xworm | d1125afe620892cf2985569a4ba2188e7514fdc5c07c1f9afa9647bf1e0d2635

Analysis

user interaction
yes
max time kernel
23s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
newui.exe
Size 158KB
Sample260810-rrfbasbk41
SHA256 d1125afe620892cf2985569a4ba2188e7514fdc5c07c1f9afa9647bf1e0d2635
MD5 86c34006a8599e5660ba19950b692c92
SHA1 b18c71df1e4354c64c0473cb446203217824a766
SHA512 5634e6c15f68465e96898dda57036b0f4433c52da5183263c190c5e9e960b674838b3a0ea180829b47125f254b6b92bea6f6bf0481c23329a31e3346105d4d41
SSDEEP 3072:v+/wxZEc38xErjPXIEFkT4AAj7Wj0gsMkJ+aQIR4mT1upPDmvEnhlpNjX4A:v+/wT8xkDIWkT4hFDMkJ+zQ0PDmvEhlz
TLSH
T14DF3F1A45EA88663D606943F9A523A4764FD1B875F322E0901B4F76F062DEECCFD2131
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V5.2

catdogfree300-43400.portmap.host:43400

Attributes

Install_directory
%AppData%
install_file
smartscreen.exe

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000f00000001c4df-14.dat	family_xworm
behavioral1/memory/4308-23-0x0000000000250000-0x0000000000264000-memory.dmp	family_xworm

Executes dropped EXE 2 IoCs

pid	Process
832	newui.exe
4308	DrivrUpdt.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	ip-api.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3364	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4124	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newui.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3364	powershell.exe
3364	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4308	DrivrUpdt.exe
Token: SeDebugPrivilege	3364	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 832	4372	newui.exe	88
PID 832 wrote to memory of 4124	832	newui.exe	90
PID 4372 wrote to memory of 4308	4372	newui.exe	91
PID 4124 wrote to memory of 3364	4124	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\newui.exe
"C:\Users\Admin\AppData\Local\Temp\newui.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Roaming\newui.exe
  "C:\Users\Admin\AppData\Roaming\newui.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1CB6.tmp\1CB7.tmp\1CB8.bat C:\Users\Admin\AppData\Roaming\newui.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$date = (Get-Date).AddHours(-6).ToString('MMM d yyyy HH:mm:ss'); Write-Host 'Successfully loaded library' -ForegroundColor White; Start-Sleep -Seconds 1; Write-Host '[loader] Downloading update...' -ForegroundColor Cyan; Start-Sleep -Seconds 1; Write-Host '[loader] Download progress: 100% (25621504/25621504 bytes)' -ForegroundColor Cyan; Start-Sleep -Seconds 1; Write-Host '[loader] Download completed! Total size: 25621504 bytes' -ForegroundColor Cyan; Start-Sleep -Seconds 1; Write-Host '[loader] Latest patch updated.' -ForegroundColor Cyan; Start-Sleep -Seconds 1; Write-Host ''; Write-Host \"Build : $date\" -ForegroundColor White; Start-Sleep -Seconds 1; Write-Host '[+] Found License : k9xq2f-rm7d4z-3t8wvn-j6p1hs-4cyl0e-b5agku-9n2qxr' -ForegroundColor Green; Start-Sleep -Seconds 1; Write-Host '[!] To enter a new license, delete _license.dat.' -ForegroundColor Yellow; Start-Sleep -Seconds 1; Write-Host ''; Write-Host ''; Write-Host '[Auth] Login Success : Your license is a Lifetime license.' -ForegroundColor Green; Start-Sleep -Seconds 1; Write-Host ''; Write-Host ''; Write-Host '[+] Connect success' -ForegroundColor Green; Start-Sleep -Seconds 1; Write-Host '[+] Finding roblox...' -ForegroundColor Green; while($true) { Start-Sleep -Seconds 60 }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3364
- C:\Users\Admin\AppData\Roaming\DrivrUpdt.exe
  "C:\Users\Admin\AppData\Roaming\DrivrUpdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1CB8.bat

Path C:\Users\Admin\AppData\Local\Temp\1CB6.tmp\1CB7.tmp\1CB8.bat
Size 1KB
SHA256 ce26118f1e330d21f1a9f09fe0acc95129e626a04324b7f928f7798631d3b5e2
MD5 d2eb3aa8046614d6dcac7e10a3254e66
SHA1 3cb80f5a502a229fc86b035423c0a1e75a54be29
SHA512 3625f0bdb436143e82cd7551591ddfbc2b834fd79ab41b01d15f8bdc600c23f4ea5c560507bafb801b356eccaa40d667ac5f96870f1382a0309398ecc5388025
TLSH
T13621493446444D9FDBE3889B56AEA798FE85D434D30F0DC5F1186675D0E64CE412B0B3
MD5 SHA1 SHA512 TLSH

Submit Download

DrivrUpdt.exe

Path C:\Users\Admin\AppData\Roaming\DrivrUpdt.exe
Size 52KB
SHA256 8d0afb07d1c130665bad9a78d03c11ce4403abc8e01150b666f2d49a11d9a5cb
MD5 42d5aee4e7ca5d3488954650754fe6a9
SHA1 b81f4636e94c59669da43311991ec7209fa4241c
SHA512 42360dfcadaf67961c578e65880ea0008952eb9b06d65a888f2bf26a2622af29471f00c753619776e2f656faee65eedee8f96bf1ed9de6d2ba5ea14b5590172c
SSDEEP 768:yUVDmB7IaRePhq1qLJDILJcqG27/bYj8nPIhj6oEoalzO2hlZEOX:yIDQsakPhq1+kRbYgW67zO2BRX
TLSH
T166336C4CB7E00625D5FE6FF858B23212C734B6638D13CA1FA9D9048A3727A9DCA407E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newui.exe

Path C:\Users\Admin\AppData\Roaming\newui.exe
Size 90KB
SHA256 0b1320d2b74faaa5d20f7addd3e4d036c671c0b9de26809c38b2e155513843ea
MD5 6506ca4e7413e0e931ee7af2a519a8d6
SHA1 372bf1650b93374fc273450a3af2f5868ea33612
SHA512 ad090388e432006d6caee06474de70c7b5e53cb3601242779148f49597392d9566d2d8d855befbe0bdcc0ea137aa140301974ad5cc5fb9f8dc7a96353dfa66bd
SSDEEP 1536:z/7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfEw1:zz7DhdC6kzWypvaQ0FxyNTBfEY
TLSH
T17E936C41F3E102F7EAF2053100A6722F973663389724E8DBC75C2E529913AD5A63D3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/832-30-0x0000000000417000-0x0000000000418000-memory.dmp

Download

memory/3364-29-0x0000024869CE0000-0x0000024869D02000-memory.dmp

Download

memory/4308-31-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/4308-26-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/4308-23-0x0000000000250000-0x0000000000264000-memory.dmp

Download

memory/4372-16-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/4372-25-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/4372-24-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/4372-0-0x00007FFDAF6AF000-0x00007FFDAF6B0000-memory.dmp

Download

memory/4372-4-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/4372-3-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/4372-1-0x00000000005B0000-0x00000000005DE000-memory.dmp

Download