xworm | e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe
Size 879KB
Sample260720-fx27gafv3j
SHA256 e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9
MD5 d8ffb090209a46f881579eae9d88fb47
SHA1 88ec3a1f4e7e187fd374f7a22f453e5b26227061
SHA512 bf47d25f51a6bbec5e925842ca816a51740f5ad06f5f3ce2814af6f63e363bca0d81c7d5c90303f23154cb9a6111e2d4bcd8eb1f6fa28a7a7310f154019b30df
SSDEEP 24576:3saLBU5wp8kow6eJACymHNW5GO+yJTzZ5:8alU5+ow6eJHyAWT+ypV5
TLSH
T1A415DFD43A26E70ACD620A30AA35DEB556B40EACF401BAE39FDD3F5B74AD1505D0CB80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

31.56.209.14:8200

Mutex

hycXl3rsZdov9699

Attributes

Install_directory
%AppData%
install_file
windows.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2464-14-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5448	powershell.exe
5584	powershell.exe
3560	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.lnk	e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.lnk	e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe

Executes dropped EXE 4 IoCs

pid	Process
1692	xIXRwcfYNITwrj.exe
5284	xIXRwcfYNITwrj.exe
5044	xIXRwcfYNITwrj.exe
4248	xIXRwcfYNITwrj.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\xIXRwcfYNITwrj = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\lh1uwzh1gqa.ps1\""	e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 924 set thread context of 2464	924	e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe	91
PID 1692 set thread context of 4248	1692	xIXRwcfYNITwrj.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xIXRwcfYNITwrj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xIXRwcfYNITwrj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
924	e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe
924	e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe
5448	powershell.exe
5448	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
1692	xIXRwcfYNITwrj.exe
1692	xIXRwcfYNITwrj.exe
1692	xIXRwcfYNITwrj.exe
1692	xIXRwcfYNITwrj.exe
1692	xIXRwcfYNITwrj.exe
1692	xIXRwcfYNITwrj.exe
5584	powershell.exe
5584	powershell.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	924	e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe
Token: SeDebugPrivilege	2464	e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe
Token: SeDebugPrivilege	5448	powershell.exe
Token: SeDebugPrivilege	3560	powershell.exe
Token: SeIncreaseQuotaPrivilege	5448	powershell.exe
Token: SeSecurityPrivilege	5448	powershell.exe
Token: SeTakeOwnershipPrivilege	5448	powershell.exe
Token: SeLoadDriverPrivilege	5448	powershell.exe
Token: SeSystemProfilePrivilege	5448	powershell.exe
Token: SeSystemtimePrivilege	5448	powershell.exe
Token: SeProfSingleProcessPrivilege	5448	powershell.exe
Token: SeIncBasePriorityPrivilege	5448	powershell.exe
Token: SeCreatePagefilePrivilege	5448	powershell.exe
Token: SeBackupPrivilege	5448	powershell.exe
Token: SeRestorePrivilege	5448	powershell.exe
Token: SeShutdownPrivilege	5448	powershell.exe
Token: SeDebugPrivilege	5448	powershell.exe
Token: SeSystemEnvironmentPrivilege	5448	powershell.exe
Token: SeRemoteShutdownPrivilege	5448	powershell.exe
Token: SeUndockPrivilege	5448	powershell.exe
Token: SeManageVolumePrivilege	5448	powershell.exe
Token: 33	5448	powershell.exe
Token: 34	5448	powershell.exe
Token: 35	5448	powershell.exe
Token: 36	5448	powershell.exe
Token: SeDebugPrivilege	1692	xIXRwcfYNITwrj.exe
Token: SeDebugPrivilege	4248	xIXRwcfYNITwrj.exe
Token: SeDebugPrivilege	5584	powershell.exe
Token: SeIncreaseQuotaPrivilege	5584	powershell.exe
Token: SeSecurityPrivilege	5584	powershell.exe
Token: SeTakeOwnershipPrivilege	5584	powershell.exe
Token: SeLoadDriverPrivilege	5584	powershell.exe
Token: SeSystemProfilePrivilege	5584	powershell.exe
Token: SeSystemtimePrivilege	5584	powershell.exe
Token: SeProfSingleProcessPrivilege	5584	powershell.exe
Token: SeIncBasePriorityPrivilege	5584	powershell.exe
Token: SeCreatePagefilePrivilege	5584	powershell.exe
Token: SeBackupPrivilege	5584	powershell.exe
Token: SeRestorePrivilege	5584	powershell.exe
Token: SeShutdownPrivilege	5584	powershell.exe
Token: SeDebugPrivilege	5584	powershell.exe
Token: SeSystemEnvironmentPrivilege	5584	powershell.exe
Token: SeRemoteShutdownPrivilege	5584	powershell.exe
Token: SeUndockPrivilege	5584	powershell.exe
Token: SeManageVolumePrivilege	5584	powershell.exe
Token: 33	5584	powershell.exe
Token: 34	5584	powershell.exe
Token: 35	5584	powershell.exe
Token: 36	5584	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 5448	924	e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe	89
PID 924 wrote to memory of 2464	924	e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe	91
PID 924 wrote to memory of 2464	924	e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe	91
PID 924 wrote to memory of 2464	924	e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe	91
PID 924 wrote to memory of 2464	924	e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe	91
PID 924 wrote to memory of 2464	924	e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe	91
PID 3560 wrote to memory of 1692	3560	powershell.exe	94
PID 1692 wrote to memory of 5584	1692	xIXRwcfYNITwrj.exe	97
PID 1692 wrote to memory of 5284	1692	xIXRwcfYNITwrj.exe	99
PID 1692 wrote to memory of 5044	1692	xIXRwcfYNITwrj.exe	100
PID 1692 wrote to memory of 4248	1692	xIXRwcfYNITwrj.exe	101
PID 1692 wrote to memory of 4248	1692	xIXRwcfYNITwrj.exe	101
PID 1692 wrote to memory of 4248	1692	xIXRwcfYNITwrj.exe	101
PID 1692 wrote to memory of 4248	1692	xIXRwcfYNITwrj.exe	101
PID 1692 wrote to memory of 4248	1692	xIXRwcfYNITwrj.exe	101

C:\Users\Admin\AppData\Local\Temp\e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe
"C:\Users\Admin\AppData\Local\Temp\e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5448
- C:\Users\Admin\AppData\Local\Temp\e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe
  "C:\Users\Admin\AppData\Local\Temp\e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2464

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\lh1uwzh1gqa.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Users\Admin\AppData\Roaming\xIXRwcfYNITwrj.exe
  "C:\Users\Admin\AppData\Roaming\xIXRwcfYNITwrj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xIXRwcfYNITwrj.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5584
- - C:\Users\Admin\AppData\Roaming\xIXRwcfYNITwrj.exe
    "C:\Users\Admin\AppData\Roaming\xIXRwcfYNITwrj.exe"
    3⤵
    - Executes dropped EXE
    PID:5284
- - C:\Users\Admin\AppData\Roaming\xIXRwcfYNITwrj.exe
    "C:\Users\Admin\AppData\Roaming\xIXRwcfYNITwrj.exe"
    3⤵
    - Executes dropped EXE
    PID:5044
- - C:\Users\Admin\AppData\Roaming\xIXRwcfYNITwrj.exe
    "C:\Users\Admin\AppData\Roaming\xIXRwcfYNITwrj.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 3c38e90c55e1285e1f0cf41a7071214b77c166ab2b26c3fd58ca12e29d56a9d1
MD5 0953dc9db4c1d12fcd854f5d5746bcee
SHA1 167da6020a159eb9dfeea98d100028e6b3374eb0
SHA512 467d63b17156cc5fc63fe93aecac04cad026a49dd0f2adc92adc62e255ec632e19643e49734bda6d05d1e0f733169786c514459ca91c88d5cc212ab91b1c9679
SSDEEP 384:v1eBaoT1iBGCGW14bPIO0/+gGeCaS2Pn5IAXr4B+dWoVIzKwMvYbhNaPElRtrZR2:texZ6GZWiMOW+SDRIAXrq+tojbhNaPsA
TLSH
T105A2B578213F6DC7D8D226B410D10AE7FBE4D489DAB611D4BF2BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_jqe25or4.zzu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jqe25or4.zzu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

lh1uwzh1gqa.ps1

Path C:\Users\Admin\AppData\Local\Temp\lh1uwzh1gqa.ps1
Size 1KB
SHA256 4ca3aeac1ee87a0be51587c329cf3ec802bddcc7529989cfe4b59c34695ba36f
MD5 42c5e06e47b32bff79338ac057c4d4e5
SHA1 f7b4ccf6dd32f18e715acf657a72d9886c07ba03
SHA512 5722fa8a1f5a1f84e97af199f3bd0f1e9a309bdc12c004d1964e162475951ce175db7c03cfd73ec0de493a022b088897880125229dde3b67705affcc933f33cf
TLSH
T13921BB868E4613C541A84BF14A1338CD746E60CF5BAF018055EDB0EEB32BD273469CA4
MD5 SHA1 SHA512 TLSH

Submit Download

xIXRwcfYNITwrj.exe

Path C:\Users\Admin\AppData\Roaming\xIXRwcfYNITwrj.exe
Size 879KB
SHA256 e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9
MD5 d8ffb090209a46f881579eae9d88fb47
SHA1 88ec3a1f4e7e187fd374f7a22f453e5b26227061
SHA512 bf47d25f51a6bbec5e925842ca816a51740f5ad06f5f3ce2814af6f63e363bca0d81c7d5c90303f23154cb9a6111e2d4bcd8eb1f6fa28a7a7310f154019b30df
SSDEEP 24576:3saLBU5wp8kow6eJACymHNW5GO+yJTzZ5:8alU5+ow6eJHyAWT+ypV5
TLSH
T1A415DFD43A26E70ACD620A30AA35DEB556B40EACF401BAE39FDD3F5B74AD1505D0CB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/924-5-0x0000000005360000-0x00000000053FC000-memory.dmp

Download

memory/924-2-0x0000000005740000-0x0000000005CFA000-memory.dmp

Download

memory/924-6-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/924-7-0x0000000005400000-0x000000000541E000-memory.dmp

Download

memory/924-8-0x0000000074682000-0x0000000074683000-memory.dmp

Download

memory/924-9-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/924-10-0x0000000007BE0000-0x0000000007C82000-memory.dmp

Download

memory/924-0-0x0000000074682000-0x0000000074683000-memory.dmp

Download

memory/924-1-0x00000000005D0000-0x00000000006B2000-memory.dmp

Download

memory/924-24-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/924-4-0x00000000051E0000-0x00000000051EA000-memory.dmp

Download

memory/924-3-0x0000000005220000-0x00000000052B2000-memory.dmp

Download

memory/2464-38-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/2464-14-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2464-20-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/2464-52-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/3560-30-0x00000186FBE50000-0x00000186FBE72000-memory.dmp

Download

memory/5448-12-0x0000000002A70000-0x0000000002AA6000-memory.dmp

Download

memory/5448-17-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/5448-26-0x00000000062A0000-0x00000000062BE000-memory.dmp

Download

memory/5448-27-0x00000000062F0000-0x000000000633C000-memory.dmp

Download

memory/5448-18-0x0000000005C40000-0x0000000005C62000-memory.dmp

Download

memory/5448-19-0x0000000005CE0000-0x0000000005D46000-memory.dmp

Download

memory/5448-21-0x0000000005D50000-0x0000000005DB6000-memory.dmp

Download

memory/5448-16-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/5448-39-0x0000000007450000-0x0000000007486000-memory.dmp

Download

memory/5448-43-0x0000000007490000-0x00000000074B0000-memory.dmp

Download

memory/5448-44-0x00000000074E0000-0x0000000007583000-memory.dmp

Download

memory/5448-25-0x0000000005DC0000-0x000000000611B000-memory.dmp

Download

memory/5448-40-0x0000000074F30000-0x0000000074F7C000-memory.dmp

Download

memory/5448-46-0x0000000007620000-0x000000000763A000-memory.dmp

Download

memory/5448-45-0x0000000007C60000-0x00000000082DC000-memory.dmp

Download

memory/5448-47-0x0000000007690000-0x000000000769A000-memory.dmp

Download

memory/5448-48-0x0000000007890000-0x0000000007926000-memory.dmp

Download

memory/5448-15-0x00000000055F0000-0x0000000005C3A000-memory.dmp

Download

memory/5448-51-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/5448-13-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/5584-59-0x0000000006020000-0x000000000637B000-memory.dmp

Download

memory/5584-61-0x0000000006850000-0x000000000689C000-memory.dmp

Download

memory/5584-62-0x0000000070780000-0x00000000707CC000-memory.dmp

Download