xworm | 74f12634a686e5646b9c11fdbc319231a4958309a146696c0aec28ef205f85b5

Analysis

max time kernel
179s
max time network
181s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74f12634a686e5646b9c11fdbc319231a4958309a146696c0aec28ef205f85b5.js
Size 127KB
Sample260806-1z13eabl2w
SHA256 74f12634a686e5646b9c11fdbc319231a4958309a146696c0aec28ef205f85b5
MD5 5a9436a28451bfd6ffacd698306fd9ec
SHA1 2b62b938b3b4446094aa7c823638adc2fd9d3c61
SHA512 d3a3626be0bc16e3b7be8d91981c205afa33ca38a489aae9b071acc8eb32b8d064355326849ac9d229fb494a94c7f73c381f699763eb08f00158f55c5765b833
SSDEEP 3072:xGWlD22EPS0rQIvcvn7xRAh2PKkScPGLZZXXyxdysY6td:lgnUJn7bAAymgZZXQW6td
TLSH
T1FDD3AE46E966C2E4F8A9C30C6915120677F00FBB03CBA5BA9F34FC146AD56538F0B6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm rat trojan

Malware Config

Extracted

Family

xworm

cristiancaballero501020.duckdns.org:1177

Mutex

sFqfygs7xZudt56V

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5236-30-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6124	3068	powershell.exe	79

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6124 set thread context of 5236	6124	powershell.exe	94

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6124	powershell.exe
6124	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6124	powershell.exe
Token: SeDebugPrivilege	5236	CasPol.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 3504	6124	powershell.exe	92
PID 3504 wrote to memory of 4796	3504	csc.exe	93
PID 6124 wrote to memory of 5236	6124	powershell.exe	94
PID 6124 wrote to memory of 5236	6124	powershell.exe	94
PID 6124 wrote to memory of 5236	6124	powershell.exe	94
PID 6124 wrote to memory of 5236	6124	powershell.exe	94
PID 6124 wrote to memory of 5236	6124	powershell.exe	94

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\74f12634a686e5646b9c11fdbc319231a4958309a146696c0aec28ef205f85b5.js
1⤵
PID:1608

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -w 1 -nop -ex unrestricted -f "C:\Users\Admin\AppData\Local\Temp\svc_67193_b301.ps1"
1⤵
- Process spawned unexpected child process
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ofcbjuds\ofcbjuds.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9AA0.tmp" "c:\Users\Admin\AppData\Local\Temp\ofcbjuds\CSCC9642AC24E5846DABC84D9AB9122D1E5.TMP"
    3⤵
    PID:4796
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES9AA0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9AA0.tmp
Size 1KB
SHA256 56026a7f27e9f8a21c51eb6b6235508053d5e5ec216ffae47fd1704085723b58
MD5 d05f88d65daa59803c0148df8fcce31a
SHA1 c3183cc3695b0f3d7f9f38c4cf3adabdb16ed4e1
SHA512 7b2da3b83a919db2453c9009b52888f5f09157e09f0d866b4c5155c58fcd6a3bbf420825993ffbaa8ea949a413ce72e424ca9c9266c326687409ac26a723bb24
TLSH
T19121AF0547F94B1FF0B75B31A8F6036FA674FD64EF62935A848042282C51604EFA0A72
MD5 SHA1 SHA512 TLSH

Submit Download

ofcbjuds.dll

Path C:\Users\Admin\AppData\Local\Temp\ofcbjuds\ofcbjuds.dll
Size 5KB
SHA256 4baad5f451cff0ad1f333e4df9bce5760d1377a53cb41e4fc9b6a790da415ac3
MD5 eaa34a2c55a2fcc98fe4d3ec19090a5d
SHA1 1cb2d7671926904f9bd355650116c32cf8ba1ab0
SHA512 10d46f62cb73e4e26fd382b95855d1e5189ceb422f0133e54ece3233456032f273eb7418a201d61d3867698ee808177d58e27040cfa1984f95f873c6d6367caf
SSDEEP 48:6gQ+1lQYtA/gnJjjMxmcdBFGg4z6gWWKzB2RRmmIfib1gbmgDngdJipjBfEoG1up:bIY1nJjgFiKzBkKrvfEEeK
TLSH
T1F7B1730697DC1693E4BB033DBCB30B06E7B5E4544B6BC76F49D4402A2CA7F641961BB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_67193_b301.ps1

Path C:\Users\Admin\AppData\Local\Temp\svc_67193_b301.ps1
Size 52KB
SHA256 2c2f4166c18b1e9478f8dd2ca85072c60ca413d063871d262118211208a41274
MD5 06f8ce2f7e5d0c4fcded17157d621c30
SHA1 6075c93dd0dd43ec266fd6fd61b2634d182e92a5
SHA512 aa0bec4bad01383735bf77d4008186e0bcd32ed00e0475f145729d8e7a5a396a5ec829db9bf63229f8f25afd8abcd2d28d9c5b9d09d3bd4b6895aecff4dc4aea
SSDEEP 768:vzGf8abKpd0LRNIntvG+lB4B3tTgtlADyNzCcAjzWJhLgVnRN:vzGf8abKpd0Ls4ay3p+6DVcA+JhcPN
TLSH
T1D333AF30764F0562CAFB0B15DEA5FA4AE56230370EF99D1534BEE1902F3704EA069E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCC9642AC24E5846DABC84D9AB9122D1E5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ofcbjuds\CSCC9642AC24E5846DABC84D9AB9122D1E5.TMP
Size 652B
SHA256 2bd8164dea5366344ccf98793c43b098825ab61ca5f8c29d135f9fca1c4a4d6b
MD5 dd2ad0a3fde99a8aea511e13fa5f7859
SHA1 d8acba89dac4c6dd47de39ff8e98e6f2bb5f6c2d
SHA512 b7d47d6a94bf0a6f6338e6c4f732d628741349c8ee65ba4b4374508a6e76f246e3ad858155841cf77b4160dd2305f1024a9e33b7a770cf5a2abca85a09935fd5
TLSH
T134F05E0963F8520EF0F34F30BDF643A3A5A9BC65EE32A3ED544043592C64A109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ofcbjuds.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ofcbjuds\ofcbjuds.0.cs
Size 3KB
SHA256 bc5d5fe5696ac168ad0cbd7d3348e475d27744570ed085f2ef663c88e03ce620
MD5 1533066361afbccbc91fab713679a4b9
SHA1 ccc3b26bb80aa19a055ef0623d3a5c48598dbd40
SHA512 2028332b95542f76974d7b86426f174b0d560e43ae29982f89cbae65b0e445e35e9224a2dd26911e047bb662b326648196fa63a8989345501c86450099c01bef
TLSH
T1BD61EF3C1316976258B32125FA9190CEE70310731ABF592039FD97222F7B15AE176F1E
MD5 SHA1 SHA512 TLSH

Submit Download

ofcbjuds.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ofcbjuds\ofcbjuds.cmdline
Size 369B
SHA256 e27bb633ac24eed33aa2bc5cb68c69d68deedef4175f4e98cb3162d18dfa1dac
MD5 eabd851290f7bd2e8474df1f4374b1f3
SHA1 1be6dafaeaaa9974d5db06fe2c4b8e74279c9c18
SHA512 7fe01500d3061583528d855350ada348e4c70ee3044c91e82ae55a88e6ae48a11519c051f3c92e685c77b8029262815b5a2f264d19bf8b4659c74059c30017f1
TLSH
T160E0682A5B76C3BD01FA11172179C4AD9272078729403F84F484C80DD0578002BE1761
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5236-33-0x0000000005970000-0x0000000005A0C000-memory.dmp

Download

memory/5236-30-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/6124-7-0x00000000057E0000-0x0000000005846000-memory.dmp

Download

memory/6124-5-0x00000000749E0000-0x000000007519C000-memory.dmp

Download

memory/6124-13-0x0000000005F20000-0x0000000005F6C000-memory.dmp

Download

memory/6124-11-0x0000000005940000-0x0000000005C9B000-memory.dmp

Download

memory/6124-15-0x00000000077F0000-0x0000000007E6C000-memory.dmp

Download

memory/6124-16-0x0000000006410000-0x000000000642A000-memory.dmp

Download

memory/6124-8-0x0000000005850000-0x00000000058B6000-memory.dmp

Download

memory/6124-1-0x00000000749F2000-0x00000000749F3000-memory.dmp

Download

memory/6124-6-0x00000000050B0000-0x00000000050D2000-memory.dmp

Download

memory/6124-12-0x0000000005EA0000-0x0000000005EBE000-memory.dmp

Download

memory/6124-4-0x00000000749E0000-0x000000007519C000-memory.dmp

Download

memory/6124-29-0x0000000006470000-0x0000000006478000-memory.dmp

Download

memory/6124-3-0x0000000005190000-0x00000000057DA000-memory.dmp

Download

memory/6124-31-0x0000000007170000-0x0000000007206000-memory.dmp

Download

memory/6124-2-0x0000000002980000-0x00000000029B6000-memory.dmp

Download

memory/6124-32-0x0000000006F00000-0x0000000006F22000-memory.dmp

Download

memory/6124-34-0x0000000007E70000-0x000000000842A000-memory.dmp

Download

memory/6124-36-0x00000000749E0000-0x000000007519C000-memory.dmp

Download