xworm | dea0649857c76ceabba2ac3ecb1aa5960e92f1a5ef80b385a75903aa7edd2c3d

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order Invoice #922635.exe
Size 803KB
Sample260730-pfe52shb98
SHA256 dea0649857c76ceabba2ac3ecb1aa5960e92f1a5ef80b385a75903aa7edd2c3d
MD5 962f8ccbacdfda078a35a1eb6dbcc11b
SHA1 958e8f42467049f05c81b368bb71ff465642164a
SHA512 aefc0c563ae5f039ff58e3f1632044acb9f55024d6e6ed9b39c737ee642129b2b39f1bf8ba30944e950e105102dc89dd9ef0adf9f7bfd535362475bcf0f4f59e
SSDEEP 24576:AWFcpVvH5ZFkBXjv0jv/Kxfrzs5gjOeZ:P2vH1uv0jvSps5Be
TLSH
T1C9051288A6859701E9F71BF11566E63013743D9EA630E70B1FEA7EEB36B3B94441031B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

carrenzaalwarex.ddns.net:7004

Mutex

2B7HLE7nXIzGq07o

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/796-13-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5112	powershell.exe
3244	powershell.exe
4980	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5480	xXJNDKas.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\xXJNDKas = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\kzpfqjjonmb.ps1\""	Order Invoice #922635.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4904 set thread context of 796	4904	Order Invoice #922635.exe	92
PID 5480 set thread context of 3128	5480	xXJNDKas.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Order Invoice #922635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xXJNDKas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4904	Order Invoice #922635.exe
4904	Order Invoice #922635.exe
4904	Order Invoice #922635.exe
4904	Order Invoice #922635.exe
5112	powershell.exe
5112	powershell.exe
4980	powershell.exe
4980	powershell.exe
4980	powershell.exe
796	RegSvcs.exe
796	RegSvcs.exe
5480	xXJNDKas.exe
5480	xXJNDKas.exe
3244	powershell.exe
3244	powershell.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	4904	Order Invoice #922635.exe
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	796	RegSvcs.exe
Token: SeDebugPrivilege	5480	xXJNDKas.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	3128	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	3244	powershell.exe
Token: SeSecurityPrivilege	3244	powershell.exe
Token: SeTakeOwnershipPrivilege	3244	powershell.exe
Token: SeLoadDriverPrivilege	3244	powershell.exe
Token: SeSystemProfilePrivilege	3244	powershell.exe
Token: SeSystemtimePrivilege	3244	powershell.exe
Token: SeProfSingleProcessPrivilege	3244	powershell.exe
Token: SeIncBasePriorityPrivilege	3244	powershell.exe
Token: SeCreatePagefilePrivilege	3244	powershell.exe
Token: SeBackupPrivilege	3244	powershell.exe
Token: SeRestorePrivilege	3244	powershell.exe
Token: SeShutdownPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeSystemEnvironmentPrivilege	3244	powershell.exe
Token: SeRemoteShutdownPrivilege	3244	powershell.exe
Token: SeUndockPrivilege	3244	powershell.exe
Token: SeManageVolumePrivilege	3244	powershell.exe
Token: 33	3244	powershell.exe
Token: 34	3244	powershell.exe
Token: 35	3244	powershell.exe
Token: 36	3244	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
796	RegSvcs.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 5112	4904	Order Invoice #922635.exe	89
PID 4904 wrote to memory of 2956	4904	Order Invoice #922635.exe	91
PID 4904 wrote to memory of 796	4904	Order Invoice #922635.exe	92
PID 4904 wrote to memory of 796	4904	Order Invoice #922635.exe	92
PID 4904 wrote to memory of 796	4904	Order Invoice #922635.exe	92
PID 4904 wrote to memory of 796	4904	Order Invoice #922635.exe	92
PID 4904 wrote to memory of 796	4904	Order Invoice #922635.exe	92
PID 4980 wrote to memory of 5480	4980	powershell.exe	95
PID 5480 wrote to memory of 3244	5480	xXJNDKas.exe	97
PID 5480 wrote to memory of 3128	5480	xXJNDKas.exe	99
PID 5480 wrote to memory of 3128	5480	xXJNDKas.exe	99
PID 5480 wrote to memory of 3128	5480	xXJNDKas.exe	99
PID 5480 wrote to memory of 3128	5480	xXJNDKas.exe	99
PID 5480 wrote to memory of 3128	5480	xXJNDKas.exe	99

C:\Users\Admin\AppData\Local\Temp\Order Invoice #922635.exe
"C:\Users\Admin\AppData\Local\Temp\Order Invoice #922635.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Order Invoice #922635.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:796

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\kzpfqjjonmb.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\AppData\Roaming\xXJNDKas.exe
  "C:\Users\Admin\AppData\Roaming\xXJNDKas.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xXJNDKas.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3244
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 1306c34c682441498f7637d57c87a884c4c63d0fabf06c67cd94ec5880b82a4c
MD5 6fc7abaf9b41607b2cfbcb14bf87eb0e
SHA1 38e7e214e5c9593bf0b4a70e1be0fee2bb19f62d
SHA512 d75c5daa159e113d67bc01c8e4585eadb6d4d81684d9ad1a3451166eb94fd8728033e7bf7554b9c81af8ae1d266443bb81b85f8762488ea41e8a6ce300dea090
SSDEEP 384:r1eBaGT1iBXGW14bzHCm0WZ+cmwl8lk2PntIAXr4L+lWarKzKwgvYbhNaP8lRtDC:JenZ6WWiviLWZ+ISZFIAXrk+xW/bhNaZ
TLSH
T14B92A468213F6DC7D8D2227050D602F7FBE4D489DA7651A4BF2BDA2F4C90EBB4E60520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_uw3lsfp2.p0r.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uw3lsfp2.p0r.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

kzpfqjjonmb.ps1

Path C:\Users\Admin\AppData\Local\Temp\kzpfqjjonmb.ps1
Size 1KB
SHA256 695db821b6d066ee6c680fa08579ccc86e66a7475aa61941255d33489cdeff17
MD5 edf27f3a12bd260d29e740c86213cdd4
SHA1 08be2a15c1c0bd85ab593ff2e9eacbd0b57c441a
SHA512 265b7be9a793445b8f0add9cd54a27b030b93e00e9f8d287f0364686d9e1a84ccf97e477446e3d031e29f63c7e1e2d12aab8c1eb27130778c95a1dcc3a26f63b
TLSH
T1EF119E5B8E8517C5402807F54A1335CE752D618B2FAF009095ECB5EEB36BE63386EDE4
MD5 SHA1 SHA512 TLSH

Submit Download

xXJNDKas.exe

Path C:\Users\Admin\AppData\Roaming\xXJNDKas.exe
Size 803KB
SHA256 dea0649857c76ceabba2ac3ecb1aa5960e92f1a5ef80b385a75903aa7edd2c3d
MD5 962f8ccbacdfda078a35a1eb6dbcc11b
SHA1 958e8f42467049f05c81b368bb71ff465642164a
SHA512 aefc0c563ae5f039ff58e3f1632044acb9f55024d6e6ed9b39c737ee642129b2b39f1bf8ba30944e950e105102dc89dd9ef0adf9f7bfd535362475bcf0f4f59e
SSDEEP 24576:AWFcpVvH5ZFkBXjv0jv/Kxfrzs5gjOeZ:P2vH1uv0jvSps5Be
TLSH
T1C9051288A6859701E9F71BF11566E63013743D9EA630E70B1FEA7EEB36B3B94441031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/796-13-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/796-48-0x0000000074440000-0x0000000074BFC000-memory.dmp

Download

memory/796-31-0x0000000074440000-0x0000000074BFC000-memory.dmp

Download

memory/796-16-0x0000000074440000-0x0000000074BFC000-memory.dmp

Download

memory/3244-55-0x0000000072C10000-0x0000000072C5C000-memory.dmp

Download

memory/3244-58-0x0000000007790000-0x0000000007833000-memory.dmp

Download

memory/3244-54-0x0000000006590000-0x00000000065DC000-memory.dmp

Download

memory/3244-52-0x0000000006040000-0x000000000639B000-memory.dmp

Download

memory/4904-11-0x0000000008240000-0x00000000082EE000-memory.dmp

Download

memory/4904-5-0x0000000003480000-0x000000000348A000-memory.dmp

Download

memory/4904-0-0x0000000074452000-0x0000000074453000-memory.dmp

Download

memory/4904-1-0x0000000000CA0000-0x0000000000D70000-memory.dmp

Download

memory/4904-2-0x0000000005B30000-0x0000000005E8B000-memory.dmp

Download

memory/4904-3-0x0000000006450000-0x0000000006A0A000-memory.dmp

Download

memory/4904-4-0x0000000005930000-0x00000000059C2000-memory.dmp

Download

memory/4904-10-0x00000000081A0000-0x000000000823C000-memory.dmp

Download

memory/4904-6-0x0000000074440000-0x0000000074BFC000-memory.dmp

Download

memory/4904-7-0x0000000005AA0000-0x0000000005AAC000-memory.dmp

Download

memory/4904-25-0x0000000074440000-0x0000000074BFC000-memory.dmp

Download

memory/4904-8-0x0000000074452000-0x0000000074453000-memory.dmp

Download

memory/4904-9-0x0000000074440000-0x0000000074BFC000-memory.dmp

Download

memory/4980-30-0x000001CE24B30000-0x000001CE24B52000-memory.dmp

Download

memory/5112-35-0x0000000007450000-0x0000000007486000-memory.dmp

Download

memory/5112-41-0x0000000007C10000-0x000000000828C000-memory.dmp

Download

memory/5112-26-0x0000000006250000-0x000000000626E000-memory.dmp

Download

memory/5112-15-0x0000000074440000-0x0000000074BFC000-memory.dmp

Download

memory/5112-36-0x0000000074D00000-0x0000000074D4C000-memory.dmp

Download

memory/5112-40-0x0000000007490000-0x0000000007533000-memory.dmp

Download

memory/5112-39-0x0000000006830000-0x0000000006850000-memory.dmp

Download

memory/5112-19-0x0000000005490000-0x00000000054B2000-memory.dmp

Download

memory/5112-42-0x00000000075D0000-0x00000000075EA000-memory.dmp

Download

memory/5112-29-0x0000000006290000-0x00000000062DC000-memory.dmp

Download

memory/5112-43-0x0000000007640000-0x000000000764A000-memory.dmp

Download

memory/5112-44-0x0000000007840000-0x00000000078D6000-memory.dmp

Download

memory/5112-47-0x0000000074440000-0x0000000074BFC000-memory.dmp

Download

memory/5112-20-0x0000000005530000-0x0000000005596000-memory.dmp

Download

memory/5112-24-0x0000000074440000-0x0000000074BFC000-memory.dmp

Download

memory/5112-21-0x00000000055A0000-0x0000000005606000-memory.dmp

Download

memory/5112-14-0x0000000002A00000-0x0000000002A36000-memory.dmp

Download

memory/5112-18-0x0000000074440000-0x0000000074BFC000-memory.dmp

Download

memory/5112-17-0x0000000005640000-0x0000000005C8A000-memory.dmp

Download