xworm | 46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe
Size 801KB
Sample260731-vb1tvade82
SHA256 46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4
MD5 d5a1c25a0d94a939935412058154c8ef
SHA1 f3d48d753ee43f069763fcf06a8c9e3536dfed8b
SHA512 b25b016938071d8407124fe85c5404bba6176f02609e34ce488749c1d741f46462b8fa9df711b858f58f7523e593b21db4d15d51c3e787ea17d6d9501b9a5d53
SSDEEP 24576:d81lEufOA4dd1SPdaAZOHRQEvX4JhDeZ:qfEufgkPEAZ+RQEAJhDe
TLSH
T19C051258B3A1DB12E8730BF51532E93103B07CAA7A21E25A4EE9BDDB7B337146414727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

carrenzaalwarex.ddns.net:7004

Mutex

2B7HLE7nXIzGq07o

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4588-17-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2428	powershell.exe
1932	powershell.exe
4932	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5540	rwjJOH.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\rwjJOH = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\xrltigysxlu.ps1\""	46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3192 set thread context of 4588	3192	46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe	91
PID 5540 set thread context of 4776	5540	rwjJOH.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rwjJOH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3192	46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe
3192	46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe
2428	powershell.exe
2428	powershell.exe
4588	RegSvcs.exe
4932	powershell.exe
4932	powershell.exe
4932	powershell.exe
5540	rwjJOH.exe
5540	rwjJOH.exe
5540	rwjJOH.exe
5540	rwjJOH.exe
5540	rwjJOH.exe
1932	powershell.exe
1932	powershell.exe
1932	powershell.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	3192	46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeDebugPrivilege	4588	RegSvcs.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeIncreaseQuotaPrivilege	2428	powershell.exe
Token: SeSecurityPrivilege	2428	powershell.exe
Token: SeTakeOwnershipPrivilege	2428	powershell.exe
Token: SeLoadDriverPrivilege	2428	powershell.exe
Token: SeSystemProfilePrivilege	2428	powershell.exe
Token: SeSystemtimePrivilege	2428	powershell.exe
Token: SeProfSingleProcessPrivilege	2428	powershell.exe
Token: SeIncBasePriorityPrivilege	2428	powershell.exe
Token: SeCreatePagefilePrivilege	2428	powershell.exe
Token: SeBackupPrivilege	2428	powershell.exe
Token: SeRestorePrivilege	2428	powershell.exe
Token: SeShutdownPrivilege	2428	powershell.exe
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeSystemEnvironmentPrivilege	2428	powershell.exe
Token: SeRemoteShutdownPrivilege	2428	powershell.exe
Token: SeUndockPrivilege	2428	powershell.exe
Token: SeManageVolumePrivilege	2428	powershell.exe
Token: 33	2428	powershell.exe
Token: 34	2428	powershell.exe
Token: 35	2428	powershell.exe
Token: 36	2428	powershell.exe
Token: SeDebugPrivilege	5540	rwjJOH.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	4776	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	1932	powershell.exe
Token: SeSecurityPrivilege	1932	powershell.exe
Token: SeTakeOwnershipPrivilege	1932	powershell.exe
Token: SeLoadDriverPrivilege	1932	powershell.exe
Token: SeSystemProfilePrivilege	1932	powershell.exe
Token: SeSystemtimePrivilege	1932	powershell.exe
Token: SeProfSingleProcessPrivilege	1932	powershell.exe
Token: SeIncBasePriorityPrivilege	1932	powershell.exe
Token: SeCreatePagefilePrivilege	1932	powershell.exe
Token: SeBackupPrivilege	1932	powershell.exe
Token: SeRestorePrivilege	1932	powershell.exe
Token: SeShutdownPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeSystemEnvironmentPrivilege	1932	powershell.exe
Token: SeRemoteShutdownPrivilege	1932	powershell.exe
Token: SeUndockPrivilege	1932	powershell.exe
Token: SeManageVolumePrivilege	1932	powershell.exe
Token: 33	1932	powershell.exe
Token: 34	1932	powershell.exe
Token: 35	1932	powershell.exe
Token: 36	1932	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4588	RegSvcs.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 2428	3192	46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe	89
PID 3192 wrote to memory of 4588	3192	46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe	91
PID 3192 wrote to memory of 4588	3192	46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe	91
PID 3192 wrote to memory of 4588	3192	46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe	91
PID 3192 wrote to memory of 4588	3192	46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe	91
PID 3192 wrote to memory of 4588	3192	46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe	91
PID 4932 wrote to memory of 5540	4932	powershell.exe	94
PID 5540 wrote to memory of 1932	5540	rwjJOH.exe	99
PID 5540 wrote to memory of 2620	5540	rwjJOH.exe	101
PID 5540 wrote to memory of 4776	5540	rwjJOH.exe	102
PID 5540 wrote to memory of 4776	5540	rwjJOH.exe	102
PID 5540 wrote to memory of 4776	5540	rwjJOH.exe	102
PID 5540 wrote to memory of 4776	5540	rwjJOH.exe	102
PID 5540 wrote to memory of 4776	5540	rwjJOH.exe	102

C:\Users\Admin\AppData\Local\Temp\46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe
"C:\Users\Admin\AppData\Local\Temp\46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2428
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4588

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\xrltigysxlu.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Roaming\rwjJOH.exe
  "C:\Users\Admin\AppData\Roaming\rwjJOH.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5540
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rwjJOH.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:2620
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 2368a35fe9eacdcbac2241babe4d6f562909867cea8917e04d1857359fba513d
MD5 631a0deb4736626effc0aca734e183b5
SHA1 eb1f9fb4d8f3b8abcd2b9b4c486c354a9fcca103
SHA512 8b633b839acbc83177ea27b0489315f755e2a23b13f9b20f551e587c76cdb2a69c154cd4ad052126a9e6442dc510e82a652b7c47373288255990cc34dd6c2592
SSDEEP 384:q8mboT1iBGTGW14bYy7L6dmI+6Equ0Eqr2PIFIAXr4B+VW8qtzKwAvYbhNaP8WR4:S0Z6G6WiMU6dmI+vy6GIAXrq+OVfbhN5
TLSH
T164A2B478213F6DC7D8D226B010D20AF7FBE4D489DAB65194BF1BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_qidqkqcs.vst.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qidqkqcs.vst.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

xrltigysxlu.ps1

Path C:\Users\Admin\AppData\Local\Temp\xrltigysxlu.ps1
Size 1KB
SHA256 7336b03c41ae97fd77b364d149849484efc0dad95c8256103272b667cf7bc64c
MD5 a3d852716e1751a862ce938616bdc743
SHA1 1c8a0ae9a898dc1e7aee82287930163aaf127a5b
SHA512 e1a633254333810a617ded9a91d8f2a8aa771de447fc9e55263f51844a4b9dbe4326e5334b541582b212f0b12fecb36570d782ba58dd4247bdc9c7942399f3d3
TLSH
T1621102478E8547D5503403F14A03B5CCB55D60CB2BBF008155ECA4DEB32BE23386ACE8
MD5 SHA1 SHA512 TLSH

Submit Download

rwjJOH.exe

Path C:\Users\Admin\AppData\Roaming\rwjJOH.exe
Size 801KB
SHA256 46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4
MD5 d5a1c25a0d94a939935412058154c8ef
SHA1 f3d48d753ee43f069763fcf06a8c9e3536dfed8b
SHA512 b25b016938071d8407124fe85c5404bba6176f02609e34ce488749c1d741f46462b8fa9df711b858f58f7523e593b21db4d15d51c3e787ea17d6d9501b9a5d53
SSDEEP 24576:d81lEufOA4dd1SPdaAZOHRQEvX4JhDeZ:qfEufgkPEAZ+RQEAJhDe
TLSH
T19C051258B3A1DB12E8730BF51532E93103B07CAA7A21E25A4EE9BDDB7B337146414727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1932-59-0x0000000007B40000-0x0000000007BE3000-memory.dmp

Download

memory/1932-56-0x0000000073430000-0x000000007347C000-memory.dmp

Download

memory/1932-55-0x0000000006DA0000-0x0000000006DEC000-memory.dmp

Download

memory/1932-53-0x0000000006520000-0x000000000687B000-memory.dmp

Download

memory/2428-13-0x00000000054B0000-0x00000000054E6000-memory.dmp

Download

memory/2428-18-0x0000000074B10000-0x00000000752CC000-memory.dmp

Download

memory/2428-42-0x0000000007CD0000-0x0000000007CEA000-memory.dmp

Download

memory/2428-33-0x0000000007B10000-0x0000000007B46000-memory.dmp

Download

memory/2428-43-0x0000000007D40000-0x0000000007D4A000-memory.dmp

Download

memory/2428-14-0x0000000074B10000-0x00000000752CC000-memory.dmp

Download

memory/2428-15-0x0000000005C70000-0x00000000062BA000-memory.dmp

Download

memory/2428-16-0x0000000074B10000-0x00000000752CC000-memory.dmp

Download

memory/2428-40-0x0000000007B90000-0x0000000007C33000-memory.dmp

Download

memory/2428-41-0x0000000008310000-0x000000000898C000-memory.dmp

Download

memory/2428-20-0x00000000063B0000-0x0000000006416000-memory.dmp

Download

memory/2428-21-0x0000000006420000-0x0000000006486000-memory.dmp

Download

memory/2428-44-0x0000000007F40000-0x0000000007FD6000-memory.dmp

Download

memory/2428-19-0x0000000005BA0000-0x0000000005BC2000-memory.dmp

Download

memory/2428-47-0x0000000074B10000-0x00000000752CC000-memory.dmp

Download

memory/2428-26-0x0000000006960000-0x000000000697E000-memory.dmp

Download

memory/2428-27-0x00000000069B0000-0x00000000069FC000-memory.dmp

Download

memory/2428-37-0x0000000007B50000-0x0000000007B70000-memory.dmp

Download

memory/2428-34-0x00000000753D0000-0x000000007541C000-memory.dmp

Download

memory/3192-11-0x0000000008070000-0x000000000811E000-memory.dmp

Download

memory/3192-4-0x00000000055F0000-0x0000000005682000-memory.dmp

Download

memory/3192-1-0x00000000009D0000-0x0000000000A9E000-memory.dmp

Download

memory/3192-25-0x0000000074B10000-0x00000000752CC000-memory.dmp

Download

memory/3192-2-0x0000000005780000-0x0000000005ADB000-memory.dmp

Download

memory/3192-3-0x00000000060A0000-0x000000000665A000-memory.dmp

Download

memory/3192-0-0x0000000074B22000-0x0000000074B23000-memory.dmp

Download

memory/3192-10-0x0000000007FD0000-0x000000000806C000-memory.dmp

Download

memory/3192-9-0x0000000074B10000-0x00000000752CC000-memory.dmp

Download

memory/3192-8-0x0000000074B22000-0x0000000074B23000-memory.dmp

Download

memory/3192-7-0x0000000005750000-0x000000000575C000-memory.dmp

Download

memory/3192-6-0x0000000074B10000-0x00000000752CC000-memory.dmp

Download

memory/3192-5-0x00000000056A0000-0x00000000056AA000-memory.dmp

Download

memory/4588-17-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4588-49-0x0000000074B10000-0x00000000752CC000-memory.dmp

Download

memory/4588-48-0x0000000074B10000-0x00000000752CC000-memory.dmp

Download

memory/4588-22-0x0000000074B10000-0x00000000752CC000-memory.dmp

Download

memory/4588-28-0x0000000074B10000-0x00000000752CC000-memory.dmp

Download

memory/4932-31-0x0000020842660000-0x0000020842682000-memory.dmp

Download