xworm | 45f3b2a158163f09cfbf248a2fa76f2b3b011b8abc35835230ab81597db43802

Analysis

max time kernel
149s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
31/07/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
123645.exe
Size 84KB
Sample260731-2wv8essepd
SHA256 45f3b2a158163f09cfbf248a2fa76f2b3b011b8abc35835230ab81597db43802
MD5 e3a5cb4262f94dd45dab2d497cb49adb
SHA1 df7c2195fffccc1cdbecaabd883151d32ff9d67d
SHA512 708e8d68674b734aa9ddf95514476a2c72eb780efa506155fcf197aeed7f8e1babd7d34c48c3df4315553a0c9fe85de9f673c5ce67a0387a1adc4a8159e9618c
SSDEEP 1536:jLOhmFlCRUh1sLJVQr9rcYTJzQ5f/sksVQgUnH85CDxQ+vD7N2up1jSic:X/X14wJrcY2/hUxUnHuCMhic
TLSH
T1A783023F3B012A31EAE656760BE2E1B825B4C7469D6C8EEDC8D3751BBC980CC7C4515A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm rat trojan

Malware Config

Extracted

Family

xworm

7326.info:2686

Attributes

install_file
USB.exe
localhost
127.0.0.1

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3456-9-0x0000000000400000-0x0000000000418000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2140	powershell.exe
3880	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3556 set thread context of 3456	3556	123645.exe	87

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	123645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3456	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3556	123645.exe
3556	123645.exe
3556	123645.exe
3556	123645.exe
2140	powershell.exe
2140	powershell.exe
3880	powershell.exe
3880	powershell.exe
3456	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	123645.exe
Token: SeDebugPrivilege	3456	RegSvcs.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeIncreaseQuotaPrivilege	2140	powershell.exe
Token: SeSecurityPrivilege	2140	powershell.exe
Token: SeTakeOwnershipPrivilege	2140	powershell.exe
Token: SeLoadDriverPrivilege	2140	powershell.exe
Token: SeSystemProfilePrivilege	2140	powershell.exe
Token: SeSystemtimePrivilege	2140	powershell.exe
Token: SeProfSingleProcessPrivilege	2140	powershell.exe
Token: SeIncBasePriorityPrivilege	2140	powershell.exe
Token: SeCreatePagefilePrivilege	2140	powershell.exe
Token: SeBackupPrivilege	2140	powershell.exe
Token: SeRestorePrivilege	2140	powershell.exe
Token: SeShutdownPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeSystemEnvironmentPrivilege	2140	powershell.exe
Token: SeRemoteShutdownPrivilege	2140	powershell.exe
Token: SeUndockPrivilege	2140	powershell.exe
Token: SeManageVolumePrivilege	2140	powershell.exe
Token: 33	2140	powershell.exe
Token: 34	2140	powershell.exe
Token: 35	2140	powershell.exe
Token: 36	2140	powershell.exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeIncreaseQuotaPrivilege	3880	powershell.exe
Token: SeSecurityPrivilege	3880	powershell.exe
Token: SeTakeOwnershipPrivilege	3880	powershell.exe
Token: SeLoadDriverPrivilege	3880	powershell.exe
Token: SeSystemProfilePrivilege	3880	powershell.exe
Token: SeSystemtimePrivilege	3880	powershell.exe
Token: SeProfSingleProcessPrivilege	3880	powershell.exe
Token: SeIncBasePriorityPrivilege	3880	powershell.exe
Token: SeCreatePagefilePrivilege	3880	powershell.exe
Token: SeBackupPrivilege	3880	powershell.exe
Token: SeRestorePrivilege	3880	powershell.exe
Token: SeShutdownPrivilege	3880	powershell.exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeSystemEnvironmentPrivilege	3880	powershell.exe
Token: SeRemoteShutdownPrivilege	3880	powershell.exe
Token: SeUndockPrivilege	3880	powershell.exe
Token: SeManageVolumePrivilege	3880	powershell.exe
Token: 33	3880	powershell.exe
Token: 34	3880	powershell.exe
Token: 35	3880	powershell.exe
Token: 36	3880	powershell.exe
Token: SeDebugPrivilege	3456	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3456	RegSvcs.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 3496	3556	123645.exe	85
PID 3556 wrote to memory of 1948	3556	123645.exe	86
PID 3556 wrote to memory of 3456	3556	123645.exe	87
PID 3556 wrote to memory of 3456	3556	123645.exe	87
PID 3556 wrote to memory of 3456	3556	123645.exe	87
PID 3556 wrote to memory of 3456	3556	123645.exe	87
PID 3556 wrote to memory of 3456	3556	123645.exe	87
PID 3456 wrote to memory of 2140	3456	RegSvcs.exe	88
PID 3456 wrote to memory of 3880	3456	RegSvcs.exe	93

C:\Users\Admin\AppData\Local\Temp\123645.exe
"C:\Users\Admin\AppData\Local\Temp\123645.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:3496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2140
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegSvcs.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 883481fe331cb89fb6061e76b43acd4dd638c16f499b10088b261036c6d0547b
MD5 f9349064c7c8f8467cc12d78a462e5f9
SHA1 5e1d27fc64751cd8c0e9448ee47741da588b3484
SHA512 3229668491b5e4068e743b31f2896b30b1842faf96aff09fad01b08771c2f11eb8d8f02a3b76e31f0d6ad650c2894c5ac1822204e132c03d9c2b8df6ca4cd7cf
TLSH
T1B2417B303131B4D84D826F0215286EC5A3EF878AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 1fc96d4496f80d98ad7266e21efee619f9f012bfdbcf14cd342aa70421e39f23
MD5 3c1dbb6647e15b8d1ab7077a3ba16a9d
SHA1 4fd04ded49fa1a0f47c5397571c0bfa261508b38
SHA512 27143a317ef567ffb8c5bef967d935d5525775b7bb35993d6ae3f2234eefca6c2e67e670c21aa56fa62a40d0f70d87e8fb96a37ed383b898c2e49c751de37699
SSDEEP 384:7tfQD3M6aUkjpFcs2dk4UcTRXcdBiRZSCD1J8CAtf5O3eLSVHIMt:RfgM6V22eVcTyGLcCALp2
TLSH
T118A2D93560B78DE5DAC215B0569E0AEEFFE0D8419BB872CCEB1DFA1D4CE2D365620064
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3isn2yfx.i04.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3isn2yfx.i04.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2140-38-0x0000000007040000-0x000000000705E000-memory.dmp

Download

memory/2140-27-0x0000000006A20000-0x0000000006A3E000-memory.dmp

Download

memory/2140-43-0x0000000008010000-0x00000000080A6000-memory.dmp

Download

memory/2140-42-0x0000000007DF0000-0x0000000007DFA000-memory.dmp

Download

memory/2140-41-0x0000000007D90000-0x0000000007DAA000-memory.dmp

Download

memory/2140-40-0x00000000083E0000-0x0000000008A5A000-memory.dmp

Download

memory/2140-39-0x0000000007C60000-0x0000000007D03000-memory.dmp

Download

memory/2140-29-0x0000000007A10000-0x0000000007A42000-memory.dmp

Download

memory/2140-26-0x0000000006620000-0x0000000006977000-memory.dmp

Download

memory/2140-13-0x00000000054B0000-0x00000000054C0000-memory.dmp

Download

memory/2140-12-0x00000000053C0000-0x00000000053F6000-memory.dmp

Download

memory/2140-15-0x0000000005B90000-0x000000000625A000-memory.dmp

Download

memory/2140-16-0x00000000062B0000-0x00000000062D2000-memory.dmp

Download

memory/2140-17-0x0000000006350000-0x00000000063B6000-memory.dmp

Download

memory/2140-30-0x0000000070070000-0x00000000700BC000-memory.dmp

Download

memory/2140-18-0x0000000006430000-0x0000000006496000-memory.dmp

Download

memory/2140-14-0x00000000054B0000-0x00000000054C0000-memory.dmp

Download

memory/2140-28-0x0000000006A70000-0x0000000006ABC000-memory.dmp

Download

memory/3456-9-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/3456-65-0x00000000051D0000-0x00000000051E0000-memory.dmp

Download

memory/3456-11-0x0000000004FB0000-0x000000000504C000-memory.dmp

Download

memory/3456-64-0x00000000051D0000-0x00000000051E0000-memory.dmp

Download

memory/3556-2-0x0000000005290000-0x0000000005322000-memory.dmp

Download

memory/3556-3-0x00000000054D0000-0x00000000054E0000-memory.dmp

Download

memory/3556-6-0x00000000054D0000-0x00000000054E0000-memory.dmp

Download

memory/3556-8-0x00000000054E0000-0x00000000054FE000-memory.dmp

Download

memory/3556-5-0x0000000005430000-0x00000000054A6000-memory.dmp

Download

memory/3556-7-0x0000000005350000-0x000000000536A000-memory.dmp

Download

memory/3556-1-0x0000000005940000-0x0000000005EE6000-memory.dmp

Download

memory/3556-0-0x00000000009E0000-0x00000000009FC000-memory.dmp

Download

memory/3556-4-0x0000000005340000-0x000000000534A000-memory.dmp

Download

memory/3880-55-0x0000000070070000-0x00000000700BC000-memory.dmp

Download