xworm | ca2d4b59516509c4ae1861a252be838cb58e6aeee8f3294df405204e964a5c4e

Resubmissions

14/07/2026, 22:33

260714-2ghnsaez4l

14/07/2026, 22:31

260714-2fmlcag13w10

Analysis

user interaction
yes
max time kernel
72s
max time network
75s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
14/07/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MenuV2.rar
Size 741KB
Sample260714-2fmlcag13w
SHA256 ca2d4b59516509c4ae1861a252be838cb58e6aeee8f3294df405204e964a5c4e
MD5 26f0acf3a2b34536d6685207add19ecf
SHA1 7644dadc627d99c0a913e1a45ba427e25f7a8a41
SHA512 3cf71d752075c9e8f25595ecc27fb5404ff1d7a4b097c186cba8dec60c293779157a8b618f583e974e39823d437c2cdac3058bd9842ffec2a82658a46e66d9e0
SSDEEP 12288:ptyBriqoTKsX2ayvr5fEFyUT93NiMeN1PVNFC06LtjsCJ9JHfJae0bxKchypYNTS:j0riqJker58FygYMe5NFQlHJ/we0bgce
TLSH
T136F43342E1668CB068D69C6DDC71EED1E2F208C1513FF0591C6D0CAEBA3E6D625BB6C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V5.6

foranother1337.publicvm.com:55554

Attributes

Install_directory
%ProgramData%
install_file
chrome.exe

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001900000002b4e3-25.dat	family_xworm
behavioral1/memory/4464-34-0x0000000000460000-0x0000000000492000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1172	powershell.exe
1252	powershell.exe
1108	powershell.exe
5360	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.lnk	chrome.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.lnk	chrome.exe

Executes dropped EXE 8 IoCs

pid	Process
3920	MenuV2.exe
3048	QhdflOwFXeGp.exe
4464	chrome.exe
3248	MenuV2.exe
5436	QhdflOwFXeGp.exe
5432	chrome.exe
3216	chrome.exe
2488	chrome.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "C:\\ProgramData\\chrome.exe"	chrome.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4824	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3668	7zFM.exe
3668	7zFM.exe
3668	7zFM.exe
3668	7zFM.exe
3668	7zFM.exe
3668	7zFM.exe
1172	powershell.exe
1172	powershell.exe
1252	powershell.exe
1252	powershell.exe
1108	powershell.exe
1108	powershell.exe
5360	powershell.exe
5360	powershell.exe
4464	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3668	7zFM.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeRestorePrivilege	3668	7zFM.exe
Token: 35	3668	7zFM.exe
Token: SeSecurityPrivilege	3668	7zFM.exe
Token: SeDebugPrivilege	4464	chrome.exe
Token: SeSecurityPrivilege	3668	7zFM.exe
Token: SeDebugPrivilege	1172	powershell.exe
Token: SeDebugPrivilege	1252	powershell.exe
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeDebugPrivilege	5432	chrome.exe
Token: SeDebugPrivilege	5360	powershell.exe
Token: SeDebugPrivilege	4464	chrome.exe
Token: SeDebugPrivilege	3216	chrome.exe
Token: SeDebugPrivilege	2488	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3668	7zFM.exe
3668	7zFM.exe
3668	7zFM.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4464	chrome.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 3920	3668	7zFM.exe	80
PID 3920 wrote to memory of 3048	3920	MenuV2.exe	81
PID 3920 wrote to memory of 4464	3920	MenuV2.exe	83
PID 4464 wrote to memory of 1172	4464	chrome.exe	86
PID 4464 wrote to memory of 1252	4464	chrome.exe	88
PID 4464 wrote to memory of 1108	4464	chrome.exe	91
PID 4464 wrote to memory of 5360	4464	chrome.exe	93
PID 3248 wrote to memory of 5436	3248	MenuV2.exe	95
PID 3248 wrote to memory of 5432	3248	MenuV2.exe	96
PID 4464 wrote to memory of 4824	4464	chrome.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\MenuV2.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Users\Admin\AppData\Local\Temp\7zO45EE2C18\MenuV2.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO45EE2C18\MenuV2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Users\Admin\AppData\Local\Temp\QhdflOwFXeGp.exe
    "C:\Users\Admin\AppData\Local\Temp\QhdflOwFXeGp.exe"
    3⤵
    - Executes dropped EXE
    PID:3048
- - C:\Users\Admin\AppData\Local\Temp\chrome.exe
    "C:\Users\Admin\AppData\Local\Temp\chrome.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\chrome.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'chrome.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\chrome.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'chrome.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5360
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "chrome" /tr "C:\ProgramData\chrome.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4824

C:\Users\Admin\Desktop\MenuV2.exe
"C:\Users\Admin\Desktop\MenuV2.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Users\Admin\AppData\Local\Temp\QhdflOwFXeGp.exe
  "C:\Users\Admin\AppData\Local\Temp\QhdflOwFXeGp.exe"
  2⤵
  - Executes dropped EXE
  PID:5436
- C:\Users\Admin\AppData\Local\Temp\chrome.exe
  "C:\Users\Admin\AppData\Local\Temp\chrome.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5432

C:\ProgramData\chrome.exe
C:\ProgramData\chrome.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3216

C:\PROGRA~3\chrome.exe
C:\PROGRA~3\chrome.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MenuV2.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MenuV2.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
TLSH
T119F0A2302371E1C8C9263F422C0D2A4966AF474A7B50FE0C7694635DD825167AF313F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6634968704019d616ea44189481094ad43f12e8a42d9931d210824f49b808e6f
MD5 23b3ad931bb1668bfdb10c12827690ad
SHA1 a54b3a2e46f4fc409a5e33eeefb50aeaf64c6c8f
SHA512 af8c73b7f7b9013ad2a37704b42715343d0028bc1fd22f7a917d2d681bba0f44c7676ecd034b28f951eb8f530c2e34857fa68b83d3285a01780abcc60551acee
TLSH
T10C218933B7ACC134C8D9117A108DAD01B2B5C3C7449ECE8B7B84C508A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 af55124cb4651151aad84c2909c287208825ee887349661bdd407d2c8e13824a
MD5 a45bc688cd525ce02f01240291dc8adc
SHA1 1d65b52423e58484808481b496f56b9154617be4
SHA512 9b0393613265e618a0f1cfdaa7267d7ae27d547d91fa866905cab1fb3e70a7c1684b4a9c8d3a7c0195a744af8cb087894ebbe15455f6b57c0b809fae0d68128f
TLSH
T16721AB33B79CC134C8D9117A108DAD01B2B5C3C7449ECE8B7BC4C518A5BF899DF641A4
MD5 SHA1 SHA512 TLSH

Submit Download

MenuV2.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO45EE2C18\MenuV2.exe
Size 748KB
SHA256 b25eb7be7027a8a28d06a9c1fbea75d43116111bbaed3aa0d549b6d3ac90bab4
MD5 5f0d461210ca6dba34f3fa4adb952ac8
SHA1 21f2a762cc0205043a22bfafbb203f9ac82c6ef0
SHA512 6efc85babe5a304c5c815cc320880d10f3657dd7e78aea9c0bf10daa80c81b95e7f7627f0f4d3a8028ca25f914abae7547999fc333596849808115ea8dcdf2d8
SSDEEP 12288:kc5K8fRXOGtBupFYRoKYOEvyPtG3LG7ghRhJX2OaGnn+jTFd/4ZzoSOpwT37MMp:R1OaBMAtPEvy1qLwgDhJXdnakznOpwT6
TLSH
T187F42338473D4375F42A0E362B96EA41824F2A9CCE670DC70D285B7B17D13A366E3563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QhdflOwFXeGp.exe

Path C:\Users\Admin\AppData\Local\Temp\QhdflOwFXeGp.exe
Size 1.4MB
SHA256 d16f4df6d0a0b0993748bd01ffd6f4ef8bdf1a57399f4310583986b9fbf0be40
MD5 025c9c1d81a59636b571bdeb5771e88b
SHA1 1699b594612cb29084c10117dc17762ee94c2f78
SHA512 06fda7f365306f717cf328d56f4be0c8ee5f3752dc09d2d2dcaabdf225bed13e7a02478543aedb01cec47ea39d8d59a85939515066dadc37e951ec3c95c93139
SSDEEP 24576:iJgvkMzSYAM9YSlbczEpQizftQDc06WogeOfQr0W:itMzLAVStcdiTgFoR2A0W
TLSH
T1CC65AE0F735A03E9D4B68934DA96E317E37578601B2086EF67D40F56AF9F2E0193A702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_tc5fkucw.fno.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tc5fkucw.fno.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Local\Temp\chrome.exe
Size 174KB
SHA256 3854aa574b53b84219c68ea290690336d32f2f385f062374e16047e952ed8c4c
MD5 54a7cfdfb3cadabfbf11bef30dd4cffe
SHA1 298f12375ac940d3e716c843542f60ccddb54867
SHA512 99d630fa5737d3651326d0ea2a92b148cbc5831c513ab12b74a821213082609c9f8991e3e6496886f4b491c138521846b08a51fc034899e9eac8935a9432cbbb
SSDEEP 3072:NSgmgpLLNRnX/bkg5ajOTvN4NpVq8BxFRzaqF+o2GQJ7/JzqVfGvi:NsgpLLN9vb7hNgVqwlL
TLSH
T1C504C4698BEBB642C49A55747C7363824A3D1F79A4CF35168EE33FED1BB3C9411120A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1172-57-0x000002AD36BA0000-0x000002AD36BA6000-memory.dmp

Download

memory/1172-52-0x000002AD36B50000-0x000002AD36B5A000-memory.dmp

Download

memory/1172-53-0x000002AD36B80000-0x000002AD36B9C000-memory.dmp

Download

memory/1172-54-0x000002AD36B60000-0x000002AD36B6A000-memory.dmp

Download

memory/1172-55-0x000002AD38310000-0x000002AD3832A000-memory.dmp

Download

memory/1172-56-0x000002AD36B70000-0x000002AD36B78000-memory.dmp

Download

memory/1172-51-0x000002AD38230000-0x000002AD382E3000-memory.dmp

Download

memory/1172-58-0x000002AD382F0000-0x000002AD382FA000-memory.dmp

Download

memory/1172-50-0x000002AD36B30000-0x000002AD36B4C000-memory.dmp

Download

memory/1172-39-0x000002AD1E640000-0x000002AD1E662000-memory.dmp

Download

memory/3920-13-0x0000000001730000-0x0000000001740000-memory.dmp

Download

memory/3920-12-0x0000000000E40000-0x0000000000F02000-memory.dmp

Download

memory/4464-34-0x0000000000460000-0x0000000000492000-memory.dmp

Download