xworm | 8faa7bcf6e1b30e68e4de554ea6203e242e9c26683b26de574d1c96ac30ad5e6

Analysis

user interaction
yes
max time kernel
86s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
XClient.exe
Size 32KB
Sample260802-ylvmcsfa33
SHA256 8faa7bcf6e1b30e68e4de554ea6203e242e9c26683b26de574d1c96ac30ad5e6
MD5 d6aea35181231d5c74223552099e7f0a
SHA1 ac512a3885d1cf26311487c408522b32d9eda959
SHA512 9fedbb12025b23dc3609d26f20f26722a07dac5f53977826926cf4b63cab4e678105c724ba96faaa7ce6fc3b517b9d0fc6f75e1e3867e9f62fc831e97a930fa9
SSDEEP 384:IlRmhGD91SluSWhnHHxzLmYV3Tm2eaFO6pzRApkFTBLTsOZwpGd2v99IkuisQVFm:cRPD9OQhx/BV3Tw4fpzVFE9jROjhNbD
TLSH
T1D3E23B4877E44712DAEEAFF12DF262061670D517D823EF9E0CE485EA2B67AC047407E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

yamalbech-35133.portmap.host:35133

Mutex

PhLbxwK2FthkLVCe

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/4532-4-0x000000001C4E0000-0x000000001C4EE000-memory.dmp	disable_win_def

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4532-0-0x0000000000DC0000-0x0000000000DCE000-memory.dmp	family_xworm

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "35"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4532	XClient.exe
Token: SeShutdownPrivilege	2204	shutdown.exe
Token: SeRemoteShutdownPrivilege	2204	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3256	LogonUI.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 2204	4532	XClient.exe	95

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SYSTEM32\shutdown.exe
  shutdown.exe /f /s /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2204

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3955055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4532-0-0x0000000000DC0000-0x0000000000DCE000-memory.dmp

Download

memory/4532-1-0x0000000002E70000-0x0000000002E80000-memory.dmp

Download

memory/4532-2-0x0000000002E50000-0x0000000002E5C000-memory.dmp

Download

memory/4532-3-0x000000001C870000-0x000000001C87A000-memory.dmp

Download

memory/4532-4-0x000000001C4E0000-0x000000001C4EE000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads