xworm | 149b160139a1bbc578a2d214005c2673d137f3d80ee222073c9913b0331a8bb3

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 06:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 330KB
Sample260818-gs5bpsff43
SHA256 149b160139a1bbc578a2d214005c2673d137f3d80ee222073c9913b0331a8bb3
MD5 89e199fd2c7690f3c315804a35a261e2
SHA1 d2f7988c83c9032b8d317c9dd2049ca5ffa03ade
SHA512 42e3b5c0dd584a83d65f55cc68b02f8661c4f11abd90530e4f26951d09047f9f386c2d751e0ae7d6f9612b568e5d7848d0a15009f945aa7c1c385525ca5d6a6f
SSDEEP 6144:DsivUBlh6mLrb2M8s2fXKIVSaiGRNyzG2gthZQ/HkTftO:Dl8BfnfaM81f6WSljy2gthZrTftO
TLSH
T11C744B47A1380C21DBB0EE39A1DCD8BB594F5E7AF5A2464D7CB5FC5824F68F1092AC06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

82.22.62.11:101

Attributes

Install_directory
%Temp%
install_file
explore.exe

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 12 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024480-6.dat	family_xworm
behavioral1/files/0x0008000000024481-25.dat	family_xworm
behavioral1/files/0x0007000000024486-42.dat	family_xworm
behavioral1/files/0x0007000000024487-54.dat	family_xworm
behavioral1/files/0x0007000000024488-49.dat	family_xworm
behavioral1/memory/2432-34-0x0000000000D80000-0x0000000000D96000-memory.dmp	family_xworm
behavioral1/files/0x0007000000024489-62.dat	family_xworm
behavioral1/memory/3732-73-0x0000000000F00000-0x0000000000F14000-memory.dmp	family_xworm
behavioral1/memory/3848-74-0x00000000005F0000-0x0000000000604000-memory.dmp	family_xworm
behavioral1/memory/3308-71-0x0000000000E30000-0x0000000000E46000-memory.dmp	family_xworm
behavioral1/memory/2120-60-0x0000000000F60000-0x0000000000F74000-memory.dmp	family_xworm
behavioral1/memory/4124-58-0x0000000000A30000-0x0000000000A46000-memory.dmp	family_xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	setup.exe

Creates a file in the Startup directory 1 TTPs 12 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5.lnk	5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4.lnk	4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4.lnk	4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3.lnk	3.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2.lnk	2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2.lnk	2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.lnk	1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6.lnk	6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6.lnk	6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5.lnk	5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3.lnk	3.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.lnk	1.exe

Executes dropped EXE 12 IoCs

pid	Process
2432	6.exe
4124	5.exe
2120	4.exe
3308	3.exe
3732	2.exe
3848	1.exe
4220	4.exe
720	3.exe
576	6.exe
4160	5.exe
2096	2.exe
5100	1.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5.exe"	5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4.exe"	4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3.exe"	3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2.exe"	2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1.exe"	1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6.exe"	6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2432	6.exe
Token: SeDebugPrivilege	4124	5.exe
Token: SeDebugPrivilege	2120	4.exe
Token: SeDebugPrivilege	3308	3.exe
Token: SeDebugPrivilege	3732	2.exe
Token: SeDebugPrivilege	3848	1.exe
Token: SeDebugPrivilege	2432	6.exe
Token: SeDebugPrivilege	4124	5.exe
Token: SeDebugPrivilege	2120	4.exe
Token: SeDebugPrivilege	3308	3.exe
Token: SeDebugPrivilege	3732	2.exe
Token: SeDebugPrivilege	3848	1.exe
Token: SeDebugPrivilege	4220	4.exe
Token: SeDebugPrivilege	4160	5.exe
Token: SeDebugPrivilege	576	6.exe
Token: SeDebugPrivilege	720	3.exe
Token: SeDebugPrivilege	2096	2.exe
Token: SeDebugPrivilege	5100	1.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2432	1908	setup.exe	86
PID 1908 wrote to memory of 4124	1908	setup.exe	87
PID 1908 wrote to memory of 2120	1908	setup.exe	88
PID 1908 wrote to memory of 3308	1908	setup.exe	89
PID 1908 wrote to memory of 3732	1908	setup.exe	90
PID 1908 wrote to memory of 3848	1908	setup.exe	91

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\6.exe
  "C:\Users\Admin\AppData\Local\Temp\6.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2432
- C:\Users\Admin\AppData\Local\Temp\5.exe
  "C:\Users\Admin\AppData\Local\Temp\5.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4124
- C:\Users\Admin\AppData\Local\Temp\4.exe
  "C:\Users\Admin\AppData\Local\Temp\4.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2120
- C:\Users\Admin\AppData\Local\Temp\3.exe
  "C:\Users\Admin\AppData\Local\Temp\3.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3308
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3732
- C:\Users\Admin\AppData\Local\Temp\1.exe
  "C:\Users\Admin\AppData\Local\Temp\1.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3848

C:\Users\Admin\AppData\Local\Temp\4.exe
C:\Users\Admin\AppData\Local\Temp\4.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4220

C:\Users\Admin\AppData\Local\Temp\3.exe
C:\Users\Admin\AppData\Local\Temp\3.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:720

C:\Users\Admin\AppData\Local\Temp\6.exe
C:\Users\Admin\AppData\Local\Temp\6.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:576

C:\Users\Admin\AppData\Local\Temp\5.exe
C:\Users\Admin\AppData\Local\Temp\5.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4160

C:\Users\Admin\AppData\Local\Temp\2.exe
C:\Users\Admin\AppData\Local\Temp\2.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Users\Admin\AppData\Local\Temp\1.exe
C:\Users\Admin\AppData\Local\Temp\1.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\3.exe.log
Size 654B
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
TLSH
T1D9F0DD242221E1C489127F111C0D2A4452BF4797B760EE0C7554529FD8312275F203E7
MD5 SHA1 SHA512 TLSH

Submit Download

1.exe

Path C:\Users\Admin\AppData\Local\Temp\1.exe
Size 56KB
SHA256 b7f9d8198560f13ccdb4ab678e4f1808f294b7f2f37152300f85c6d39086f7c9
MD5 8ddf9f107c1f188422ce5eaf0755a33f
SHA1 daeced107563e7a0e22fd8a1b326190ff839aaab
SHA512 fc1d1b36eda19d8c298232457d575c382fef129a35ad0f92d9fc90321c9fdbbda11a02304ec6b341810bd54fc2ed7a229401a30829626c72c653562e41847b84
SSDEEP 1536:B6GcRQcih3PjM9inzb7B+07ROkvRguEQN:B6Ge8hfjMAnzb7BdROkvRGI
TLSH
T107436B187BE58124E2FFAFB21DB17211D37AF2639803A71F24C841975723EC98E416E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2.exe

Path C:\Users\Admin\AppData\Local\Temp\2.exe
Size 57KB
SHA256 15d4ae0ca8aefc7298244d35757acdb7501313bb5aaa57fb4ecfee7964894867
MD5 f4ad89e7ab135b5a606542577fcac2c9
SHA1 4e13c7062333a4fde3f720b47306c91f64575720
SHA512 62424ad43c4c172442aa203bb2cd83a8b249ec115146f5c8fbfbf256f571320181400b465849784b6e29f66951bb0aa3e860241d28d8b45de62eb766e265061f
SSDEEP 1536:U/eWXlVFgCno3O6nn6zb9zNB2or8Sj57SO3i4zHDTQB:Ge1O6nn6zbFrpHoO3iuHPU
TLSH
T15A436B287BEA8128E2FF6FB09DB17292C679E2235A13B71F14C441871717E85CD817E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3.exe

Path C:\Users\Admin\AppData\Local\Temp\3.exe
Size 60KB
SHA256 d3f1556be5ee83cb0a8d38f8432c16182d566f87e0652df47eeb53227babe55c
MD5 05637284ecf7c110f7dc1b5fdb2f16ab
SHA1 1dcaa155b47491babc744b9fead2c4a41ffcc19b
SHA512 87f1f57c466c7b92452dbe3dab5a0eea430fc9d282665ce08f578b6bf00c6627276d60dd04e9b5985c95c13de8f25059d23d0a572f8fbf66b1aadd8110249205
SSDEEP 1536:n5ntDB+gsCIu1HF6zbv4hrXmqfOy+EuFQU:n5twgsCIYHF6zbv4tXmqfOy+9B
TLSH
T17F536B187BE64225F2FFABB25CF16261C779B2235913AB1F14C501871723D85CE907EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4.exe

Path C:\Users\Admin\AppData\Local\Temp\4.exe
Size 54KB
SHA256 ddf2cb1aae860c619f06d081aea47a71c95388588df3a29998f7232ff157c1e0
MD5 54cfbea606e414970a3ae742671f14ca
SHA1 cf3a5d7e7a5c03b0de2408239b74e5ac009a45a4
SHA512 f9fd7fc06ccf8370b2bf4c5c39c805b4308db622a68a0f26245d0636445b353cf92e8bd04c7dc8e6ad9a3718058133d5cb55a5bb437094da3186840089647046
SSDEEP 1536:4LTO0tzHm9b0/rHzb7trDLlF9bDGOq+FgQH:4La0zH4Qrzb7VPxDGOqh+
TLSH
T13D437C187BD68225D2FF9FB16DB13292C7B6E6139D13A71F14C8408A0B53E898E417E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5.exe

Path C:\Users\Admin\AppData\Local\Temp\5.exe
Size 61KB
SHA256 8929f885ac8f71eafeed671529ee1c405071cacaa3e4f0da4899a0db5c2107e4
MD5 edf56fd1e17c68255f3be7cc49b2732d
SHA1 451d0e919406776c9c0b3c88e1fdadec75edc9d1
SHA512 e6d4a926886507bfec4366f6b41825e40a6d335f4c684fb694b2a630ee7d51230dc21ab6308c02d235317deb1f3c4899a6f38943e97dccf289864307109f2993
SSDEEP 768:RBZuBbQo66HtnRr8fQNs/W+S6pyQNumz/KazQWMIz/zb35MkqyZiwZa49V2+AbOx:kBcED8aHGpxwO/Pzb35MwFeOgmmXQB
TLSH
T163536C183BD68126D2FFAB711DF171A2C779F2135913AB2F14C4418A1627AC9CE817FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6.exe

Path C:\Users\Admin\AppData\Local\Temp\6.exe
Size 61KB
SHA256 85104d7383432c9dd2107e328944203d6f2116d415127c6bd1767a663f21e1e8
MD5 c4270c8d48740621a10e94d16fcff283
SHA1 b44c8c452b2f2ce0cfeeec567b62b4363bf4316a
SHA512 25b048088d3259fb4280e2f89489e4be6bd683fd7df4d48d259af9c76bc6ff305eb67c1e22d6be1da3a459b3c6f88550e4ec80969674d36c324d7d55a95a1c5c
SSDEEP 1536:xyP5H1tB6FtcwvrZUzbfeXSouv8OliLIjQ8:xypkt3rCzbfjkOliEl
TLSH
T13C53AE1C7BD98226E1FF5FB11CB132628776F6176813AB0F28C441965713EC98D507EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1908-0-0x0000000000210000-0x0000000000268000-memory.dmp

Download

memory/1908-1-0x000000001B030000-0x000000001B040000-memory.dmp

Download

memory/2120-60-0x0000000000F60000-0x0000000000F74000-memory.dmp

Download

memory/2432-34-0x0000000000D80000-0x0000000000D96000-memory.dmp

Download

memory/3308-71-0x0000000000E30000-0x0000000000E46000-memory.dmp

Download

memory/3732-73-0x0000000000F00000-0x0000000000F14000-memory.dmp

Download

memory/3848-74-0x00000000005F0000-0x0000000000604000-memory.dmp

Download

memory/4124-58-0x0000000000A30000-0x0000000000A46000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads