xworm | 9d77be6ba9a198c39d0a08c1f35467aa528ef087dbc94d10b78041bd61a02e79

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XBinder v2.exe
Size 718KB
Sample260730-nvjlcahn4v
SHA256 9d77be6ba9a198c39d0a08c1f35467aa528ef087dbc94d10b78041bd61a02e79
MD5 8a5fe986e1001d7bea2f0ab3ce0d8698
SHA1 71964ef1c11d96890ba4f01e05f796fedb6a411c
SHA512 c3352cd4d8f4318765dd0ac0f3fe539ddfb3f0a416bfdcd714cd3a09fc0858459aec7d02dc4415831701b490278c679c377df43b6ac1bac8c1f92f7775ebc7f1
SSDEEP 12288:t38/jnMnsBvch3jokLenicZyk2DaPusaAT4elWEFztstNwqnlDs9EQryq:V8TMnsetCnijk2jRAT4wltOlwHry
TLSH
T186F42205BAA0A907DCBC1AB5DF7AC934371CBD999E24C6AE95F43EFF7AB41218050530
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V6.0

reason-trinity.gl.at.ply.gg:39101

Attributes

Install_directory
%LocalAppData%
install_file
USB.exe

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5b0-33.dat	family_xworm
behavioral2/memory/1692-39-0x00000000009F0000-0x0000000000A08000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5052	powershell.exe
2828	powershell.exe
3528	powershell.exe
4260	powershell.exe
5316	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
1692	XWormClient.exe
2656	XWormClient.exe
4404	CTF-загрузчик

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\XWormClient = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XWormClient.exe"	XBinder v2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\CTF-загрузчик = "C:\\Users\\Admin\\AppData\\Local\\CTF-загрузчик"	XWormClient.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5556	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4116	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
5052	powershell.exe
5052	powershell.exe
2828	powershell.exe
2828	powershell.exe
2828	powershell.exe
3528	powershell.exe
3528	powershell.exe
3528	powershell.exe
4260	powershell.exe
4260	powershell.exe
4260	powershell.exe
5316	powershell.exe
5316	powershell.exe
5316	powershell.exe
1692	XWormClient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2836	XBinder v2.exe
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeIncreaseQuotaPrivilege	5052	powershell.exe
Token: SeSecurityPrivilege	5052	powershell.exe
Token: SeTakeOwnershipPrivilege	5052	powershell.exe
Token: SeLoadDriverPrivilege	5052	powershell.exe
Token: SeSystemProfilePrivilege	5052	powershell.exe
Token: SeSystemtimePrivilege	5052	powershell.exe
Token: SeProfSingleProcessPrivilege	5052	powershell.exe
Token: SeIncBasePriorityPrivilege	5052	powershell.exe
Token: SeCreatePagefilePrivilege	5052	powershell.exe
Token: SeBackupPrivilege	5052	powershell.exe
Token: SeRestorePrivilege	5052	powershell.exe
Token: SeShutdownPrivilege	5052	powershell.exe
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeSystemEnvironmentPrivilege	5052	powershell.exe
Token: SeRemoteShutdownPrivilege	5052	powershell.exe
Token: SeUndockPrivilege	5052	powershell.exe
Token: SeManageVolumePrivilege	5052	powershell.exe
Token: 33	5052	powershell.exe
Token: 34	5052	powershell.exe
Token: 35	5052	powershell.exe
Token: 36	5052	powershell.exe
Token: SeDebugPrivilege	1692	XWormClient.exe
Token: SeDebugPrivilege	2656	XWormClient.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeIncreaseQuotaPrivilege	2828	powershell.exe
Token: SeSecurityPrivilege	2828	powershell.exe
Token: SeTakeOwnershipPrivilege	2828	powershell.exe
Token: SeLoadDriverPrivilege	2828	powershell.exe
Token: SeSystemProfilePrivilege	2828	powershell.exe
Token: SeSystemtimePrivilege	2828	powershell.exe
Token: SeProfSingleProcessPrivilege	2828	powershell.exe
Token: SeIncBasePriorityPrivilege	2828	powershell.exe
Token: SeCreatePagefilePrivilege	2828	powershell.exe
Token: SeBackupPrivilege	2828	powershell.exe
Token: SeRestorePrivilege	2828	powershell.exe
Token: SeShutdownPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeSystemEnvironmentPrivilege	2828	powershell.exe
Token: SeRemoteShutdownPrivilege	2828	powershell.exe
Token: SeUndockPrivilege	2828	powershell.exe
Token: SeManageVolumePrivilege	2828	powershell.exe
Token: 33	2828	powershell.exe
Token: 34	2828	powershell.exe
Token: 35	2828	powershell.exe
Token: 36	2828	powershell.exe
Token: SeDebugPrivilege	3528	powershell.exe
Token: SeIncreaseQuotaPrivilege	3528	powershell.exe
Token: SeSecurityPrivilege	3528	powershell.exe
Token: SeTakeOwnershipPrivilege	3528	powershell.exe
Token: SeLoadDriverPrivilege	3528	powershell.exe
Token: SeSystemProfilePrivilege	3528	powershell.exe
Token: SeSystemtimePrivilege	3528	powershell.exe
Token: SeProfSingleProcessPrivilege	3528	powershell.exe
Token: SeIncBasePriorityPrivilege	3528	powershell.exe
Token: SeCreatePagefilePrivilege	3528	powershell.exe
Token: SeBackupPrivilege	3528	powershell.exe
Token: SeRestorePrivilege	3528	powershell.exe
Token: SeShutdownPrivilege	3528	powershell.exe
Token: SeDebugPrivilege	3528	powershell.exe
Token: SeSystemEnvironmentPrivilege	3528	powershell.exe
Token: SeRemoteShutdownPrivilege	3528	powershell.exe
Token: SeUndockPrivilege	3528	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1692	XWormClient.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2648	2836	XBinder v2.exe	90
PID 2836 wrote to memory of 5052	2836	XBinder v2.exe	91
PID 2836 wrote to memory of 1692	2836	XBinder v2.exe	95
PID 2836 wrote to memory of 5556	2836	XBinder v2.exe	96
PID 5556 wrote to memory of 4116	5556	cmd.exe	98
PID 1692 wrote to memory of 2828	1692	XWormClient.exe	101
PID 1692 wrote to memory of 3528	1692	XWormClient.exe	103
PID 1692 wrote to memory of 4260	1692	XWormClient.exe	105
PID 1692 wrote to memory of 5316	1692	XWormClient.exe	107
PID 1692 wrote to memory of 3832	1692	XWormClient.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XBinder v2.exe
"C:\Users\Admin\AppData\Local\Temp\XBinder v2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Users\Admin\AppData\Local\Temp\XBinder v2.exe
  "C:\Users\Admin\AppData\Local\Temp\XBinder v2.exe"
  2⤵
  PID:2648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWormClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5052
- C:\Users\Admin\AppData\Local\Temp\XWormClient.exe
  "C:\Users\Admin\AppData\Local\Temp\XWormClient.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWormClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\CTF-загрузчик'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'CTF-загрузчик'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5316
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "CTF-загрузчик" /tr "C:\Users\Admin\AppData\Local\CTF-загрузчик"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBABB.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5556
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4116

C:\Users\Admin\AppData\Local\Temp\XWormClient.exe
C:\Users\Admin\AppData\Local\Temp\XWormClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Users\Admin\AppData\Local\CTF-загрузчик
"C:\Users\Admin\AppData\Local\CTF-загрузчик"
1⤵
- Executes dropped EXE
PID:4404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bc3adc6f82a8110a928ed6755b7c363f1af83ceb434f5587e2511e4f6cdf9e42
MD5 80642800e302d25cc033771c919d3151
SHA1 8e0f876702ebf5c019a9aaad2aab944546d0f2e7
SHA512 77075167b3f0877d2a41ed3bdb3482a8d1c187c11351b16737d4811047bdab9237af563d5450ae2f6c5d37472f7ff3346fc0bba99cebb9d08a906bdb4f6e88b4
TLSH
T1E6216833F3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 48e5256b1effeab38e38f99352e4727bba2f699a2f4676dd318d6732ea3f8663
MD5 14a51c684ab9e7e9597d2e9d29497a43
SHA1 9b405a4ab2cdaee9bb85a08f54cb139d6f2aeb73
SHA512 7ce1d95e370704d6c64e5dbc858abe0ea38d749fb6dcc3e2ea03219517ad3445bf35a6810306feff7b738b22de73e9e58c30744117db69d87cf00d888954a4d2
TLSH
T13B216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB7B84E659A43F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 31f54a84498a62f4280cdad450e7e459b75378c7e67bfcf3279f493410eef07a
MD5 dcd0d48e287a2fa1fc2c2116c1997c88
SHA1 aa1c4035e6666763d1ccd82b32b9541f4b42b1be
SHA512 b4af5e7ff27bffe7527094d4187b934df549bcd1f31df3853c1ff317f47e60165682f740ee3279f573d5ea8adfd586aee37095800fcb77aa348011284ce99859
TLSH
T18C216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 70906d599329ed3659da38e792fe4ef0bf5fe2fbe19e2e46eca43a7b778d5153
MD5 c37d9a94d7a97d3dd185ca260e6c18e0
SHA1 f61c94b4383078f444de35dc18ba6521b997a15e
SHA512 fb91945bdbb88e144d7ea69add6e94bdb16f3007a91a5e24373edd8c5332b54d05f153c6412ff41a01c032500b3fa27565a46702933a4f4ef050f9a035440630
TLSH
T1A1216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

XWormClient.exe

Path C:\Users\Admin\AppData\Local\Temp\XWormClient.exe
Size 74KB
SHA256 4cbf28c862a40f70df00a3ee50053b860ee70d0451ec262eaf13effcd764aa34
MD5 9ecb3de3ec803e2107ba57e29662f742
SHA1 910877300780d697bc62c4eb0d4b488cfb7603ef
SHA512 ed588e61437ee7e81cc508bc1d81003da643e91e9d26cb5dd323bcad8d887a9b8828bc59195dc9c545b78f4d935cc28c75bc5472dba9725a3fc62eb5a6852f64
SSDEEP 1536:BFxFT93kXHeUrqa4QOl/DuR5ZngbMNEAGAV4rW6EDFUOSEO2d5I:BDFtzUr7XY/DuSbMNE1AKcZO2dS
TLSH
T178737D1877E6412EE0FFAFB459F13122C736F623A903D51F24D9029B2A27A89CD416F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_4u2ypiwu.grr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4u2ypiwu.grr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpBABB.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpBABB.tmp.bat
Size 162B
SHA256 04739459a3ebf5884d58651167551a5d1a0d7845b9ccb3f97a83e967bdee3afc
MD5 efadf7867ad56b35cf30282309bf1afc
SHA1 bbe2888055904bf2a135789074f36fd5e86e5dfa
SHA512 d6cddc832541d236e491d1bba0a5f29f688dd0e442792efa87aaf79a973525f4a624caf64d7d2119522b10b923957dd1cd72558a205e57cbff0293b6f2ad5404
TLSH
T1F3C08C0255CEFE1B1A0A242715B6C48ED06B9C1E2E586B6097AA800878814ACF5BC38A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1692-69-0x000000001C520000-0x000000001C6EA000-memory.dmp

Download

memory/1692-39-0x00000000009F0000-0x0000000000A08000-memory.dmp

Download

memory/2648-6-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/2648-5-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/2648-26-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/2828-48-0x000001BE4DFB0000-0x000001BE4E062000-memory.dmp

Download

memory/2836-4-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/2836-1-0x00000000006E0000-0x0000000000798000-memory.dmp

Download

memory/2836-41-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/2836-3-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/2836-2-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/2836-0-0x00007FFC64D3F000-0x00007FFC64D40000-memory.dmp

Download

memory/5052-12-0x0000012540DD0000-0x0000012540DEE000-memory.dmp

Download

memory/5052-24-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/5052-25-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/5052-23-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/5052-28-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/5052-22-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/5052-21-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/5052-20-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/5052-19-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/5052-18-0x0000012540BB0000-0x0000012540BBA000-memory.dmp

Download

memory/5052-17-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/5052-16-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/5052-15-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/5052-14-0x00007FFC64BB0000-0x00007FFC65554000-memory.dmp

Download

memory/5052-13-0x0000012540DF0000-0x0000012540EA2000-memory.dmp

Download

memory/5052-9-0x0000012540AF0000-0x0000012540B12000-memory.dmp

Download