xworm | 1e9d4dc066bb20686120d6c4328c23861a098e84257a681b878726b784416a0c

Analysis

max time kernel
6s
max time network
6s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 19:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
V7PV7PV7PV7PV7P.exe
Size 32KB
Sample260812-x53lmstdkb
SHA256 1e9d4dc066bb20686120d6c4328c23861a098e84257a681b878726b784416a0c
MD5 c0684caa7133ad2006518667e6422548
SHA1 d335aa1892c44322d83d4434d948b90208187ea2
SHA512 a4d2320d4003856186e178433725d9a985a95b0495517d9422b06be24df658fb74e50c2ea51e574b32ac757e615efa46cd98f03e418e5a61395f110de1f12c7f
SSDEEP 768:ExC3fOJ5yyXvGFbO752+VFo9jEOjhDbz:ECPOeyX+bO7520Fo9jEOjR/
TLSH
T18AE23C4877E04312C5FEAFF02DF3B10A5675E11B9913EB5E0CD4CA9A2B63AC146907E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

127.0.0..1:50001

Mutex

IK1Rx5NNXEpzyKwP

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/3576-0-0x0000000000A70000-0x0000000000A7E000-memory.dmp	family_xworm

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3576	V7PV7PV7PV7PV7P.exe

C:\Users\Admin\AppData\Local\Temp\V7PV7PV7PV7PV7P.exe
"C:\Users\Admin\AppData\Local\Temp\V7PV7PV7PV7PV7P.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3576-0-0x0000000000A70000-0x0000000000A7E000-memory.dmp

Download

memory/3576-1-0x000000001B710000-0x000000001B720000-memory.dmp