xworm | da82d570b5aabbf99226cbc9ee5f8426c1dfc5592c11a97fd777d42c1017b0c6

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XWormClient.exe
Size 107KB
Sample260718-a4pxtsay5p
SHA256 da82d570b5aabbf99226cbc9ee5f8426c1dfc5592c11a97fd777d42c1017b0c6
MD5 0a5495247baa0adece21c2a1f3982ec6
SHA1 c26ba9b02451ee227d6a0f72b5a1d5e300c22ccf
SHA512 b5981b41a9a27795db699a83ff275290908d305005d36f6cac729228d0cba724762395fc1b0348326afdb38fcdd02df4a6a5cf7edcdd9b7fcf147ca675600031
SSDEEP 3072:1jU//fPBIrk+9jHT1rDvjYnsSbXPUVT9:VU//fPmBHT1nUsSbX6
TLSH
T101B33A4DB7458E54C52C5FBB8F33494C02E9E4A771A7FBAB55D89DE19C238C88A4B8C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm persistence rat trojan

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4384-1-0x0000000000980000-0x00000000009A2000-memory.dmp	family_xworm
behavioral2/files/0x001b00000001c352-58.dat	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5128	powershell.exe
2928	powershell.exe
6052	powershell.exe
1508	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\test.lnk	XWormClient.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\test.lnk	XWormClient.exe

Executes dropped EXE 3 IoCs

pid	Process
3404	test.exe
3064	test.exe
3960	test.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\test = "C:\\Users\\Admin\\AppData\\Roaming\\test.exe"	XWormClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3280	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4384	XWormClient.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
5128	powershell.exe
5128	powershell.exe
2928	powershell.exe
2928	powershell.exe
6052	powershell.exe
6052	powershell.exe
1508	powershell.exe
1508	powershell.exe
4384	XWormClient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4384	XWormClient.exe
Token: SeDebugPrivilege	5128	powershell.exe
Token: SeIncreaseQuotaPrivilege	5128	powershell.exe
Token: SeSecurityPrivilege	5128	powershell.exe
Token: SeTakeOwnershipPrivilege	5128	powershell.exe
Token: SeLoadDriverPrivilege	5128	powershell.exe
Token: SeSystemProfilePrivilege	5128	powershell.exe
Token: SeSystemtimePrivilege	5128	powershell.exe
Token: SeProfSingleProcessPrivilege	5128	powershell.exe
Token: SeIncBasePriorityPrivilege	5128	powershell.exe
Token: SeCreatePagefilePrivilege	5128	powershell.exe
Token: SeBackupPrivilege	5128	powershell.exe
Token: SeRestorePrivilege	5128	powershell.exe
Token: SeShutdownPrivilege	5128	powershell.exe
Token: SeDebugPrivilege	5128	powershell.exe
Token: SeSystemEnvironmentPrivilege	5128	powershell.exe
Token: SeRemoteShutdownPrivilege	5128	powershell.exe
Token: SeUndockPrivilege	5128	powershell.exe
Token: SeManageVolumePrivilege	5128	powershell.exe
Token: 33	5128	powershell.exe
Token: 34	5128	powershell.exe
Token: 35	5128	powershell.exe
Token: 36	5128	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeIncreaseQuotaPrivilege	2928	powershell.exe
Token: SeSecurityPrivilege	2928	powershell.exe
Token: SeTakeOwnershipPrivilege	2928	powershell.exe
Token: SeLoadDriverPrivilege	2928	powershell.exe
Token: SeSystemProfilePrivilege	2928	powershell.exe
Token: SeSystemtimePrivilege	2928	powershell.exe
Token: SeProfSingleProcessPrivilege	2928	powershell.exe
Token: SeIncBasePriorityPrivilege	2928	powershell.exe
Token: SeCreatePagefilePrivilege	2928	powershell.exe
Token: SeBackupPrivilege	2928	powershell.exe
Token: SeRestorePrivilege	2928	powershell.exe
Token: SeShutdownPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeSystemEnvironmentPrivilege	2928	powershell.exe
Token: SeRemoteShutdownPrivilege	2928	powershell.exe
Token: SeUndockPrivilege	2928	powershell.exe
Token: SeManageVolumePrivilege	2928	powershell.exe
Token: 33	2928	powershell.exe
Token: 34	2928	powershell.exe
Token: 35	2928	powershell.exe
Token: 36	2928	powershell.exe
Token: SeDebugPrivilege	6052	powershell.exe
Token: SeIncreaseQuotaPrivilege	6052	powershell.exe
Token: SeSecurityPrivilege	6052	powershell.exe
Token: SeTakeOwnershipPrivilege	6052	powershell.exe
Token: SeLoadDriverPrivilege	6052	powershell.exe
Token: SeSystemProfilePrivilege	6052	powershell.exe
Token: SeSystemtimePrivilege	6052	powershell.exe
Token: SeProfSingleProcessPrivilege	6052	powershell.exe
Token: SeIncBasePriorityPrivilege	6052	powershell.exe
Token: SeCreatePagefilePrivilege	6052	powershell.exe
Token: SeBackupPrivilege	6052	powershell.exe
Token: SeRestorePrivilege	6052	powershell.exe
Token: SeShutdownPrivilege	6052	powershell.exe
Token: SeDebugPrivilege	6052	powershell.exe
Token: SeSystemEnvironmentPrivilege	6052	powershell.exe
Token: SeRemoteShutdownPrivilege	6052	powershell.exe
Token: SeUndockPrivilege	6052	powershell.exe
Token: SeManageVolumePrivilege	6052	powershell.exe
Token: 33	6052	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4384	XWormClient.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 5128	4384	XWormClient.exe	89
PID 4384 wrote to memory of 2928	4384	XWormClient.exe	92
PID 4384 wrote to memory of 6052	4384	XWormClient.exe	94
PID 4384 wrote to memory of 1508	4384	XWormClient.exe	96
PID 4384 wrote to memory of 3280	4384	XWormClient.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XWormClient.exe
"C:\Users\Admin\AppData\Local\Temp\XWormClient.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWormClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\test.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'test.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1508
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "test" /tr "C:\Users\Admin\AppData\Roaming\test.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3280

C:\Users\Admin\AppData\Roaming\test.exe
C:\Users\Admin\AppData\Roaming\test.exe
1⤵
- Executes dropped EXE
PID:3404

C:\Users\Admin\AppData\Roaming\test.exe
"C:\Users\Admin\AppData\Roaming\test.exe"
1⤵
- Executes dropped EXE
PID:3064

C:\Users\Admin\AppData\Roaming\test.exe
"C:\Users\Admin\AppData\Roaming\test.exe"
1⤵
- Executes dropped EXE
PID:3960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 97c052f969f8ec409cf9ca88f96511805dc8b3d7f26c3fc928d8af9d8c36376f
MD5 533b4f1d6cac3dce4e14376943e4dd15
SHA1 a22254b2bc581c5379732cb07e51488328d314f0
SHA512 f0f126ebf341c3c66ca4e1e1df9f07c7ce79fa1a5ffae7dedf4026d78ac26874fe42ec24a6551ac4377bcc87557a0114cbed2124ead4fc39a95f89f45e6a574f
TLSH
T1BE216833F3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 74157addc9814e17df355b4c639b7ec8a109f3b9c4485f8d11fb7f2c86f2d8d5
MD5 788581388f967ab82f499fbe977d6a36
SHA1 3fc78a7d3c2ced4654e3ae36ec12adc1874e1f3c
SHA512 d805b1ac29f622994a9db2fc709fcf3cc183fdbfd0072d96b7f2f519c0fb85a3ffa7c08da81474e71166eef73b953b69b30bf981554666fa3ed750b8b245541c
TLSH
T1C5216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6a975b38f17817ab555c8476296140477b5616761da3cbdbb69b2f6ad8e7c961
MD5 0b8014dc154b5d0ec8adcc4203db0a9a
SHA1 37db81da158f471f145564e044750bed09037abc
SHA512 da4e9a72f40eaaf5dad2755dd0bc3126059b6a3d55907cb631e86ea9e35fbef9b72b287978e6901e01b1096cedafa2da99f96777e43e4621cb2e193c404f508b
TLSH
T19C219833B3CC8614C89A013A10CDAC0036B6CBCB40DECF5B7B80E655A43F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_alxrkoew.xht.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_alxrkoew.xht.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

test.exe

Path C:\Users\Admin\AppData\Roaming\test.exe
Size 107KB
SHA256 da82d570b5aabbf99226cbc9ee5f8426c1dfc5592c11a97fd777d42c1017b0c6
MD5 0a5495247baa0adece21c2a1f3982ec6
SHA1 c26ba9b02451ee227d6a0f72b5a1d5e300c22ccf
SHA512 b5981b41a9a27795db699a83ff275290908d305005d36f6cac729228d0cba724762395fc1b0348326afdb38fcdd02df4a6a5cf7edcdd9b7fcf147ca675600031
SSDEEP 3072:1jU//fPBIrk+9jHT1rDvjYnsSbXPUVT9:VU//fPmBHT1nUsSbX6
TLSH
T101B33A4DB7458E54C52C5FBB8F33494C02E9E4A771A7FBAB55D89DE19C238C88A4B8C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4384-0-0x00007FFE9AF1F000-0x00007FFE9AF20000-memory.dmp

Download

memory/4384-59-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4384-9-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4384-62-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4384-61-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4384-5-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4384-60-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4384-63-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4384-4-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4384-56-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4384-55-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4384-54-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4384-3-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4384-2-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4384-1-0x0000000000980000-0x00000000009A2000-memory.dmp

Download

memory/5128-12-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/5128-25-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/5128-26-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/5128-27-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/5128-28-0x000001DDF5AC0000-0x000001DDF5ACA000-memory.dmp

Download

memory/5128-29-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/5128-31-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/5128-24-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/5128-19-0x000001DDF5AA0000-0x000001DDF5ABE000-memory.dmp

Download

memory/5128-23-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/5128-22-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/5128-20-0x000001DDF5ED0000-0x000001DDF5F82000-memory.dmp

Download

memory/5128-21-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/5128-16-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/5128-15-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/5128-14-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/5128-13-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/5128-11-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/5128-10-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/5128-8-0x000001DDF5A40000-0x000001DDF5A62000-memory.dmp

Download