xworm | a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe
Size 912KB
Sample260810-rf92jaar41
SHA256 a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f
MD5 fee6805fb73267fafdb82d761619ce01
SHA1 839aa76c931130539d167cca5e70770e72fe601b
SHA512 dafceacab5d200a5c90c864e7050060a0acc04d388f3e6eead6faa13900ecf2c69f255ea28cd6602fb2acb1bd6091dee983606d5d953759f117c77539d87a0ca
SSDEEP 24576:gFUjR6pFsRrXHAaD7Xda+46vNeVzjoxd/6/ASmyDa:ttimRzPD7ta+4cNedoxd/+ASHa
TLSH
T116150255231ACC02C6936FF15EB0E37504B99D88B911D3338EFABDABB86E7826D111D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5400-12-0x0000000000400000-0x000000000041C000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3096	powershell.exe

Executes dropped EXE 9 IoCs

pid	Process
5928	AxKGLDb.exe
1768	windows32s.exe
6336	windows32s.exe
7116	AxKGLDb.exe
728	windows32s.exe
4824	windows32s.exe
1196	windows32s.exe
1460	windows32s.exe
3492	windows32s.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\AxKGLDb = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\zsx2o2sjihk.ps1\""	a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 52 set thread context of 5400	52	a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe	89
PID 5928 set thread context of 7116	5928	AxKGLDb.exe	99
PID 1768 set thread context of 728	1768	windows32s.exe	100
PID 6336 set thread context of 4824	6336	windows32s.exe	101
PID 1196 set thread context of 3492	1196	windows32s.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows32s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows32s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows32s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows32s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows32s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AxKGLDb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows32s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AxKGLDb.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
52	a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe
52	a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe
3096	powershell.exe
3096	powershell.exe
3096	powershell.exe
5928	AxKGLDb.exe
5928	AxKGLDb.exe
5928	AxKGLDb.exe
1768	windows32s.exe
1768	windows32s.exe
1768	windows32s.exe
6336	windows32s.exe
6336	windows32s.exe
1196	windows32s.exe
1196	windows32s.exe
1196	windows32s.exe
1196	windows32s.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	52	a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe
Token: SeDebugPrivilege	5400	a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe
Token: SeDebugPrivilege	3096	powershell.exe
Token: SeDebugPrivilege	5928	AxKGLDb.exe
Token: SeDebugPrivilege	7116	AxKGLDb.exe
Token: SeDebugPrivilege	1768	windows32s.exe
Token: SeDebugPrivilege	728	windows32s.exe
Token: SeDebugPrivilege	6336	windows32s.exe
Token: SeDebugPrivilege	4824	windows32s.exe
Token: SeDebugPrivilege	1196	windows32s.exe
Token: SeDebugPrivilege	3492	windows32s.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 52 wrote to memory of 5400	52	a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe	89
PID 52 wrote to memory of 5400	52	a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe	89
PID 52 wrote to memory of 5400	52	a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe	89
PID 52 wrote to memory of 5400	52	a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe	89
PID 52 wrote to memory of 5400	52	a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe	89
PID 3096 wrote to memory of 5928	3096	powershell.exe	92
PID 5400 wrote to memory of 1608	5400	a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe	93
PID 5928 wrote to memory of 7116	5928	AxKGLDb.exe	99
PID 5928 wrote to memory of 7116	5928	AxKGLDb.exe	99
PID 5928 wrote to memory of 7116	5928	AxKGLDb.exe	99
PID 5928 wrote to memory of 7116	5928	AxKGLDb.exe	99
PID 5928 wrote to memory of 7116	5928	AxKGLDb.exe	99
PID 1768 wrote to memory of 728	1768	windows32s.exe	100
PID 1768 wrote to memory of 728	1768	windows32s.exe	100
PID 1768 wrote to memory of 728	1768	windows32s.exe	100
PID 1768 wrote to memory of 728	1768	windows32s.exe	100
PID 1768 wrote to memory of 728	1768	windows32s.exe	100
PID 6336 wrote to memory of 4824	6336	windows32s.exe	101
PID 6336 wrote to memory of 4824	6336	windows32s.exe	101
PID 6336 wrote to memory of 4824	6336	windows32s.exe	101
PID 6336 wrote to memory of 4824	6336	windows32s.exe	101
PID 6336 wrote to memory of 4824	6336	windows32s.exe	101
PID 1196 wrote to memory of 1460	1196	windows32s.exe	103
PID 1196 wrote to memory of 3492	1196	windows32s.exe	104
PID 1196 wrote to memory of 3492	1196	windows32s.exe	104
PID 1196 wrote to memory of 3492	1196	windows32s.exe	104
PID 1196 wrote to memory of 3492	1196	windows32s.exe	104
PID 1196 wrote to memory of 3492	1196	windows32s.exe	104

C:\Users\Admin\AppData\Local\Temp\a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe
"C:\Users\Admin\AppData\Local\Temp\a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:52
- C:\Users\Admin\AppData\Local\Temp\a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe
  "C:\Users\Admin\AppData\Local\Temp\a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5400
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "windows32s" /tr "C:\Users\Admin\AppData\Roaming\windows32s.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1608

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\zsx2o2sjihk.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Users\Admin\AppData\Roaming\AxKGLDb.exe
  "C:\Users\Admin\AppData\Roaming\AxKGLDb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5928
- - C:\Users\Admin\AppData\Roaming\AxKGLDb.exe
    "C:\Users\Admin\AppData\Roaming\AxKGLDb.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:7116

C:\Users\Admin\AppData\Roaming\windows32s.exe
C:\Users\Admin\AppData\Roaming\windows32s.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Users\Admin\AppData\Roaming\windows32s.exe
  "C:\Users\Admin\AppData\Roaming\windows32s.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:728

C:\Users\Admin\AppData\Roaming\windows32s.exe
"C:\Users\Admin\AppData\Roaming\windows32s.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6336
- C:\Users\Admin\AppData\Roaming\windows32s.exe
  "C:\Users\Admin\AppData\Roaming\windows32s.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4824

C:\Users\Admin\AppData\Roaming\windows32s.exe
"C:\Users\Admin\AppData\Roaming\windows32s.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Roaming\windows32s.exe
  "C:\Users\Admin\AppData\Roaming\windows32s.exe"
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Users\Admin\AppData\Roaming\windows32s.exe
  "C:\Users\Admin\AppData\Roaming\windows32s.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zsx2o2sjihk.ps1

Path C:\Users\Admin\AppData\Local\Temp\zsx2o2sjihk.ps1
Size 1KB
SHA256 7fde1efe4c0acf50b7d7f920c8337c63b935e24881a5b689433f46c83c8e5d4a
MD5 6f9c92da773eead00ce7a324ddd0d0d0
SHA1 6480890d3381ce89a327a8a9bc62985bf6526fdf
SHA512 351fd92c97238899250dffb07267422dadc9e85be53ba4abd6ded1bc5928749a578cee4d9cc69ba3e3a70c4b6362e718862aa7d71dd4fc8dad523026e1b41612
TLSH
T1B31120078D8953C6002803F14A2374CD742DA0CF5BAF029099ECA5EDB32BE23386ACE4
MD5 SHA1 SHA512 TLSH

Submit Download

AxKGLDb.exe

Path C:\Users\Admin\AppData\Roaming\AxKGLDb.exe
Size 912KB
SHA256 a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f
MD5 fee6805fb73267fafdb82d761619ce01
SHA1 839aa76c931130539d167cca5e70770e72fe601b
SHA512 dafceacab5d200a5c90c864e7050060a0acc04d388f3e6eead6faa13900ecf2c69f255ea28cd6602fb2acb1bd6091dee983606d5d953759f117c77539d87a0ca
SSDEEP 24576:gFUjR6pFsRrXHAaD7Xda+46vNeVzjoxd/6/ASmyDa:ttimRzPD7ta+4cNedoxd/+ASHa
TLSH
T116150255231ACC02C6936FF15EB0E37504B99D88B911D3338EFABDABB86E7826D111D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/52-6-0x0000000074C40000-0x00000000753FC000-memory.dmp

Download

memory/52-3-0x0000000005670000-0x0000000005702000-memory.dmp

Download

memory/52-4-0x0000000005560000-0x000000000556A000-memory.dmp

Download

memory/52-5-0x0000000005710000-0x00000000057AC000-memory.dmp

Download

memory/52-0-0x0000000074C52000-0x0000000074C53000-memory.dmp

Download

memory/52-7-0x0000000005C10000-0x0000000005C32000-memory.dmp

Download

memory/52-8-0x0000000074C52000-0x0000000074C53000-memory.dmp

Download

memory/52-9-0x0000000074C40000-0x00000000753FC000-memory.dmp

Download

memory/52-10-0x0000000007BC0000-0x0000000007C74000-memory.dmp

Download

memory/52-2-0x0000000005C30000-0x00000000061EA000-memory.dmp

Download

memory/52-1-0x0000000000970000-0x0000000000A58000-memory.dmp

Download

memory/52-15-0x0000000074C40000-0x00000000753FC000-memory.dmp

Download

memory/1196-49-0x0000000005420000-0x0000000005442000-memory.dmp

Download

memory/3096-19-0x00007FF854520000-0x00007FF854EC4000-memory.dmp

Download

memory/3096-27-0x00007FF854520000-0x00007FF854EC4000-memory.dmp

Download

memory/3096-20-0x0000014BE0700000-0x0000014BE0722000-memory.dmp

Download

memory/3096-21-0x00007FF854520000-0x00007FF854EC4000-memory.dmp

Download

memory/3096-33-0x00007FF854520000-0x00007FF854EC4000-memory.dmp

Download

memory/3096-24-0x00007FF854520000-0x00007FF854EC4000-memory.dmp

Download

memory/3096-23-0x00007FF854520000-0x00007FF854EC4000-memory.dmp

Download

memory/3096-25-0x00007FF854520000-0x00007FF854EC4000-memory.dmp

Download

memory/3096-26-0x00007FF854520000-0x00007FF854EC4000-memory.dmp

Download

memory/3096-16-0x00007FF8546AF000-0x00007FF8546B0000-memory.dmp

Download

memory/3096-28-0x00007FF854520000-0x00007FF854EC4000-memory.dmp

Download

memory/3096-29-0x00007FF854520000-0x00007FF854EC4000-memory.dmp

Download

memory/3096-30-0x00007FF854520000-0x00007FF854EC4000-memory.dmp

Download

memory/5400-14-0x0000000074C40000-0x00000000753FC000-memory.dmp

Download

memory/5400-13-0x0000000004F30000-0x0000000004F96000-memory.dmp

Download

memory/5400-36-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/5400-39-0x0000000074C40000-0x00000000753FC000-memory.dmp

Download

memory/5400-40-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/5400-12-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5928-35-0x0000000005D90000-0x0000000005DB2000-memory.dmp

Download