powershell.exe
Token: SeCreatePagefilePrivilege	5564	powershell.exe
Token: SeBackupPrivilege	5564	powershell.exe
Token: SeRestorePrivilege	5564	powershell.exe
Token: SeShutdownPrivilege	5564	powershell.exe
Token: SeDebugPrivilege	5564	powershell.exe
Token: SeSystemEnvironmentPrivilege	5564	powershell.exe
Token: SeRemoteShutdownPrivilege	5564	powershell.exe
Token: SeUndockPrivilege	5564	powershell.exe
Token: SeManageVolumePrivilege	5564	powershell.exe
Token: 33	5564	powershell.exe
Token: 34	5564	powershell.exe
Token: 35	5564	powershell.exe
Token: 36	5564	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 1436	3336	cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f.exe	88
PID 3336 wrote to memory of 4248	3336	cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f.exe	90
PID 3336 wrote to memory of 4248	3336	cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f.exe	90
PID 3336 wrote to memory of 4248	3336	cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f.exe	90
PID 3336 wrote to memory of 4248	3336	cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f.exe	90
PID 3336 wrote to memory of 4248	3336	cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f.exe	90
PID 5420 wrote to memory of 3932	5420	powershell.exe	94
PID 3932 wrote to memory of 5564	3932	xYnVqDsuWR.exe	96
PID 3932 wrote to memory of 3216	3932	xYnVqDsuWR.exe	98
PID 3932 wrote to memory of 3216	3932	xYnVqDsuWR.exe	98
PID 3932 wrote to memory of 3216	3932	xYnVqDsuWR.exe	98
PID 3932 wrote to memory of 3216	3932	xYnVqDsuWR.exe	98
PID 3932 wrote to memory of 3216	3932	xYnVqDsuWR.exe	98

C:\Users\Admin\AppData\Local\Temp\cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f.exe
"C:\Users\Admin\AppData\Local\Temp\cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4248

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\n1fqir1yajc.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5420
- C:\Users\Admin\AppData\Roaming\xYnVqDsuWR.exe
  "C:\Users\Admin\AppData\Roaming\xYnVqDsuWR.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xYnVqDsuWR.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5564
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4e14a7b28afff95b70ba849207619ff903c6ea821b8cf2c12b589579a7d7d3af
MD5 099f7306d2e129f2a3dd4a124f5e9f61
SHA1 d5f10a991ea12b52de9b43832ff344766835e8a1
SHA512 9914dea58ce264b1a34f795aa57129779222f50fd7f4c658a649e1cfc84042af732389bfff477919dc04b802c28ff404225883f52a43fce8da7c5b0ee550054c
TLSH
T108215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xg01s2aj.m3m.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xg01s2aj.m3m.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

n1fqir1yajc.ps1

Path C:\Users\Admin\AppData\Local\Temp\n1fqir1yajc.ps1
Size 1KB
SHA256 91dbea9fcd9e92a82b7efd333efb1fecd2f6e03696dd7d1a0aeb1163129ac979
MD5 6d45b1e170a5b5ce4c69c90ef30297ab
SHA1 48ed17286a422af924eb6cc5777a23724d93200f
SHA512 7f3d8d6d4ea2246b7207c3f1980ce48a076a4b2ec935b049d5fd0bd0fecbfa74c14f48bb45d377a1a2c1c11d1a59f4c372b9fce45518129764708dd43e332ed6
TLSH
T1CB21EE1B8E8847C2506443E0010371CDB22D62CB277F449095EDB6AEB327E63386ACD4
MD5 SHA1 SHA512 TLSH

Submit Download

xYnVqDsuWR.exe

Path C:\Users\Admin\AppData\Roaming\xYnVqDsuWR.exe
Size 867KB
SHA256 cfbed85c7d61b9127e13610df2e9cf2c2502b137ea36c8c4b6a9497869d0310f
MD5 c6a8f2766cb25cf806277b1c350d0518
SHA1 3fd3de31cdb4237917137a0c9360cb31f9159b99
SHA512 a3ceb6595de13bb2870dda80243d14a8135f5429cff3e4a35ed7c9bcae32dc5061f7d3e54ef6d3ab6db756d8ec51f89693826f4f24aab54a522d33a7ecd31a5e
SSDEEP 24576:cJxr+LjhK1Xme8k2mpP3zs2E6XLYTawZ8fPSn5:A+Lj+XmLys2KTnZWI5
TLSH
T16C15E058AA5BE803C66403758AE1F07403B95FD9E512D21B1FDE6EEB7A23B824DC4743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1436-40-0x00000000078F0000-0x000000000790A000-memory.dmp

Download

memory/1436-41-0x0000000007960000-0x000000000796A000-memory.dmp

Download

memory/1436-47-0x0000000075130000-0x00000000758EC000-memory.dmp

Download

memory/1436-42-0x0000000007B60000-0x0000000007BF6000-memory.dmp

Download

memory/1436-39-0x0000000007F30000-0x00000000085AC000-memory.dmp

Download

memory/1436-33-0x0000000007540000-0x0000000007576000-memory.dmp

Download

memory/1436-38-0x0000000007590000-0x0000000007633000-memory.dmp

Download

memory/1436-37-0x0000000006B50000-0x0000000006B70000-memory.dmp

Download

memory/1436-13-0x0000000075130000-0x00000000758EC000-memory.dmp

Download

memory/1436-14-0x0000000002D50000-0x0000000002D86000-memory.dmp

Download

memory/1436-16-0x0000000075130000-0x00000000758EC000-memory.dmp

Download

memory/1436-15-0x0000000005890000-0x0000000005EDA000-memory.dmp

Download

memory/1436-17-0x0000000075130000-0x00000000758EC000-memory.dmp

Download

memory/1436-34-0x0000000070550000-0x000000007059C000-memory.dmp

Download

memory/1436-26-0x00000000065B0000-0x00000000065FC000-memory.dmp

Download

memory/1436-20-0x00000000057A0000-0x00000000057C2000-memory.dmp

Download

memory/1436-24-0x0000000006000000-0x0000000006066000-memory.dmp

Download

memory/1436-21-0x0000000005EE0000-0x0000000005F46000-memory.dmp

Download

memory/1436-25-0x0000000006560000-0x000000000657E000-memory.dmp

Download

memory/3336-8-0x0000000075142000-0x0000000075143000-memory.dmp

Download

memory/3336-3-0x0000000005A90000-0x0000000005B22000-memory.dmp

Download

memory/3336-9-0x0000000075130000-0x00000000758EC000-memory.dmp

Download

memory/3336-6-0x0000000008140000-0x0000000008160000-memory.dmp

Download

memory/3336-4-0x0000000003720000-0x000000000372A000-memory.dmp

Download

memory/3336-0-0x0000000075142000-0x0000000075143000-memory.dmp

Download

memory/3336-11-0x00000000089B0000-0x0000000008A4C000-memory.dmp

Download

memory/3336-27-0x0000000075130000-0x00000000758EC000-memory.dmp

Download

memory/3336-1-0x0000000000E70000-0x0000000000F50000-memory.dmp

Download

memory/3336-2-0x0000000006050000-0x000000000660A000-memory.dmp

Download

memory/3336-5-0x0000000075130000-0x00000000758EC000-memory.dmp

Download

memory/3336-7-0x0000000008160000-0x00000000084BB000-memory.dmp

Download

memory/3336-10-0x0000000008910000-0x00000000089B4000-memory.dmp

Download

memory/3932-48-0x0000000007D50000-0x00000000080AB000-memory.dmp

Download

memory/4248-18-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4248-19-0x0000000075130000-0x00000000758EC000-memory.dmp

Download

memory/4248-28-0x0000000075130000-0x00000000758EC000-memory.dmp

Download

memory/4248-49-0x0000000075130000-0x00000000758EC000-memory.dmp

Download

memory/5420-31-0x00000161E9D70000-0x00000161E9D92000-memory.dmp

Download

memory/5564-53-0x0000000006630000-0x000000000698B000-memory.dmp

Download

memory/5564-55-0x0000000006EE0000-0x0000000006F2C000-memory.dmp

Download

memory/5564-56-0x0000000071420000-0x000000007146C000-memory.dmp

Download

memory/5564-59-0x00000000079A0000-0x0000000007A43000-memory.dmp

Download