xworm | b2cbef938be96a11939ce968f99d4c224a6e43aa5a9095dd8ac2c6382d3d457a

Analysis

user interaction
yes
max time kernel
12s
max time network
13s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
04/08/2026, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Creative EAX Setting.exe
Size 2.0MB
Sample260804-b7mgjsba43
SHA256 b2cbef938be96a11939ce968f99d4c224a6e43aa5a9095dd8ac2c6382d3d457a
MD5 da008d26a9b7d118935215dde444d0be
SHA1 d914b7f7f22baba64619cbb7c480cf3876b635e7
SHA512 142650292d0810dffa59cadcd4f2f34838ab5f1b9141c5797639ec77035d9e946ba509f0a43c8561b8c3918d993035f76e26376bdb97371587cdc617ace2e023
SSDEEP 49152:hjKVa2JtVS6OCwwxNwkPMBgbRHt7UbvrbhaVMrt8phuOqGz:hoJnSzsHighWbrX8TuOT
TLSH
T174A5BF8E7264113B3646B4BA3EB83EFE507BBCE4D56B151687573F7121ADBA042E3801
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

128.234.24.39:1876

Mutex

8yXhthFwhDwHCVCU

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001400000001635e-5.dat	family_xworm
behavioral1/memory/5376-21-0x0000000000500000-0x000000000050E000-memory.dmp	family_xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\International\Geo\Nation	Creative EAX Setting.exe

Executes dropped EXE 2 IoCs

pid	Process
5376	33.exe
4676	3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5036	4676	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5376	33.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 5376	2564	Creative EAX Setting.exe	83
PID 2564 wrote to memory of 4676	2564	Creative EAX Setting.exe	84

C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting.exe
"C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Users\Admin\AppData\Roaming\33.exe
  "C:\Users\Admin\AppData\Roaming\33.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5376
- C:\Users\Admin\AppData\Roaming\3.exe
  "C:\Users\Admin\AppData\Roaming\3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 892
    3⤵
    - Program crash
    PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4676 -ip 4676
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3.exe

Path C:\Users\Admin\AppData\Roaming\3.exe
Size 2.0MB
SHA256 2ab7757fefd90d891b84b5577eaf07543701dabab1e0697d777c70eb29163ff1
MD5 79a347d53f89162586c68ecbca7ee3df
SHA1 e0a523ebe900473738b25bd3bfceec5723f58501
SHA512 0d3a6e5cc8e3aa8fae252b054a1063eca05707005895d1edf13faa02b922e870d2e0e50edf51ef0bc633c653ee59264e4000ed30151729cdde25b24ddf65d326
SSDEEP 49152:mHES0LhprAA6bHES0LhprAA6YFEaIHES0LhprAA6/+9+gfoLHES0LhprFu6:MES0LhprAA6TES0LhprAA6YFUES0Lhpx
TLSH
T1CF956BA2E50041EDDD3D97B1A0373F86192274FAC9F5598DB89870A58AD7393083FD3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33.exe

Path C:\Users\Admin\AppData\Roaming\33.exe
Size 30KB
SHA256 ec06016173f90f18ecd13688594cf62830cd634fa68069ffb9acdf4cd66d8aeb
MD5 75f1574eaa64c6e93f3c4442994930d5
SHA1 f1c1e297f17ea6702aa5492e1e5c7060c0578d37
SHA512 2d290d50a79d939f22ff5b8a74f62d3a5c08876e0c2ade417801c4487754e186597c1dd9d5b9b1d3c73a875b094cb4c16ee10befec4dee846a43ecd967b3355f
SSDEEP 384:VeAwIGmefcZWGl3nxe0XLZJkpJqXlYECwaiwQsbRugtFuBLTIOZw/WVwvn9IkVur:nHZrtxekwo1YETDJsbBFR9REiOqhqbN
TLSH
T10DD24B0877E58327D5FF2FF229B2910103759507D923DFAE5CD885A76F67A8146003EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2564-0-0x0000000000DD0000-0x0000000000FE2000-memory.dmp

Download

memory/4676-31-0x0000000000CE0000-0x0000000000EDA000-memory.dmp

Download

memory/4676-32-0x0000000006010000-0x00000000065B6000-memory.dmp

Download

memory/4676-33-0x0000000003430000-0x00000000034C2000-memory.dmp

Download

memory/5376-21-0x0000000000500000-0x000000000050E000-memory.dmp

Download

memory/5376-34-0x000000001B2D0000-0x000000001B2E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads