xworm | 8e35ecb913c6fcde475d68a726ce847c179d855d56a914efc460b5a4134b186b

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order invoice.xlsm
Size 354KB
Sample260723-pc3f6swtey
SHA256 8e35ecb913c6fcde475d68a726ce847c179d855d56a914efc460b5a4134b186b
MD5 2bfc63abb7f0ab256c0477d643c9ada8
SHA1 daad0b6e711cc480410490493291249ce055947e
SHA512 e7125393ec610e998f0e91d2ea7c71edf985a2aecf5828ef55ea6e716494a672dbe9ae751348b535a5386e388107bac8a58fb2f7d70a78cffc067e283c3ef62a
SSDEEP 6144:50sJxyX1jZAgcyUUFYxT2mw7aXMx3L8fuyiUAsptUwDKDqYEBdFV37Tnl:50sJx0gyfYpdAx78riUAspKeKeYEVZTl
TLSH
T1DA7422A03E278F4BC64DDA35EB8CB18848857CDAE282137EB5F18F235D459E07E14597
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

oman101.duckdns.org:4545

Mutex

pe7B8RV9EP0Gtp98

Attributes

Install_directory
%AppData%
install_file
XWormClient.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5288-72-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1920	4128	wscript.exe	88

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
564	powershell.exe
1180	powershell.exe
5548	powershell.exe
2412	powershell.exe
2580	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	aspnet_compiler.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	aspnet_compiler.exe

Executes dropped EXE 3 IoCs

pid	Process
824	XWormClient.exe
4124	XWormClient.exe
1780	XWormClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\XWormClient = "C:\\Users\\Admin\\AppData\\Roaming\\XWormClient.exe"	aspnet_compiler.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 564 set thread context of 5288	564	powershell.exe	98

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
6036	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1640	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4128	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
1180	powershell.exe
1180	powershell.exe
1180	powershell.exe
564	powershell.exe
5548	powershell.exe
5548	powershell.exe
5548	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
564	powershell.exe
2580	powershell.exe
2580	powershell.exe
2580	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	564	powershell.exe
Token: SeDebugPrivilege	5288	aspnet_compiler.exe
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeIncreaseQuotaPrivilege	1180	powershell.exe
Token: SeSecurityPrivilege	1180	powershell.exe
Token: SeTakeOwnershipPrivilege	1180	powershell.exe
Token: SeLoadDriverPrivilege	1180	powershell.exe
Token: SeSystemProfilePrivilege	1180	powershell.exe
Token: SeSystemtimePrivilege	1180	powershell.exe
Token: SeProfSingleProcessPrivilege	1180	powershell.exe
Token: SeIncBasePriorityPrivilege	1180	powershell.exe
Token: SeCreatePagefilePrivilege	1180	powershell.exe
Token: SeBackupPrivilege	1180	powershell.exe
Token: SeRestorePrivilege	1180	powershell.exe
Token: SeShutdownPrivilege	1180	powershell.exe
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeSystemEnvironmentPrivilege	1180	powershell.exe
Token: SeRemoteShutdownPrivilege	1180	powershell.exe
Token: SeUndockPrivilege	1180	powershell.exe
Token: SeManageVolumePrivilege	1180	powershell.exe
Token: 33	1180	powershell.exe
Token: 34	1180	powershell.exe
Token: 35	1180	powershell.exe
Token: 36	1180	powershell.exe
Token: SeDebugPrivilege	5548	powershell.exe
Token: SeIncreaseQuotaPrivilege	5548	powershell.exe
Token: SeSecurityPrivilege	5548	powershell.exe
Token: SeTakeOwnershipPrivilege	5548	powershell.exe
Token: SeLoadDriverPrivilege	5548	powershell.exe
Token: SeSystemProfilePrivilege	5548	powershell.exe
Token: SeSystemtimePrivilege	5548	powershell.exe
Token: SeProfSingleProcessPrivilege	5548	powershell.exe
Token: SeIncBasePriorityPrivilege	5548	powershell.exe
Token: SeCreatePagefilePrivilege	5548	powershell.exe
Token: SeBackupPrivilege	5548	powershell.exe
Token: SeRestorePrivilege	5548	powershell.exe
Token: SeShutdownPrivilege	5548	powershell.exe
Token: SeDebugPrivilege	5548	powershell.exe
Token: SeSystemEnvironmentPrivilege	5548	powershell.exe
Token: SeRemoteShutdownPrivilege	5548	powershell.exe
Token: SeUndockPrivilege	5548	powershell.exe
Token: SeManageVolumePrivilege	5548	powershell.exe
Token: 33	5548	powershell.exe
Token: 34	5548	powershell.exe
Token: 35	5548	powershell.exe
Token: 36	5548	powershell.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeIncreaseQuotaPrivilege	2412	powershell.exe
Token: SeSecurityPrivilege	2412	powershell.exe
Token: SeTakeOwnershipPrivilege	2412	powershell.exe
Token: SeLoadDriverPrivilege	2412	powershell.exe
Token: SeSystemProfilePrivilege	2412	powershell.exe
Token: SeSystemtimePrivilege	2412	powershell.exe
Token: SeProfSingleProcessPrivilege	2412	powershell.exe
Token: SeIncBasePriorityPrivilege	2412	powershell.exe
Token: SeCreatePagefilePrivilege	2412	powershell.exe
Token: SeBackupPrivilege	2412	powershell.exe
Token: SeRestorePrivilege	2412	powershell.exe
Token: SeShutdownPrivilege	2412	powershell.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeSystemEnvironmentPrivilege	2412	powershell.exe
Token: SeRemoteShutdownPrivilege	2412	powershell.exe
Token: SeUndockPrivilege	2412	powershell.exe
Token: SeManageVolumePrivilege	2412	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4128	EXCEL.EXE
4128	EXCEL.EXE

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE
4128	EXCEL.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 1920	4128	EXCEL.EXE	90
PID 1920 wrote to memory of 564	1920	wscript.exe	91
PID 564 wrote to memory of 3596	564	powershell.exe	93
PID 564 wrote to memory of 5616	564	powershell.exe	94
PID 564 wrote to memory of 4780	564	powershell.exe	95
PID 564 wrote to memory of 5744	564	powershell.exe	96
PID 564 wrote to memory of 5372	564	powershell.exe	97
PID 564 wrote to memory of 5288	564	powershell.exe	98
PID 564 wrote to memory of 5288	564	powershell.exe	98
PID 564 wrote to memory of 5288	564	powershell.exe	98
PID 564 wrote to memory of 5288	564	powershell.exe	98
PID 564 wrote to memory of 5288	564	powershell.exe	98
PID 5288 wrote to memory of 1180	5288	aspnet_compiler.exe	99
PID 5288 wrote to memory of 5548	5288	aspnet_compiler.exe	102
PID 5288 wrote to memory of 2412	5288	aspnet_compiler.exe	104
PID 5288 wrote to memory of 2580	5288	aspnet_compiler.exe	106
PID 5288 wrote to memory of 1640	5288	aspnet_compiler.exe	108
PID 1920 wrote to memory of 6036	1920	wscript.exe	115

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Order invoice.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\QPwnrJHmuj.js"
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\ps_oN3NaHZyLAyk_1784808736839.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:564
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:3596
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:5616
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:4780
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:5744
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:5372
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      Drops startup file
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5288
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1180
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'aspnet_compiler.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5548
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XWormClient.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2412
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormClient.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2580
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XWormClient" /tr "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1640
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im wscript.exe
    3⤵
    - Kills process with taskkill
    PID:6036

C:\Users\Admin\AppData\Roaming\XWormClient.exe
C:\Users\Admin\AppData\Roaming\XWormClient.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:824

C:\Users\Admin\AppData\Roaming\XWormClient.exe
"C:\Users\Admin\AppData\Roaming\XWormClient.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4124

C:\Users\Admin\AppData\Roaming\XWormClient.exe
"C:\Users\Admin\AppData\Roaming\XWormClient.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ps_oN3NaHZyLAyk_1784808736839.ps1

Path C:\Temp\ps_oN3NaHZyLAyk_1784808736839.ps1
Size 290KB
SHA256 2c693155cda1a63715b4aa59a7b7de66adf1b224ee1b95c0f3aaa20a66ba6084
MD5 6e57b87c40e71eda28ff8b82848f0add
SHA1 df98fe43a84a66692e476589135d44d9fc83ce73
SHA512 8cc4da834ba3c61edb9437e67de4c5533ce1d660e701ec4023952afd8dec1e1ffab52ae0555407553e29eabdee1ec85677fdccb0062ce54a37edd7256a3e634b
SSDEEP 6144:Xz7cSprGwm4HF09K/Cd1xR9ThUsdNsVa2MTXuLVjKvn8U+PVP:9ZGwm4l09K/Cd19ThXdNOa2MruLVjKv6
TLSH
T19A54E8FB1FDE31D2506EDF36A13A9E3CE19636F2400BB0593058B1E7A45279BA466C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 901b7c4273ab7e1756b61cd612868e777c3a2a24e5dd2b53fc4583138baf168d
MD5 0099ac1520d7c05597899536d0cdbe06
SHA1 2bce6dd90b169ef7e071eb6f4fc8f2f96c96d3f4
SHA512 2f9e10bff94e8af66e6d96a1d6500663804d92aa2ac8a9d5b5c4756d8af07bad46c209737076058fd81eb86625674d420a216186db928508450ceaddbb20a18e
SSDEEP 384:l1eBaoT1iBGqGW14bOqYqsODtu0oC2VVZIAXz48+xW7utzKwgvYbhNqPIlRtLZRy:PexZ6GxWiTVsO4zhIAXzX+lV/bhNqPQM
TLSH
T1EBA2B478203F6DC7D8D226B010D10AF7FBE4D489DAB651D4BF1BDA2F4C90EBA4A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 cd5a77d89610ae4b1de1486c46ffd70202df3f6cc5a4ed14a7c1c53a0a180333
MD5 2b3aab44a123cde023f1b2a5feae223f
SHA1 cac37be957d2176657bbc2426fa22edb806ac56f
SHA512 d042ac2a800d370497b454ad10c019ec3f684fa4f4a2ff28ed3f9dad11700ecaa3f847fc5e832228e899096f5280e289f7ccaa18c6d53da1e1985ea0e1fd5c75
SSDEEP 384:81eBaoT1iBG4ly7DdF+bN+Te/872PMqzdC0wIACOIZRMBoaqB66KwIv27hieU5hf:4exZ6G4lEDdF+bNtkKU4C0wIAX66BoaF
TLSH
T174A2082D266F89CBD89161B400824342F7F8D559E6E251DBFF1BC92F2C41A7D9E801F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 38bb4657af09da74520209c2f22e240b2f9ee18b480b6ab38b18a9ec86b852ce
MD5 a6fadb82db3d44bc0b7b219d1c265af1
SHA1 e7a61521b088d595d737e0f6ff31799fef17dcd1
SHA512 22074717d288149fe5a71290ed701079cb54d4d0c46c5e0bfb077333c7154273563d6c52c3adf5750f9f10e9f7d059ad0f02cdd3aaadee4cb949770b7143b72c
SSDEEP 384:K1eBaoT1iBGE9blnq5gAgByxrr2PtWOEOiUDzdC0oIAXIbAoaqB3K6Kw8dv27hiJ:aexZ6GC5nq9gA6UN/UFC0oIAXvoaM6eG
TLSH
T1DCA2091D262F48CBD99161B810814786FBF8D195EBE251DBFB4BC92F1C81A7E5E401F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_duuicdiq.fha.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_duuicdiq.fha.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 1KB
SHA256 ee029cdc759dae92f88deadc67117102d15566d2bd496615820c4a9577d8dc2d
MD5 422920a3c2f9f3b370e94d0f338b2b53
SHA1 102204a2126e930622d4c8e9ff6201610b74cf2d
SHA512 ae74dc321eb66f93a21a9ecdfc7332a252309e7712010314b3f7ec3d81653a3f05ec989130c51bda1d8671adff6f4bba3d7f447ccb2e538ff88fbb760f6856db
TLSH
T14B21BE0126CB1B1BD4544AB11B3E471AF3B0BD53BF20971D9608222F6DB15809D4EA67
MD5 SHA1 SHA512 TLSH

Submit Download

QPwnrJHmuj.js

Path C:\Users\Admin\AppData\Roaming\QPwnrJHmuj.js
Size 528KB
SHA256 7fa351e9a0f42046c8cbc7890ef1a792240505f3886104d930979efa80742c9b
MD5 daf344aef0e92a088e3f38df22ec5ab3
SHA1 ac9f617f8dd64fc9c55edc87c90fcf0238be8a9b
SHA512 09c534fb4000f9af31b05c7947420700c1deeb0057c8f77416eda9e97540ab87e3bb0d0898e366f0c3a64418fa273f1c01388ec859359e6993944d211bcee32b
SSDEEP 12288:q1BPs3DLTYybfI78ODQZRByglT9LxqV8tATJvxutLl:uMLYybfI71QZRByglT9LxqV8tATJvxuz
TLSH
T130B43B722B9E35042712778EB44BD9C8CB6ED5220F82E99574EE55848F1E897FCC0C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XWormClient.exe

Path C:\Users\Admin\AppData\Roaming\XWormClient.exe
Size 48KB
SHA256 923c541ce782bf45a3d338487e6f411cd11ab0b98eb9775a2d2065dff39a4f37
MD5 7835ac3587533a4c407164a221390881
SHA1 4494150264b431068cc9d7ced0949f92545277c6
SHA512 b1ecf29f743fe039a8c61f0fd77559a81a100cd060337cee9cc43a0cadd6df0ba7ed7386906d3b1d1ea6d2538bf649af8bcab79ab564a41bac624c0454eeb6c7
SSDEEP 768:pFcAS6TP8ZeM8cKkf85d/50V6Iq85dqf7PzZDeN4EWF//dj9z94:pmAPkfOd/508GODeN4EWZz94
TLSH
T11B23D728A7E81316F6BB47B099F5D083AA76B5436E75C74D388A434D0B237C08953F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/564-70-0x000001F0A0FB0000-0x000001F0A0FB8000-memory.dmp

Download

memory/564-69-0x000001F088B50000-0x000001F088B5C000-memory.dmp

Download

memory/564-67-0x000001F088AE0000-0x000001F088B02000-memory.dmp

Download

memory/824-139-0x0000000000880000-0x0000000000890000-memory.dmp

Download

memory/824-140-0x00000000056A0000-0x0000000005BCC000-memory.dmp

Download

memory/1180-94-0x0000000007640000-0x000000000764A000-memory.dmp

Download

memory/1180-87-0x0000000070870000-0x00000000708BC000-memory.dmp

Download

memory/1180-78-0x0000000005CA0000-0x0000000005D06000-memory.dmp

Download

memory/1180-77-0x0000000005480000-0x00000000054A2000-memory.dmp

Download

memory/1180-95-0x0000000007840000-0x00000000078D6000-memory.dmp

Download

memory/1180-93-0x00000000075D0000-0x00000000075EA000-memory.dmp

Download

memory/1180-92-0x0000000007C10000-0x000000000828C000-memory.dmp

Download

memory/1180-91-0x0000000007490000-0x0000000007533000-memory.dmp

Download

memory/1180-90-0x0000000006850000-0x0000000006870000-memory.dmp

Download

memory/1180-79-0x0000000005D10000-0x0000000005D76000-memory.dmp

Download

memory/1180-86-0x0000000007420000-0x0000000007456000-memory.dmp

Download

memory/1180-85-0x0000000006310000-0x000000000635C000-memory.dmp

Download

memory/1180-84-0x0000000005EF0000-0x0000000005F0E000-memory.dmp

Download

memory/1180-76-0x00000000054E0000-0x0000000005B2A000-memory.dmp

Download

memory/1180-82-0x0000000005F50000-0x00000000062AB000-memory.dmp

Download

memory/1180-75-0x0000000002A30000-0x0000000002A66000-memory.dmp

Download

memory/2412-115-0x0000000070870000-0x00000000708BC000-memory.dmp

Download

memory/2580-123-0x0000000070870000-0x00000000708BC000-memory.dmp

Download

memory/2580-121-0x0000000005930000-0x0000000005C8B000-memory.dmp

Download

memory/4128-83-0x00007FFFA7880000-0x00007FFFA7AE3000-memory.dmp

Download

memory/4128-55-0x00007FFFA7880000-0x00007FFFA7AE3000-memory.dmp

Download

memory/4128-5-0x00007FFFA7880000-0x00007FFFA7AE3000-memory.dmp

Download

memory/4128-15-0x00007FFF64F50000-0x00007FFF64F60000-memory.dmp

Download

memory/4128-71-0x00007FFFA7880000-0x00007FFFA7AE3000-memory.dmp

Download

memory/4128-4-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp

Download

memory/4128-6-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp

Download

memory/4128-14-0x00007FFFA7880000-0x00007FFFA7AE3000-memory.dmp

Download

memory/4128-3-0x00007FFFA79DF000-0x00007FFFA79E0000-memory.dmp

Download

memory/4128-1-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp

Download

memory/4128-0-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp

Download

memory/4128-74-0x00007FFFA7880000-0x00007FFFA7AE3000-memory.dmp

Download

memory/4128-2-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp

Download

memory/4128-47-0x00007FFFA7880000-0x00007FFFA7AE3000-memory.dmp

Download

memory/4128-13-0x00007FFF64F50000-0x00007FFF64F60000-memory.dmp

Download

memory/4128-8-0x00007FFFA7880000-0x00007FFFA7AE3000-memory.dmp

Download

memory/4128-7-0x00007FFFA7880000-0x00007FFFA7AE3000-memory.dmp

Download

memory/4128-9-0x00007FFFA7880000-0x00007FFFA7AE3000-memory.dmp

Download

memory/4128-12-0x00007FFFA7880000-0x00007FFFA7AE3000-memory.dmp

Download

memory/4128-11-0x00007FFFA7880000-0x00007FFFA7AE3000-memory.dmp

Download

memory/4128-34-0x00007FFFA7880000-0x00007FFFA7AE3000-memory.dmp

Download

memory/4128-35-0x00007FFFA7880000-0x00007FFFA7AE3000-memory.dmp

Download

memory/4128-10-0x00007FFFA7880000-0x00007FFFA7AE3000-memory.dmp

Download

memory/5288-72-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5288-73-0x0000000005070000-0x000000000510C000-memory.dmp

Download

memory/5288-141-0x0000000006FB0000-0x0000000007042000-memory.dmp

Download

memory/5288-142-0x0000000007610000-0x0000000007BCA000-memory.dmp

Download

memory/5548-107-0x0000000070870000-0x00000000708BC000-memory.dmp

Download

memory/5548-102-0x0000000005870000-0x0000000005BCB000-memory.dmp

Download