xworm | 833b709b93b80919dc06d8b0619de8919df283060dd9fdb9da6bd4d9b778ca7a

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 3.7MB
Sample260804-t167gsdf65
SHA256 833b709b93b80919dc06d8b0619de8919df283060dd9fdb9da6bd4d9b778ca7a
MD5 2bb1b024135ef7b0af3141d389530d82
SHA1 96a837eee8332c0d27efcad1537000001e5aa86d
SHA512 fab1098c7bd59975d36b89a5ab3baf98eb8485b081a77933dbe98075e5d861de0594dffead070dcd542d3768b04746dbffc83ce2059f9c229937bcfa408b92e2
SSDEEP 98304:RBJzPZwQwRYTkDTysBKwbCym8bILHGWCv5IjjPmg9:RvvpYTysBhegv5IjjPmg9
TLSH
T1F7068D17E2A350ECC12BC17D4657A772A530B868C534FE7F5A90DB312E31E50AB6EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

217.195.153.81:50000

Mutex

JOcw4x9bUg5qZM55

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4628-33-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Downloads MZ/PE file 1 IoCs

flow	pid	Process
6	2952	file.exe

Executes dropped EXE 5 IoCs

pid	Process
4348	OneDriveSync.exe
2884	OneDriveSync.exe
3912	dlA186.tmp.exe
3764	dlA186.tmp.exe
5264	dl3611.tmp.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\OneDrive\\OneDriveSync.exe\""	file.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\OneDrive\\OneDriveSync.exe\""	OneDriveSync.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\OneDrive\\OneDriveSync.exe\""	OneDriveSync.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
22	raw.githubusercontent.com
1	raw.githubusercontent.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3912 set thread context of 4628	3912	dlA186.tmp.exe	105
PID 3764 set thread context of 2588	3764	dlA186.tmp.exe	109
PID 5264 set thread context of 4512	5264	dl3611.tmp.exe	114

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dlA186.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dl3611.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dlA186.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2584	schtasks.exe
1280	schtasks.exe
5840	schtasks.exe
5896	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4628	jsc.exe
Token: SeDebugPrivilege	2588	jsc.exe
Token: SeDebugPrivilege	4512	jsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2952	file.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 5896	2952	file.exe	89
PID 2884 wrote to memory of 1280	2884	OneDriveSync.exe	95
PID 4348 wrote to memory of 2584	4348	OneDriveSync.exe	96
PID 2952 wrote to memory of 3912	2952	file.exe	99
PID 3912 wrote to memory of 1492	3912	dlA186.tmp.exe	100
PID 3912 wrote to memory of 5840	3912	dlA186.tmp.exe	102
PID 3912 wrote to memory of 4628	3912	dlA186.tmp.exe	105
PID 3912 wrote to memory of 4628	3912	dlA186.tmp.exe	105
PID 3912 wrote to memory of 4628	3912	dlA186.tmp.exe	105
PID 3912 wrote to memory of 4628	3912	dlA186.tmp.exe	105
PID 3912 wrote to memory of 4628	3912	dlA186.tmp.exe	105
PID 3764 wrote to memory of 5484	3764	dlA186.tmp.exe	107
PID 3764 wrote to memory of 2588	3764	dlA186.tmp.exe	109
PID 3764 wrote to memory of 2588	3764	dlA186.tmp.exe	109
PID 3764 wrote to memory of 2588	3764	dlA186.tmp.exe	109
PID 3764 wrote to memory of 2588	3764	dlA186.tmp.exe	109
PID 3764 wrote to memory of 2588	3764	dlA186.tmp.exe	109
PID 2952 wrote to memory of 5264	2952	file.exe	111
PID 5264 wrote to memory of 4600	5264	dl3611.tmp.exe	112
PID 5264 wrote to memory of 4512	5264	dl3611.tmp.exe	114
PID 5264 wrote to memory of 4512	5264	dl3611.tmp.exe	114
PID 5264 wrote to memory of 4512	5264	dl3611.tmp.exe	114
PID 5264 wrote to memory of 4512	5264	dl3611.tmp.exe	114
PID 5264 wrote to memory of 4512	5264	dl3611.tmp.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Downloads MZ/PE file
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "OneDriveSync" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveSync.exe" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5896
- C:\Users\Admin\AppData\Local\Temp\dlA186.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\dlA186.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /query /tn "SystemHealthMonitor"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1492
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /sc ONLOGON /tn "SystemHealthMonitor" /tr "\"C:\Users\Admin\AppData\Local\Local Studio\dlA186.tmp.exe\"" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5840
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- C:\Users\Admin\AppData\Local\Temp\dl3611.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\dl3611.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5264
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /query /tn "SystemHealthMonitor"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4600
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4512

C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveSync.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveSync.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "OneDriveSync" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveSync.exe" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1280

C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveSync.exe
C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveSync.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "OneDriveSync" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveSync.exe" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2584

C:\Users\Admin\AppData\Local\Local Studio\dlA186.tmp.exe
"C:\Users\Admin\AppData\Local\Local Studio\dlA186.tmp.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /query /tn "SystemHealthMonitor"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dlA186.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\dlA186.tmp.exe
Size 1.0MB
SHA256 565110ae685e0248e3ed684c859ccd1cc092c3ad1aa6a05fbfbefb10af46583b
MD5 27139922a7ac56aa3e54591cbf8e21bd
SHA1 9426e24435e9ebd360362d15c408df8cb2ea21db
SHA512 5c36d0f78adbbcbc277d4534feb707d4d63ea79d19ffec892a26459af6dc462fdf231e18d57ec824bca32031749fb04cfb63e9c0060a5eec4188245edeb8c5f4
SSDEEP 24576:xulhFab5Rz8uXXrdrc4pir95BTFH4enH0d04Q0dewv:xulubpir9zTFH4enUdXTd
TLSH
T10C354B1137ED6AE9F07F6F35D2E56255D77AE3722606DB8B1E00C24A1D13B42CE4283A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSync.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveSync.exe
Size 3.7MB
SHA256 833b709b93b80919dc06d8b0619de8919df283060dd9fdb9da6bd4d9b778ca7a
MD5 2bb1b024135ef7b0af3141d389530d82
SHA1 96a837eee8332c0d27efcad1537000001e5aa86d
SHA512 fab1098c7bd59975d36b89a5ab3baf98eb8485b081a77933dbe98075e5d861de0594dffead070dcd542d3768b04746dbffc83ce2059f9c229937bcfa408b92e2
SSDEEP 98304:RBJzPZwQwRYTkDTysBKwbCym8bILHGWCv5IjjPmg9:RvvpYTysBhegv5IjjPmg9
TLSH
T1F7068D17E2A350ECC12BC17D4657A772A530B868C534FE7F5A90DB312E31E50AB6EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2884-3-0x00007FF61C760000-0x00007FF61CB1A000-memory.dmp

Download

memory/2952-62-0x00007FF7AFBD0000-0x00007FF7AFF8A000-memory.dmp

Download

memory/2952-4-0x00007FF7AFBD0000-0x00007FF7AFF8A000-memory.dmp

Download

memory/2952-39-0x00007FF7AFBD0000-0x00007FF7AFF8A000-memory.dmp

Download

memory/3764-37-0x0000000004DD0000-0x0000000004DE6000-memory.dmp

Download

memory/3912-29-0x00000000057D0000-0x0000000005846000-memory.dmp

Download

memory/3912-31-0x00000000058A0000-0x00000000058B6000-memory.dmp

Download

memory/3912-32-0x0000000005930000-0x0000000005938000-memory.dmp

Download

memory/3912-30-0x0000000005770000-0x000000000578E000-memory.dmp

Download

memory/3912-27-0x0000000000BA0000-0x0000000000CAC000-memory.dmp

Download

memory/4348-2-0x00007FF61C760000-0x00007FF61CB1A000-memory.dmp

Download

memory/4628-33-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4628-34-0x0000000005420000-0x00000000054BC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads