xworm | f07ffac728d40d518724aa62f71d5c71df93915b37bed0d97a2ebb8134347fe7

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_9d1c9c5486381a610bb941ba899ddb67_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 35.9MB
Sample260814-ajprbs1epc
SHA256 f07ffac728d40d518724aa62f71d5c71df93915b37bed0d97a2ebb8134347fe7
MD5 9d1c9c5486381a610bb941ba899ddb67
SHA1 f574a9b4124e0710d1b04863ecfb58d2eaf6e0c7
SHA512 9d64418a61cc033d24185bdb917b7e487cf1b032311b05c9ae31860c0911003c84a245a988605288253892f2baa39902c6ceef4a8a9c35ba048819d1046bdaa2
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfg:fMguj8Q4VfvjqFTrYn
TLSH
T122878B0773E60095E9B7D1388AA65507D773B8638331CBDF329D06152FABAD09A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

Mutex

YoU3NMvZy6ey3l5u

Attributes

Install_directory
%ProgramData%
install_file
svchost.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001b87f-4.dat	family_xworm
behavioral2/memory/6044-6-0x0000000000BA0000-0x0000000000BB0000-memory.dmp	family_xworm

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001b87f-4.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/6044-6-0x0000000000BA0000-0x0000000000BB0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1224	powershell.exe
2372	powershell.exe
3944	powershell.exe
4516	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe

Executes dropped EXE 5 IoCs

pid	Process
6044	svchost.exe
2500	svchost.exe
6016	svchost.exe
1804	svchost.exe
5384	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\ProgramData\\svchost.exe"	svchost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
6	raw.githubusercontent.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5800	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5840	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2372	powershell.exe
2372	powershell.exe
3944	powershell.exe
3944	powershell.exe
4516	powershell.exe
4516	powershell.exe
1224	powershell.exe
1224	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6044	svchost.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeIncreaseQuotaPrivilege	2372	powershell.exe
Token: SeSecurityPrivilege	2372	powershell.exe
Token: SeTakeOwnershipPrivilege	2372	powershell.exe
Token: SeLoadDriverPrivilege	2372	powershell.exe
Token: SeSystemProfilePrivilege	2372	powershell.exe
Token: SeSystemtimePrivilege	2372	powershell.exe
Token: SeProfSingleProcessPrivilege	2372	powershell.exe
Token: SeIncBasePriorityPrivilege	2372	powershell.exe
Token: SeCreatePagefilePrivilege	2372	powershell.exe
Token: SeBackupPrivilege	2372	powershell.exe
Token: SeRestorePrivilege	2372	powershell.exe
Token: SeShutdownPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeSystemEnvironmentPrivilege	2372	powershell.exe
Token: SeRemoteShutdownPrivilege	2372	powershell.exe
Token: SeUndockPrivilege	2372	powershell.exe
Token: SeManageVolumePrivilege	2372	powershell.exe
Token: 33	2372	powershell.exe
Token: 34	2372	powershell.exe
Token: 35	2372	powershell.exe
Token: 36	2372	powershell.exe
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeIncreaseQuotaPrivilege	3944	powershell.exe
Token: SeSecurityPrivilege	3944	powershell.exe
Token: SeTakeOwnershipPrivilege	3944	powershell.exe
Token: SeLoadDriverPrivilege	3944	powershell.exe
Token: SeSystemProfilePrivilege	3944	powershell.exe
Token: SeSystemtimePrivilege	3944	powershell.exe
Token: SeProfSingleProcessPrivilege	3944	powershell.exe
Token: SeIncBasePriorityPrivilege	3944	powershell.exe
Token: SeCreatePagefilePrivilege	3944	powershell.exe
Token: SeBackupPrivilege	3944	powershell.exe
Token: SeRestorePrivilege	3944	powershell.exe
Token: SeShutdownPrivilege	3944	powershell.exe
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeSystemEnvironmentPrivilege	3944	powershell.exe
Token: SeRemoteShutdownPrivilege	3944	powershell.exe
Token: SeUndockPrivilege	3944	powershell.exe
Token: SeManageVolumePrivilege	3944	powershell.exe
Token: 33	3944	powershell.exe
Token: 34	3944	powershell.exe
Token: 35	3944	powershell.exe
Token: 36	3944	powershell.exe
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeIncreaseQuotaPrivilege	4516	powershell.exe
Token: SeSecurityPrivilege	4516	powershell.exe
Token: SeTakeOwnershipPrivilege	4516	powershell.exe
Token: SeLoadDriverPrivilege	4516	powershell.exe
Token: SeSystemProfilePrivilege	4516	powershell.exe
Token: SeSystemtimePrivilege	4516	powershell.exe
Token: SeProfSingleProcessPrivilege	4516	powershell.exe
Token: SeIncBasePriorityPrivilege	4516	powershell.exe
Token: SeCreatePagefilePrivilege	4516	powershell.exe
Token: SeBackupPrivilege	4516	powershell.exe
Token: SeRestorePrivilege	4516	powershell.exe
Token: SeShutdownPrivilege	4516	powershell.exe
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeSystemEnvironmentPrivilege	4516	powershell.exe
Token: SeRemoteShutdownPrivilege	4516	powershell.exe
Token: SeUndockPrivilege	4516	powershell.exe
Token: SeManageVolumePrivilege	4516	powershell.exe
Token: 33	4516	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5180 wrote to memory of 5840	5180	2026-08-13_9d1c9c5486381a610bb941ba899ddb67_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	90
PID 5840 wrote to memory of 5800	5840	cmd.exe	91
PID 5800 wrote to memory of 6044	5800	wscript.exe	92
PID 6044 wrote to memory of 2372	6044	svchost.exe	93
PID 6044 wrote to memory of 3944	6044	svchost.exe	96
PID 6044 wrote to memory of 4516	6044	svchost.exe	98
PID 6044 wrote to memory of 1224	6044	svchost.exe	100
PID 6044 wrote to memory of 6004	6044	svchost.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-13_9d1c9c5486381a610bb941ba899ddb67_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_9d1c9c5486381a610bb941ba899ddb67_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript "C:\Users\Admin\AppData\Roaming\run.vbs""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5840
- - C:\Windows\system32\wscript.exe
    wscript "C:\Users\Admin\AppData\Roaming\run.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Creates a file in the Startup directory
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:6044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1224
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6004

C:\ProgramData\svchost.exe
C:\ProgramData\svchost.exe
1⤵
- Executes dropped EXE
PID:2500

C:\PROGRA~3\svchost.exe
C:\PROGRA~3\svchost.exe
1⤵
- Executes dropped EXE
PID:6016

C:\ProgramData\svchost.exe
"C:\ProgramData\svchost.exe"
1⤵
- Executes dropped EXE
PID:1804

C:\ProgramData\svchost.exe
"C:\ProgramData\svchost.exe"
1⤵
- Executes dropped EXE
PID:5384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 60b592fe75996b857f20801fd9df51c24d43568fdaa91864bde7775d471da323
MD5 f31dbce2c6178c15e6f16c92bd1038b7
SHA1 92ae454b1a110aeb4008f5354dd5e03243cee680
SHA512 e731b8bb6edd3e2271142eaf27f88597cbd292477dbaf97f829da0fe760c050fd4ae5059b79e27a2e768aec6b7c60a583a962339ed55dc0f265d35e4f48ce686
TLSH
T1CE216833F3DD8615CC9A413A10CDAC1036B6C7DB40DECF9B6B84E659A43F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4074e254dc10ba7edc5e740f5f16fe6a662f613bbc6489e9908e4e18b910b86b
MD5 73d498780f2f926d9b748e6b0fa64d2a
SHA1 4af7478c7f0cc6e921a65cbae851b2260ccf1209
SHA512 a3fc5cd02daf1c566a430c850fa08a18043fd0b69bb2bc49454a43671c9de4c6d71d84f4dfd4e80edc069088bb00162ee07db5a5108d25ce6caff943568f16db
TLSH
T14C219833B3DC8624CC9A013A10CDAC1036B6C7CB40DECFAB6B80E655A43F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_i5ylsjdm.tgp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i5ylsjdm.tgp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

run.vbs

Path C:\Users\Admin\AppData\Roaming\run.vbs
Size 120B
SHA256 411a8d8e60f0c81d6dbd17f7ee06b2548db2f1b7f8bdc4c6b7bf1ab6b07b5aff
MD5 7c7053ecd0fc2df9cd51dba02aacdf0c
SHA1 d97baff870d10ba70ccdddecfc77c6c49b56a166
SHA512 1847167d33fd7a6b42d1ba85f2c81796e60ea3c87accade5c6f093fa8d494ed4ea7728d7ec027af97cf26b8c10c3cae6a9cb66ae0be2836b8c8085c22de7468b
TLSH
T18DB01225188CC92D509EC0C30B72A40DE9E5AC96B7097C4C8B11E8DC734042CF92B143
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 36KB
SHA256 ac8f7cb7e603a4e24356037f0e586da2984212be236a410f68d95b3b2c29cbcf
MD5 dc503287788dc92a9250987c781e7089
SHA1 b24892b834d5e14b04b2e42503bd1a86cc10d0ac
SHA512 ed03ce4b63edde8c0d5ef29db023e6403a205f28e345aeb4d95d135eb95fea8bd160da9d03edf6295d9a8afd64813e17687fe3e75d9b0895a159ffb704b13102
SSDEEP 768:w5266qeqRyTd7OSFyw9sQQ76KO/hKN7Kiq:w5F6qejTdpFr9sn6KO/QZrq
TLSH
T116F25B0837C04721D6EDAFB469B3A1530679B6178D27EB5E0CD4899B2B37AC18A013F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2372-9-0x000001CDEAA20000-0x000001CDEAA42000-memory.dmp

Download

memory/2372-12-0x000001CDEAAC0000-0x000001CDEAADE000-memory.dmp

Download

memory/2372-13-0x000001CDEAAE0000-0x000001CDEAB92000-memory.dmp

Download

memory/2372-14-0x000001CDEABA0000-0x000001CDEABAA000-memory.dmp

Download

memory/6044-6-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

Download