xworm | 54db77d001f909ea7ce02ce14bcffd5f903d7a7a571d409b5b2a4316575f730c

Analysis

max time kernel
149s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
54db77d001f909ea7ce02ce14bcffd5f903d7a7a571d409b5b2a4316575f730c.exe
Size 65KB
Sample260804-vtzphawbma
SHA256 54db77d001f909ea7ce02ce14bcffd5f903d7a7a571d409b5b2a4316575f730c
MD5 b2a13f0d62c70cc252f291be7abd7ad4
SHA1 441b11bb2e4ccd1b3ad5ffc0606164c793ea42a5
SHA512 05981cbd2982281f70bb91a48920c598da8aa6622ae765649c32aaa9286262f0a1728355e39b59729a6b2e3f283b344ba04ea8a80cdc0def633d31198d30b720
SSDEEP 1536:V+6/3YrEi5M2gkbOXapo5q3UDmo6YnDFKO7yCGUHFp:8i3YrEii2gkbO+UDmGn5KO7NHFp
TLSH
T12E535D287BE64015F1BFAFB11EF57253D67AF72319029A5F14C9028B1623A84CD817F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V7.4

ttexrmc3ba.localto.net:7002:1488

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2900-1-0x00000000003C0000-0x00000000003D6000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5756	powershell.exe
1848	powershell.exe
5080	powershell.exe
2212	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xeno.lnk	54db77d001f909ea7ce02ce14bcffd5f903d7a7a571d409b5b2a4316575f730c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xeno.lnk	54db77d001f909ea7ce02ce14bcffd5f903d7a7a571d409b5b2a4316575f730c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1848	powershell.exe
1848	powershell.exe
5080	powershell.exe
5080	powershell.exe
2212	powershell.exe
2212	powershell.exe
5756	powershell.exe
5756	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2900	54db77d001f909ea7ce02ce14bcffd5f903d7a7a571d409b5b2a4316575f730c.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeIncreaseQuotaPrivilege	1848	powershell.exe
Token: SeSecurityPrivilege	1848	powershell.exe
Token: SeTakeOwnershipPrivilege	1848	powershell.exe
Token: SeLoadDriverPrivilege	1848	powershell.exe
Token: SeSystemProfilePrivilege	1848	powershell.exe
Token: SeSystemtimePrivilege	1848	powershell.exe
Token: SeProfSingleProcessPrivilege	1848	powershell.exe
Token: SeIncBasePriorityPrivilege	1848	powershell.exe
Token: SeCreatePagefilePrivilege	1848	powershell.exe
Token: SeBackupPrivilege	1848	powershell.exe
Token: SeRestorePrivilege	1848	powershell.exe
Token: SeShutdownPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeSystemEnvironmentPrivilege	1848	powershell.exe
Token: SeRemoteShutdownPrivilege	1848	powershell.exe
Token: SeUndockPrivilege	1848	powershell.exe
Token: SeManageVolumePrivilege	1848	powershell.exe
Token: 33	1848	powershell.exe
Token: 34	1848	powershell.exe
Token: 35	1848	powershell.exe
Token: 36	1848	powershell.exe
Token: SeDebugPrivilege	5080	powershell.exe
Token: SeIncreaseQuotaPrivilege	5080	powershell.exe
Token: SeSecurityPrivilege	5080	powershell.exe
Token: SeTakeOwnershipPrivilege	5080	powershell.exe
Token: SeLoadDriverPrivilege	5080	powershell.exe
Token: SeSystemProfilePrivilege	5080	powershell.exe
Token: SeSystemtimePrivilege	5080	powershell.exe
Token: SeProfSingleProcessPrivilege	5080	powershell.exe
Token: SeIncBasePriorityPrivilege	5080	powershell.exe
Token: SeCreatePagefilePrivilege	5080	powershell.exe
Token: SeBackupPrivilege	5080	powershell.exe
Token: SeRestorePrivilege	5080	powershell.exe
Token: SeShutdownPrivilege	5080	powershell.exe
Token: SeDebugPrivilege	5080	powershell.exe
Token: SeSystemEnvironmentPrivilege	5080	powershell.exe
Token: SeRemoteShutdownPrivilege	5080	powershell.exe
Token: SeUndockPrivilege	5080	powershell.exe
Token: SeManageVolumePrivilege	5080	powershell.exe
Token: 33	5080	powershell.exe
Token: 34	5080	powershell.exe
Token: 35	5080	powershell.exe
Token: 36	5080	powershell.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeIncreaseQuotaPrivilege	2212	powershell.exe
Token: SeSecurityPrivilege	2212	powershell.exe
Token: SeTakeOwnershipPrivilege	2212	powershell.exe
Token: SeLoadDriverPrivilege	2212	powershell.exe
Token: SeSystemProfilePrivilege	2212	powershell.exe
Token: SeSystemtimePrivilege	2212	powershell.exe
Token: SeProfSingleProcessPrivilege	2212	powershell.exe
Token: SeIncBasePriorityPrivilege	2212	powershell.exe
Token: SeCreatePagefilePrivilege	2212	powershell.exe
Token: SeBackupPrivilege	2212	powershell.exe
Token: SeRestorePrivilege	2212	powershell.exe
Token: SeShutdownPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeSystemEnvironmentPrivilege	2212	powershell.exe
Token: SeRemoteShutdownPrivilege	2212	powershell.exe
Token: SeUndockPrivilege	2212	powershell.exe
Token: SeManageVolumePrivilege	2212	powershell.exe
Token: 33	2212	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 1848	2900	54db77d001f909ea7ce02ce14bcffd5f903d7a7a571d409b5b2a4316575f730c.exe	89
PID 2900 wrote to memory of 5080	2900	54db77d001f909ea7ce02ce14bcffd5f903d7a7a571d409b5b2a4316575f730c.exe	92
PID 2900 wrote to memory of 2212	2900	54db77d001f909ea7ce02ce14bcffd5f903d7a7a571d409b5b2a4316575f730c.exe	94
PID 2900 wrote to memory of 5756	2900	54db77d001f909ea7ce02ce14bcffd5f903d7a7a571d409b5b2a4316575f730c.exe	96

C:\Users\Admin\AppData\Local\Temp\54db77d001f909ea7ce02ce14bcffd5f903d7a7a571d409b5b2a4316575f730c.exe
"C:\Users\Admin\AppData\Local\Temp\54db77d001f909ea7ce02ce14bcffd5f903d7a7a571d409b5b2a4316575f730c.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\54db77d001f909ea7ce02ce14bcffd5f903d7a7a571d409b5b2a4316575f730c.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '54db77d001f909ea7ce02ce14bcffd5f903d7a7a571d409b5b2a4316575f730c.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Xeno'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Xeno'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 168454fbd10bd6c316787e0630eccd8473426abab36526d9269a91f4bb86727e
MD5 63a0f9f2a7e2c55eb05bb487e7ce4d25
SHA1 732a481a3ae95a8a8a9c8965aacfcabf02069428
SHA512 f1c582b60867619dcdd3d3cc6283a8bce08695d14461445f63c3fe31d28f2afcab5ca4e0b7a659cee7f0439f336d654570548778d5690469daf050aa24e27f82
TLSH
T163214633F3DD8655C899413A10CEAC1036BB87DB409E8E9B6B84D559A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 120f661670b9c9bcef6fa45b38c693ea6166a266146df31d722eb6ed8a06b221
MD5 220d7629912a8fecde10014b46c1efba
SHA1 e041e3f3af622f37660165e7b68741875f7ec838
SHA512 9c5658995eea147b95774e8f0acb6eeba2cd715887b6fa497d0c82a154078ffc93356983fb8902fb00383745255939d0e874a4a0c7d38f2857882d0155bf8624
TLSH
T1B4216833F3DD8624D89A413A10CDAC1036B6C7DB41DFCFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_epkcjg4n.pcb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_epkcjg4n.pcb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1848-7-0x0000016DA59D0000-0x0000016DA59F2000-memory.dmp

Download

memory/1848-17-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/1848-6-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/1848-25-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/1848-11-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/1848-10-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/1848-12-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/1848-13-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/1848-14-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/1848-16-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/1848-15-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/1848-5-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/1848-20-0x0000016DA5C60000-0x0000016DA5C7E000-memory.dmp

Download

memory/1848-21-0x0000016DA5C80000-0x0000016DA5D32000-memory.dmp

Download

memory/1848-22-0x0000016DA5A40000-0x0000016DA5A4A000-memory.dmp

Download

memory/1848-24-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/2900-0-0x00007FF8CFE3F000-0x00007FF8CFE40000-memory.dmp

Download

memory/2900-4-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/2900-3-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/2900-2-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/2900-1-0x00000000003C0000-0x00000000003D6000-memory.dmp

Download

memory/2900-47-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/2900-48-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/2900-49-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download