xworm | e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 03:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe
Size 2.1MB
Sample260722-dwxjgsvthy
SHA256 e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7
MD5 24f1c6fbb6cd28d53117bfbef3e9ec08
SHA1 056db76657f3108c8db03a33c59db1fa8ee1cd14
SHA512 ab1594509ddc48b3fe848d29dc4cedaa05eeab0703d98a3a18883ce1e474cb3a73b9427f9411184d82810ae9b6a9d037d15953329a0a7a26ce26561fd751c4d8
SSDEEP 49152:W0ao7zY6iUSzvEHTf1PLudGRSY3yOZ2S+oeATrfK:WqeY3yOZ2S+oeATrfK
TLSH
T1D2A5AE19E3D812A8E167DA74CB51A332D6B178534771E19F0A99D70A2F73E908F3B312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

203.202.232.132:2828

Mutex

XUhZctuZtD9oWuI7

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3336-1-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Executes dropped EXE 2 IoCs

pid	Process
2948	e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe
3204	jsc.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppData = "cmd /c start \"\" /D \"C:\\ProgramData\\AppData\" e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe"	e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1856 set thread context of 3336	1856	e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe	90
PID 2948 set thread context of 1184	2948	e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3336	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3336	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe
3204	jsc.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe
Token: SeDebugPrivilege	2948	e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe
Token: SeDebugPrivilege	3336	jsc.exe
Token: SeDebugPrivilege	1184	jsc.exe
Token: SeDebugPrivilege	3204	jsc.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 3336	1856	e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe	90
PID 1856 wrote to memory of 3336	1856	e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe	90
PID 1856 wrote to memory of 3336	1856	e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe	90
PID 1856 wrote to memory of 3336	1856	e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe	90
PID 1856 wrote to memory of 3336	1856	e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe	90
PID 720 wrote to memory of 2948	720	cmd.exe	93
PID 2948 wrote to memory of 1184	2948	e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe	94
PID 2948 wrote to memory of 1184	2948	e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe	94
PID 2948 wrote to memory of 1184	2948	e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe	94
PID 2948 wrote to memory of 1184	2948	e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe	94
PID 2948 wrote to memory of 1184	2948	e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe	94
PID 3336 wrote to memory of 4776	3336	jsc.exe	95
PID 4776 wrote to memory of 6112	4776	csc.exe	97
PID 3336 wrote to memory of 3204	3336	jsc.exe	98

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

C:\Users\Admin\AppData\Local\Temp\e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe
"C:\Users\Admin\AppData\Local\Temp\e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:3336
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\jsc.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_2829b9f2e4954995a47122ca9bf75162.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES79E9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC680A1F3733948F29FF2C25CC4F03FB.TMP"
      4⤵
      PID:6112
- - C:\Users\Admin\AppData\Local\Temp\jsc.exe
    "C:\Users\Admin\AppData\Local\Temp\jsc.exe" 3336
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3204

C:\Windows\system32\cmd.exe
"cmd /c start "" /D "C:\ProgramData\AppData" e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:720
- C:\ProgramData\AppData\e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe
  "C:\ProgramData\AppData\e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe

Path C:\ProgramData\AppData\e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7.exe
Size 2.1MB
SHA256 e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7
MD5 24f1c6fbb6cd28d53117bfbef3e9ec08
SHA1 056db76657f3108c8db03a33c59db1fa8ee1cd14
SHA512 ab1594509ddc48b3fe848d29dc4cedaa05eeab0703d98a3a18883ce1e474cb3a73b9427f9411184d82810ae9b6a9d037d15953329a0a7a26ce26561fd751c4d8
SSDEEP 49152:W0ao7zY6iUSzvEHTf1PLudGRSY3yOZ2S+oeATrfK:WqeY3yOZ2S+oeATrfK
TLSH
T1D2A5AE19E3D812A8E167DA74CB51A332D6B178534771E19F0A99D70A2F73E908F3B312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES79E9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES79E9.tmp
Size 1KB
SHA256 1a6232e7ebfb1c3e25baf9a2c5bf6441aa545e42fa36f2a0a971fa569e2cd916
MD5 91a68741126414d4958a2c2d2aa3e2a1
SHA1 a397e70686e15028644a0d68f5c0de1def8be937
SHA512 64173bcc4af6eb924f7c0c3835771bc73b225c089f582b0ceaed7bdbcfc0a7569aa9c753acbc58ff8dcb689d07853dac97c2e6ac16b47018bb955459ccbf54f4
TLSH
T15241534093D88B1FF173473168F7932AA678BD51AF9A575DB584122F1E02740DDC32B1
MD5 SHA1 SHA512 TLSH

Submit Download

jsc.exe

Path C:\Users\Admin\AppData\Local\Temp\jsc.exe
Size 5KB
SHA256 f90a566bba162af0b5f6d1bcaa62976255cf91699999e1a16f890bb004cbcb1f
MD5 1d0f46ca1445a149620bcc242b48bf4d
SHA1 3708a9e33e5d3cc2bd2613379269a3ff6876e005
SHA512 dfaeb261308f4ea118dc397bf2be73e48ac6cd3e6c9ec73b5dc4cdb01cdd32b5c96bd2d186b45894b95a1f8d79f7f4130a111a6e1252b16f90985926ce845a90
SSDEEP 96:zdew7V9c5p3Cdck8BynqgHlNxPvE8Ra7M1ayFuzNt:zvScoyqgHj+8U7Mno
TLSH
T149C1D84797CC43AAE4660734B8B303522B74D8124BABAB9F29E4133F6EB539018537F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC680A1F3733948F29FF2C25CC4F03FB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC680A1F3733948F29FF2C25CC4F03FB.TMP
Size 1KB
SHA256 97d5b2464371cc9a0712dd5dcb1b83940b3c9e3bbe505e5a068f4126def9b567
MD5 989d1f618c8d6fa47385bb96fd7852f6
SHA1 9fdc9f62ad54d80d3c31523e9d126c0646d93a2e
SHA512 e70ef3f3fef6fad9f7a3fe8a5bc0cd2413716eb6ac8effe96640236c47f14ca28c9641929935ef63c06f370adc787807dcff40712ec9dbbaf15af49822362b9b
TLSH
T15A21CE81A3E8421EF2B34B7079F2C363956DBE668DBA47EC34C8175F1F15A1085936B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_2829b9f2e4954995a47122ca9bf75162.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_2829b9f2e4954995a47122ca9bf75162.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3204-25-0x0000000000E60000-0x0000000000E68000-memory.dmp

Download

memory/3336-7-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/3336-10-0x00000000078F0000-0x0000000007EAA000-memory.dmp

Download

memory/3336-11-0x00000000748A2000-0x00000000748A3000-memory.dmp

Download

memory/3336-12-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/3336-13-0x0000000007330000-0x00000000073AC000-memory.dmp

Download

memory/3336-14-0x00000000073B0000-0x00000000073B8000-memory.dmp

Download

memory/3336-9-0x0000000007290000-0x0000000007322000-memory.dmp

Download

memory/3336-8-0x0000000005F80000-0x0000000005FE6000-memory.dmp

Download

memory/3336-1-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3336-3-0x00000000058B0000-0x000000000594C000-memory.dmp

Download

memory/3336-2-0x00000000748A2000-0x00000000748A3000-memory.dmp

Download

memory/3336-26-0x00000000084A0000-0x0000000008662000-memory.dmp

Download