xworm | 5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe
Size 712KB
Sample260810-jabyjstdqd
SHA256 5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a
MD5 a7c87913f2ed0c8e17525cf94d4556b1
SHA1 df32c8c1632504de7701cb0fda53ec9aea74642d
SHA512 84c57c76a9c5885f556854a5a86305313b108e58f676cf2165faee9f6114a251ca8e1cd44f841a0d82db3c5e684cd314c66a3cab315c6d0c1bafbe226931175e
SSDEEP 12288:Fx2iNNeRPA6/OxTB09BBR8mHOFidDtS8wgeO4Pe+hU2KrGuLPXXW2gBBkR:Fx1n+NYTi9BX8mrRZwvPHiXrnPNgBc
TLSH
T16DF412A75A19CB43D9E18BF12E73D73147B86D9DE450D35B8EEA5DCF3810714A80822B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V6.4

sharjahaquarium.com:6000

Mutex

uDcmtKH6KKEtSR4n

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2128-24-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5188	powershell.exe
3684	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4508	ioGQIrRzAKLi.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/1696-9-0x00000000089C0000-0x00000000089CE000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1696 set thread context of 2128	1696	5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe	95
PID 4508 set thread context of 4324	4508	ioGQIrRzAKLi.exe	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ioGQIrRzAKLi.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1432	schtasks.exe
4620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1696	5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe
5188	powershell.exe
1696	5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe
1696	5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe
1696	5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe
5188	powershell.exe
2128	RegSvcs.exe
4508	ioGQIrRzAKLi.exe
4508	ioGQIrRzAKLi.exe
4508	ioGQIrRzAKLi.exe
3684	powershell.exe
3684	powershell.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	1696	5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe
Token: SeDebugPrivilege	5188	powershell.exe
Token: SeDebugPrivilege	2128	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	5188	powershell.exe
Token: SeSecurityPrivilege	5188	powershell.exe
Token: SeTakeOwnershipPrivilege	5188	powershell.exe
Token: SeLoadDriverPrivilege	5188	powershell.exe
Token: SeSystemProfilePrivilege	5188	powershell.exe
Token: SeSystemtimePrivilege	5188	powershell.exe
Token: SeProfSingleProcessPrivilege	5188	powershell.exe
Token: SeIncBasePriorityPrivilege	5188	powershell.exe
Token: SeCreatePagefilePrivilege	5188	powershell.exe
Token: SeBackupPrivilege	5188	powershell.exe
Token: SeRestorePrivilege	5188	powershell.exe
Token: SeShutdownPrivilege	5188	powershell.exe
Token: SeDebugPrivilege	5188	powershell.exe
Token: SeSystemEnvironmentPrivilege	5188	powershell.exe
Token: SeRemoteShutdownPrivilege	5188	powershell.exe
Token: SeUndockPrivilege	5188	powershell.exe
Token: SeManageVolumePrivilege	5188	powershell.exe
Token: 33	5188	powershell.exe
Token: 34	5188	powershell.exe
Token: 35	5188	powershell.exe
Token: 36	5188	powershell.exe
Token: SeDebugPrivilege	4508	ioGQIrRzAKLi.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	4324	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	3684	powershell.exe
Token: SeSecurityPrivilege	3684	powershell.exe
Token: SeTakeOwnershipPrivilege	3684	powershell.exe
Token: SeLoadDriverPrivilege	3684	powershell.exe
Token: SeSystemProfilePrivilege	3684	powershell.exe
Token: SeSystemtimePrivilege	3684	powershell.exe
Token: SeProfSingleProcessPrivilege	3684	powershell.exe
Token: SeIncBasePriorityPrivilege	3684	powershell.exe
Token: SeCreatePagefilePrivilege	3684	powershell.exe
Token: SeBackupPrivilege	3684	powershell.exe
Token: SeRestorePrivilege	3684	powershell.exe
Token: SeShutdownPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeSystemEnvironmentPrivilege	3684	powershell.exe
Token: SeRemoteShutdownPrivilege	3684	powershell.exe
Token: SeUndockPrivilege	3684	powershell.exe
Token: SeManageVolumePrivilege	3684	powershell.exe
Token: 33	3684	powershell.exe
Token: 34	3684	powershell.exe
Token: 35	3684	powershell.exe
Token: 36	3684	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2128	RegSvcs.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 5188	1696	5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe	89
PID 1696 wrote to memory of 1432	1696	5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe	91
PID 1696 wrote to memory of 1992	1696	5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe	94
PID 1696 wrote to memory of 2128	1696	5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe	95
PID 1696 wrote to memory of 2128	1696	5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe	95
PID 1696 wrote to memory of 2128	1696	5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe	95
PID 1696 wrote to memory of 2128	1696	5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe	95
PID 1696 wrote to memory of 2128	1696	5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe	95
PID 4508 wrote to memory of 3684	4508	ioGQIrRzAKLi.exe	99
PID 4508 wrote to memory of 4620	4508	ioGQIrRzAKLi.exe	101
PID 4508 wrote to memory of 4324	4508	ioGQIrRzAKLi.exe	103
PID 4508 wrote to memory of 4324	4508	ioGQIrRzAKLi.exe	103
PID 4508 wrote to memory of 4324	4508	ioGQIrRzAKLi.exe	103
PID 4508 wrote to memory of 4324	4508	ioGQIrRzAKLi.exe	103
PID 4508 wrote to memory of 4324	4508	ioGQIrRzAKLi.exe	103

C:\Users\Admin\AppData\Local\Temp\5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe
"C:\Users\Admin\AppData\Local\Temp\5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ioGQIrRzAKLi.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5188
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ioGQIrRzAKLi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4DB9.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1992
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2128

C:\Users\Admin\AppData\Roaming\ioGQIrRzAKLi.exe
C:\Users\Admin\AppData\Roaming\ioGQIrRzAKLi.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ioGQIrRzAKLi.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3684
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ioGQIrRzAKLi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9A81.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 d2f251c214d51f7a670dde20ca9d750ecf4d7a55ccf582fa6c1d77451e4ee163
MD5 dda70ccabda0bc5cb326171e5230e3d6
SHA1 0dc9ae039cab29908600010de5abf86d780b0ece
SHA512 d2f1a475682160482da9fa96aceed12143c38da4d52170d27cf3fc1d17b9cde2b6232e754638f10ed36f65be13f9232a576f92aa16446727162238bd382e6bc6
SSDEEP 384:h8mboT1iBGyGW14bP+98ePzoSe7rr2PnNIAXr4B+lWoqtzKwcvYbhNaPIWRtLZRK:70Z6GpWi7+8e8T6lIAXrq+aVTbhNaPRE
TLSH
T1CAA2B478213F6DC7D8D216B010D20AF7FBE4D489DAB65198BF1BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3nfswhjv.2fa.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3nfswhjv.2fa.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmp4DB9.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4DB9.tmp
Size 1KB
SHA256 76bf1eb4080c622e975888722d1523592589c1083d85676197ebc974ec8f4712
MD5 451b65f546a8ce0adcb0ceb74e995b32
SHA1 37eee027cc9000de28a30322f06b94c2ba84ef00
SHA512 33204b1c14f7d2595c9e9f132c6cab3daac81d08fde7c4339d15c24a7c846fd17fa6403314cb92ccb3901ac65f75b4943237cc8b6efb2a4e9990bcc201cd8692
TLSH
T1ED311064D8F0F75BB5530229935166835F758BB745614039F8CC0A7C7F8A686205363B
MD5 SHA1 SHA512 TLSH

Submit Download

ioGQIrRzAKLi.exe

Path C:\Users\Admin\AppData\Roaming\ioGQIrRzAKLi.exe
Size 712KB
SHA256 5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a
MD5 a7c87913f2ed0c8e17525cf94d4556b1
SHA1 df32c8c1632504de7701cb0fda53ec9aea74642d
SHA512 84c57c76a9c5885f556854a5a86305313b108e58f676cf2165faee9f6114a251ca8e1cd44f841a0d82db3c5e684cd314c66a3cab315c6d0c1bafbe226931175e
SSDEEP 12288:Fx2iNNeRPA6/OxTB09BBR8mHOFidDtS8wgeO4Pe+hU2KrGuLPXXW2gBBkR:Fx1n+NYTi9BX8mrRZwvPHiXrnPNgBc
TLSH
T16DF412A75A19CB43D9E18BF12E73D73147B86D9DE450D35B8EEA5DCF3810714A80822B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1696-6-0x00000000084E0000-0x000000000883B000-memory.dmp

Download

memory/1696-13-0x0000000008D70000-0x0000000008E0C000-memory.dmp

Download

memory/1696-4-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/1696-7-0x00000000088A0000-0x00000000088BE000-memory.dmp

Download

memory/1696-8-0x00000000088F0000-0x0000000008912000-memory.dmp

Download

memory/1696-9-0x00000000089C0000-0x00000000089CE000-memory.dmp

Download

memory/1696-10-0x00000000749E2000-0x00000000749E3000-memory.dmp

Download

memory/1696-11-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/1696-12-0x0000000008E90000-0x0000000008EE4000-memory.dmp

Download

memory/1696-5-0x00000000059A0000-0x00000000059AA000-memory.dmp

Download

memory/1696-1-0x0000000000DC0000-0x0000000000E74000-memory.dmp

Download

memory/1696-25-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/1696-3-0x0000000005A70000-0x0000000005B02000-memory.dmp

Download

memory/1696-0-0x00000000749E2000-0x00000000749E3000-memory.dmp

Download

memory/1696-2-0x0000000006030000-0x00000000065EA000-memory.dmp

Download

memory/2128-24-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3684-46-0x0000000005760000-0x0000000005ABB000-memory.dmp

Download

memory/3684-48-0x0000000005C80000-0x0000000005CCC000-memory.dmp

Download

memory/3684-49-0x0000000070EC0000-0x0000000070F0C000-memory.dmp

Download

memory/3684-52-0x0000000006E30000-0x0000000006ED3000-memory.dmp

Download

memory/5188-23-0x0000000005880000-0x00000000058E6000-memory.dmp

Download

memory/5188-27-0x0000000005DE0000-0x0000000005E2C000-memory.dmp

Download

memory/5188-29-0x0000000006F30000-0x0000000006F66000-memory.dmp

Download

memory/5188-30-0x00000000752B0000-0x00000000752FC000-memory.dmp

Download

memory/5188-33-0x0000000006F70000-0x0000000006F90000-memory.dmp

Download

memory/5188-34-0x0000000006F90000-0x0000000007033000-memory.dmp

Download

memory/5188-35-0x0000000007730000-0x0000000007DAC000-memory.dmp

Download

memory/5188-36-0x00000000070F0000-0x000000000710A000-memory.dmp

Download

memory/5188-37-0x0000000007160000-0x000000000716A000-memory.dmp

Download

memory/5188-38-0x0000000007360000-0x00000000073F6000-memory.dmp

Download

memory/5188-40-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/5188-26-0x0000000005DB0000-0x0000000005DCE000-memory.dmp

Download

memory/5188-22-0x0000000005940000-0x00000000059A6000-memory.dmp

Download

memory/5188-18-0x0000000005090000-0x00000000056DA000-memory.dmp

Download

memory/5188-19-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/5188-16-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/5188-15-0x00000000048A0000-0x00000000048D6000-memory.dmp

Download