xworm | b4a3205341b7d6eee7d8a810300a39960ac66c7fb89f585a06c6e1e921a49820

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
products.exe
Size 66KB
Sample260716-pgvbcscz3p
SHA256 b4a3205341b7d6eee7d8a810300a39960ac66c7fb89f585a06c6e1e921a49820
MD5 650f23885fb2959893108950df8e1e22
SHA1 9386b1a0b191f56cf4cf6669303b507d7f72201d
SHA512 b6ef661d780148b528e7cef327ab4dd71e57a237ea950e27f42d7b7634731ff2b505cab04af83c205702b18d820836e6a40fa8e3ce8549b2c31cc7540bd8a6d0
SSDEEP 768:wNOlPy66++RRbQdTXded6k5GKMFg9WIV6POAhsdegcJ/WNrKM5Mm67l:oOsj3QdTX6CFg9WIV6POA+cfRWJIl
TLSH
T1DA6380CABF848D10D9AD97F104621286063DFD86D423974F07A875E65E3BD838A73ED2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection execution xworm persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

64.89.161.16:1470

Mutex

gWrIq26jVxrJjlUp

Attributes

Install_directory
%AppData%
install_file
schost.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2844-1-0x00000000004B0000-0x00000000004C6000-memory.dmp	family_xworm
behavioral2/files/0x001500000001c58d-54.dat	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4852	powershell.exe
3396	powershell.exe
6092	powershell.exe
6076	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\schost.lnk	products.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\schost.lnk	products.exe

Executes dropped EXE 4 IoCs

pid	Process
1836	schost.exe
4120	schost.exe
3720	schost.exe
5052	schost.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	products.exe
Key opened	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	products.exe
Key opened	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	products.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\schost = "C:\\Users\\Admin\\AppData\\Roaming\\schost.exe"	products.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2760	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2844	products.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4852	powershell.exe
4852	powershell.exe
3396	powershell.exe
3396	powershell.exe
6092	powershell.exe
6092	powershell.exe
6076	powershell.exe
6076	powershell.exe
2844	products.exe
2844	products.exe
2844	products.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2844	products.exe
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeIncreaseQuotaPrivilege	4852	powershell.exe
Token: SeSecurityPrivilege	4852	powershell.exe
Token: SeTakeOwnershipPrivilege	4852	powershell.exe
Token: SeLoadDriverPrivilege	4852	powershell.exe
Token: SeSystemProfilePrivilege	4852	powershell.exe
Token: SeSystemtimePrivilege	4852	powershell.exe
Token: SeProfSingleProcessPrivilege	4852	powershell.exe
Token: SeIncBasePriorityPrivilege	4852	powershell.exe
Token: SeCreatePagefilePrivilege	4852	powershell.exe
Token: SeBackupPrivilege	4852	powershell.exe
Token: SeRestorePrivilege	4852	powershell.exe
Token: SeShutdownPrivilege	4852	powershell.exe
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeSystemEnvironmentPrivilege	4852	powershell.exe
Token: SeRemoteShutdownPrivilege	4852	powershell.exe
Token: SeUndockPrivilege	4852	powershell.exe
Token: SeManageVolumePrivilege	4852	powershell.exe
Token: 33	4852	powershell.exe
Token: 34	4852	powershell.exe
Token: 35	4852	powershell.exe
Token: 36	4852	powershell.exe
Token: SeDebugPrivilege	3396	powershell.exe
Token: SeIncreaseQuotaPrivilege	3396	powershell.exe
Token: SeSecurityPrivilege	3396	powershell.exe
Token: SeTakeOwnershipPrivilege	3396	powershell.exe
Token: SeLoadDriverPrivilege	3396	powershell.exe
Token: SeSystemProfilePrivilege	3396	powershell.exe
Token: SeSystemtimePrivilege	3396	powershell.exe
Token: SeProfSingleProcessPrivilege	3396	powershell.exe
Token: SeIncBasePriorityPrivilege	3396	powershell.exe
Token: SeCreatePagefilePrivilege	3396	powershell.exe
Token: SeBackupPrivilege	3396	powershell.exe
Token: SeRestorePrivilege	3396	powershell.exe
Token: SeShutdownPrivilege	3396	powershell.exe
Token: SeDebugPrivilege	3396	powershell.exe
Token: SeSystemEnvironmentPrivilege	3396	powershell.exe
Token: SeRemoteShutdownPrivilege	3396	powershell.exe
Token: SeUndockPrivilege	3396	powershell.exe
Token: SeManageVolumePrivilege	3396	powershell.exe
Token: 33	3396	powershell.exe
Token: 34	3396	powershell.exe
Token: 35	3396	powershell.exe
Token: 36	3396	powershell.exe
Token: SeDebugPrivilege	6092	powershell.exe
Token: SeIncreaseQuotaPrivilege	6092	powershell.exe
Token: SeSecurityPrivilege	6092	powershell.exe
Token: SeTakeOwnershipPrivilege	6092	powershell.exe
Token: SeLoadDriverPrivilege	6092	powershell.exe
Token: SeSystemProfilePrivilege	6092	powershell.exe
Token: SeSystemtimePrivilege	6092	powershell.exe
Token: SeProfSingleProcessPrivilege	6092	powershell.exe
Token: SeIncBasePriorityPrivilege	6092	powershell.exe
Token: SeCreatePagefilePrivilege	6092	powershell.exe
Token: SeBackupPrivilege	6092	powershell.exe
Token: SeRestorePrivilege	6092	powershell.exe
Token: SeShutdownPrivilege	6092	powershell.exe
Token: SeDebugPrivilege	6092	powershell.exe
Token: SeSystemEnvironmentPrivilege	6092	powershell.exe
Token: SeRemoteShutdownPrivilege	6092	powershell.exe
Token: SeUndockPrivilege	6092	powershell.exe
Token: SeManageVolumePrivilege	6092	powershell.exe
Token: 33	6092	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2844	products.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 4852	2844	products.exe	87
PID 2844 wrote to memory of 3396	2844	products.exe	90
PID 2844 wrote to memory of 6092	2844	products.exe	92
PID 2844 wrote to memory of 6076	2844	products.exe	94
PID 2844 wrote to memory of 2760	2844	products.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	products.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	products.exe

C:\Users\Admin\AppData\Local\Temp\products.exe
"C:\Users\Admin\AppData\Local\Temp\products.exe"
1⤵
- Drops startup file
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\products.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'products.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\schost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'schost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6076
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "schost" /tr "C:\Users\Admin\AppData\Roaming\schost.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2760

C:\Users\Admin\AppData\Roaming\schost.exe
C:\Users\Admin\AppData\Roaming\schost.exe
1⤵
- Executes dropped EXE
PID:1836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1716

C:\Users\Admin\AppData\Roaming\schost.exe
"C:\Users\Admin\AppData\Roaming\schost.exe"
1⤵
- Executes dropped EXE
PID:4120

C:\Users\Admin\AppData\Roaming\schost.exe
"C:\Users\Admin\AppData\Roaming\schost.exe"
1⤵
- Executes dropped EXE
PID:3720

C:\Users\Admin\AppData\Roaming\schost.exe
"C:\Users\Admin\AppData\Roaming\schost.exe"
1⤵
- Executes dropped EXE
PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f7680072ca5221cf2d0f5ef9769a208e6ade25923ae1978cfe80fbdc4748dc3a
MD5 eb72d559eabf90cedffc8b7cf6f6f8c4
SHA1 d6e019d739b4449f763fe58f6328967e2ca1dd0e
SHA512 077a72e9235386248102f36ab70fd5691aed539416f813bed543681cd2d1caf0d40edd1647933f49412f83cf7d422518cbf1602043709365b25c4cc7267e92a5
TLSH
T16B216837B3DD8614C89A413A10CDAD1036B6CBDB40DECF5B6B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3ca3a237804ea63e1813edcd74a299fbd5d568deb389f5828519c949d2c87b8d
MD5 5eab98e01a0edae01deb254b84c391f1
SHA1 da9648aa531724a994844c868f1674b9727e2c92
SHA512 02c1e23c5c7ee2a935a9bd5db003cf90aedb63f7d0ebc4268b0431a126a70aa022c5a7b698201578657d66e7d4863e34da0a4d1f0f59910ef42f4642fda00759
TLSH
T1C3216837B3DD8614CC9A413A10CDAD1036B6CBDB40DECE5B7B85E655A43F699CE61060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mhe3n1hx.5pb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mhe3n1hx.5pb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

schost.exe

Path C:\Users\Admin\AppData\Roaming\schost.exe
Size 66KB
SHA256 b4a3205341b7d6eee7d8a810300a39960ac66c7fb89f585a06c6e1e921a49820
MD5 650f23885fb2959893108950df8e1e22
SHA1 9386b1a0b191f56cf4cf6669303b507d7f72201d
SHA512 b6ef661d780148b528e7cef327ab4dd71e57a237ea950e27f42d7b7634731ff2b505cab04af83c205702b18d820836e6a40fa8e3ce8549b2c31cc7540bd8a6d0
SSDEEP 768:wNOlPy66++RRbQdTXded6k5GKMFg9WIV6POAhsdegcJ/WNrKM5Mm67l:oOsj3QdTX6CFg9WIV6POA+cfRWJIl
TLSH
T1DA6380CABF848D10D9AD97F104621286063DFD86D423974F07A875E65E3BD838A73ED2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2844-0-0x00007FFAE0BAF000-0x00007FFAE0BB0000-memory.dmp

Download

memory/2844-62-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/2844-71-0x000000001AB00000-0x000000001AB7A000-memory.dmp

Download

memory/2844-70-0x000000001E900000-0x000000001EAC2000-memory.dmp

Download

memory/2844-69-0x000000001AA50000-0x000000001AA5A000-memory.dmp

Download

memory/2844-68-0x000000001E3D0000-0x000000001E536000-memory.dmp

Download

memory/2844-67-0x0000000000DA0000-0x0000000000DA8000-memory.dmp

Download

memory/2844-74-0x000000001EBD0000-0x000000001F046000-memory.dmp

Download

memory/2844-66-0x000000001AA70000-0x000000001AAE6000-memory.dmp

Download

memory/2844-65-0x0000000027730000-0x0000000028262000-memory.dmp

Download

memory/2844-64-0x00000000268D0000-0x0000000027734000-memory.dmp

Download

memory/2844-72-0x000000001AA60000-0x000000001AA66000-memory.dmp

Download

memory/2844-61-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/2844-60-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/2844-59-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/2844-58-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/2844-57-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/2844-55-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/2844-4-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/2844-3-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/2844-2-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/2844-1-0x00000000004B0000-0x00000000004C6000-memory.dmp

Download

memory/4852-16-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/4852-31-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/4852-29-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/4852-28-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/4852-27-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/4852-26-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/4852-25-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/4852-24-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/4852-23-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/4852-22-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/4852-21-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/4852-20-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/4852-19-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/4852-18-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/4852-17-0x000001BB75870000-0x000001BB7587A000-memory.dmp

Download

memory/4852-14-0x000001BB757B0000-0x000001BB75862000-memory.dmp

Download

memory/4852-15-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/4852-13-0x000001BB75790000-0x000001BB757AE000-memory.dmp

Download

memory/4852-10-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/4852-9-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/4852-8-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp

Download

memory/4852-5-0x000001BB74F40000-0x000001BB74F62000-memory.dmp

Download