xworm | 329b9cfcc633c230f6892141c6a5c584cd1a24d389a495766ff3c93b152451b5

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 08:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Claim Documents.js
Size 1.1MB
Sample260805-j6epbagb59
SHA256 329b9cfcc633c230f6892141c6a5c584cd1a24d389a495766ff3c93b152451b5
MD5 f208f2c5ed2693051e840ac2028496fc
SHA1 06cdf5c0c01d7f4c362380e397c90818a078c8dd
SHA512 6525659d88370c74573ef0400c63c257d4ff561a268dfab91bf0775d154c185efee9281b7b0b0b29f801f24ba36fd70aa7c0779e8956c8be209bfb719f99a6a0
SSDEEP 768:lvJC2vkvmCT8+T8XC2vAvFT82vJvmvmvmvavmvYT8+T8XC2vdC2vAv1vJC2vmvdZ:jB
TLSH
T1C3353F520E43EE03C4ADDAA3DD14C0DCA7B1791AAC8DD226F662CAC8509175CDE9EF71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

31.57.184.10:5050

Mutex

xEDR6B9qT7Kcybd4

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2808-17-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5640	5936	powershell.exe	89

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	5640	powershell.exe
8	5640	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Claim Documents.js	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5640 set thread context of 2808	5640	powershell.exe	92

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5640	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5640	powershell.exe
5640	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5640	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5640 wrote to memory of 2808	5640	powershell.exe	92
PID 5640 wrote to memory of 2808	5640	powershell.exe	92
PID 5640 wrote to memory of 2808	5640	powershell.exe	92
PID 5640 wrote to memory of 2808	5640	powershell.exe	92
PID 5640 wrote to memory of 2808	5640	powershell.exe	92

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Claim Documents.js"
1⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:4244

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Invoke-Expression $env:defensives"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2808-17-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/5640-10-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/5640-12-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/5640-5-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/5640-6-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/5640-7-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/5640-8-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/5640-3-0x000001DB7AC70000-0x000001DB7AC92000-memory.dmp

Download

memory/5640-9-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/5640-11-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/5640-0-0x00007FFCF573F000-0x00007FFCF5740000-memory.dmp

Download

memory/5640-13-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/5640-14-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/5640-15-0x000001DB7B010000-0x000001DB7B0A2000-memory.dmp

Download

memory/5640-16-0x000001DB7B0A0000-0x000001DB7B0AA000-memory.dmp

Download

memory/5640-4-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/5640-19-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download