xworm | e475c5d635d2146034224a76ea1e62290c108a139a3d92df01c2f2785c4b9e18

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bellaware.exe
Size 3.0MB
Sample260820-csl3xadn3v
SHA256 e475c5d635d2146034224a76ea1e62290c108a139a3d92df01c2f2785c4b9e18
MD5 f176d261ea2bbbbef427e8da7189a0f6
SHA1 7d56da7e542179af0f91299e4fd2bb52be0c3e4b
SHA512 b036fd336b7b022ecd3056a0a984cb4b0158a7b0dc3d43c33ce40ae8b110d9d5d589552af8e93065013f0dc9b8b994abda224b7d7d89ba112c85b26300cbc93d
SSDEEP 49152:8RgoyP3RcvQNrHxfboet0w1iPyXgLWRMdqcYABCCO:sgoyPeYr0eaw6yXgLibs
TLSH
T1F9E5331A2A4324FCC6079C397D2CECB9398041D38F48C76A646A216B5F5D6EA1DF3DE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c589-18.dat	family_xworm
behavioral2/memory/3360-26-0x0000000000070000-0x0000000000094000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4996	powershell.exe
4296	powershell.exe
472	powershell.exe
2872	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender Executable.lnk	62d1a906dd534eff943e9ec92dbe10cd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender Executable.lnk	62d1a906dd534eff943e9ec92dbe10cd.exe

Executes dropped EXE 3 IoCs

pid	Process
5416	66d849d818db47a4989714ad71f2fa5b.exe
3360	62d1a906dd534eff943e9ec92dbe10cd.exe
4672	Windows Defender Executable.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Executable = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Defender Executable.exe"	62d1a906dd534eff943e9ec92dbe10cd.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4208	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
5416	66d849d818db47a4989714ad71f2fa5b.exe
5416	66d849d818db47a4989714ad71f2fa5b.exe
4996	powershell.exe
4996	powershell.exe
4996	powershell.exe
4296	powershell.exe
4296	powershell.exe
4296	powershell.exe
472	powershell.exe
472	powershell.exe
472	powershell.exe
2872	powershell.exe
2872	powershell.exe
2872	powershell.exe
3360	62d1a906dd534eff943e9ec92dbe10cd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	62d1a906dd534eff943e9ec92dbe10cd.exe
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeIncreaseQuotaPrivilege	4996	powershell.exe
Token: SeSecurityPrivilege	4996	powershell.exe
Token: SeTakeOwnershipPrivilege	4996	powershell.exe
Token: SeLoadDriverPrivilege	4996	powershell.exe
Token: SeSystemProfilePrivilege	4996	powershell.exe
Token: SeSystemtimePrivilege	4996	powershell.exe
Token: SeProfSingleProcessPrivilege	4996	powershell.exe
Token: SeIncBasePriorityPrivilege	4996	powershell.exe
Token: SeCreatePagefilePrivilege	4996	powershell.exe
Token: SeBackupPrivilege	4996	powershell.exe
Token: SeRestorePrivilege	4996	powershell.exe
Token: SeShutdownPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeSystemEnvironmentPrivilege	4996	powershell.exe
Token: SeRemoteShutdownPrivilege	4996	powershell.exe
Token: SeUndockPrivilege	4996	powershell.exe
Token: SeManageVolumePrivilege	4996	powershell.exe
Token: 33	4996	powershell.exe
Token: 34	4996	powershell.exe
Token: 35	4996	powershell.exe
Token: 36	4996	powershell.exe
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeIncreaseQuotaPrivilege	4296	powershell.exe
Token: SeSecurityPrivilege	4296	powershell.exe
Token: SeTakeOwnershipPrivilege	4296	powershell.exe
Token: SeLoadDriverPrivilege	4296	powershell.exe
Token: SeSystemProfilePrivilege	4296	powershell.exe
Token: SeSystemtimePrivilege	4296	powershell.exe
Token: SeProfSingleProcessPrivilege	4296	powershell.exe
Token: SeIncBasePriorityPrivilege	4296	powershell.exe
Token: SeCreatePagefilePrivilege	4296	powershell.exe
Token: SeBackupPrivilege	4296	powershell.exe
Token: SeRestorePrivilege	4296	powershell.exe
Token: SeShutdownPrivilege	4296	powershell.exe
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeSystemEnvironmentPrivilege	4296	powershell.exe
Token: SeRemoteShutdownPrivilege	4296	powershell.exe
Token: SeUndockPrivilege	4296	powershell.exe
Token: SeManageVolumePrivilege	4296	powershell.exe
Token: 33	4296	powershell.exe
Token: 34	4296	powershell.exe
Token: 35	4296	powershell.exe
Token: 36	4296	powershell.exe
Token: SeDebugPrivilege	472	powershell.exe
Token: SeIncreaseQuotaPrivilege	472	powershell.exe
Token: SeSecurityPrivilege	472	powershell.exe
Token: SeTakeOwnershipPrivilege	472	powershell.exe
Token: SeLoadDriverPrivilege	472	powershell.exe
Token: SeSystemProfilePrivilege	472	powershell.exe
Token: SeSystemtimePrivilege	472	powershell.exe
Token: SeProfSingleProcessPrivilege	472	powershell.exe
Token: SeIncBasePriorityPrivilege	472	powershell.exe
Token: SeCreatePagefilePrivilege	472	powershell.exe
Token: SeBackupPrivilege	472	powershell.exe
Token: SeRestorePrivilege	472	powershell.exe
Token: SeShutdownPrivilege	472	powershell.exe
Token: SeDebugPrivilege	472	powershell.exe
Token: SeSystemEnvironmentPrivilege	472	powershell.exe
Token: SeRemoteShutdownPrivilege	472	powershell.exe
Token: SeUndockPrivilege	472	powershell.exe
Token: SeManageVolumePrivilege	472	powershell.exe
Token: 33	472	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3360	62d1a906dd534eff943e9ec92dbe10cd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 5416	3664	bellaware.exe	89
PID 3664 wrote to memory of 3360	3664	bellaware.exe	91
PID 3360 wrote to memory of 4996	3360	62d1a906dd534eff943e9ec92dbe10cd.exe	93
PID 3360 wrote to memory of 4296	3360	62d1a906dd534eff943e9ec92dbe10cd.exe	96
PID 3360 wrote to memory of 472	3360	62d1a906dd534eff943e9ec92dbe10cd.exe	99
PID 3360 wrote to memory of 2872	3360	62d1a906dd534eff943e9ec92dbe10cd.exe	101
PID 3360 wrote to memory of 4208	3360	62d1a906dd534eff943e9ec92dbe10cd.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bellaware.exe
"C:\Users\Admin\AppData\Local\Temp\bellaware.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Users\Admin\AppData\Local\Temp\465b5fccf1dd40a194b6508891d983d9\66d849d818db47a4989714ad71f2fa5b.exe
  "C:\Users\Admin\AppData\Local\Temp\465b5fccf1dd40a194b6508891d983d9\66d849d818db47a4989714ad71f2fa5b.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5416
- C:\Users\Admin\AppData\Local\Temp\465b5fccf1dd40a194b6508891d983d9\62d1a906dd534eff943e9ec92dbe10cd.exe
  "C:\Users\Admin\AppData\Local\Temp\465b5fccf1dd40a194b6508891d983d9\62d1a906dd534eff943e9ec92dbe10cd.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\465b5fccf1dd40a194b6508891d983d9\62d1a906dd534eff943e9ec92dbe10cd.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '62d1a906dd534eff943e9ec92dbe10cd.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Defender Executable.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Defender Executable.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2872
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Defender Executable" /tr "C:\Users\Admin\AppData\Roaming\Windows Defender Executable.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4208

C:\Users\Admin\AppData\Roaming\Windows Defender Executable.exe
"C:\Users\Admin\AppData\Roaming\Windows Defender Executable.exe"
1⤵
- Executes dropped EXE
PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 64a6188465c4fdfe2bf37677777a9292d4746a7c4d304745e557df8e56cfac70
MD5 afe2b066773ff8e0759b14d56fdd720f
SHA1 34d41863ac73eb3fba4fff73441e6866917191f5
SHA512 f138672a70b08674ecbc9a31e79bcc14c7c1f06bb3bc47f5e50a591a4a6138ee786e5b7c42e801f3a898f287bb0152a7d732f3d995d74c9bd130263aa563ec52
TLSH
T1E0216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6e16a2dfccf5e68575f762d494243c1f760de4e4d72e539e3c463a222b88a35a
MD5 d78786a656b0f4ee366904cee62af4ab
SHA1 e03287eabb1f02372e7c9f9d8fda6d2650537d94
SHA512 7eac7bb11000d3c328dc9c5aa01876852561b5fd4c4da6588a3b691edb4f4a6c78e9daa9d8888d37079fcea1722d3fd328d4302819d005250e2da8bbec8ceb67
TLSH
T10A216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

62d1a906dd534eff943e9ec92dbe10cd.exe

Path C:\Users\Admin\AppData\Local\Temp\465b5fccf1dd40a194b6508891d983d9\62d1a906dd534eff943e9ec92dbe10cd.exe
Size 115KB
SHA256 13f4d8d48962f9c49edd66d38f3aeb521755ab8e7561beeba4fe8b81f1e4b6fc
MD5 d275f57fd6137297f3aab4f95f5abd3b
SHA1 06bca160311e1e599c6a2008ddcb2291970c83c8
SHA512 efc097c9ffac97bebb3fa98dfcbe07e11886c8711fa8677e7c9791fa6ace9220e9a44137bb183a2d11e819eea00ea7caa58b8e7a4f19e9d51f058c75770bbbdd
SSDEEP 1536:q1bpEU2RlXtsSUQGh5aqz78+8ndOU9PudOo8qsLDNwM2NVLYo5PbKSXDhCd8:+dEUuX7Gh/kjdvYHtsLsVLY+PbKS4K
TLSH
T13EC34A4EF74A5D88C41C1F7784AB601D41E9C9AB6527F66F54C81DE2ADA28CCCB8F8C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66d849d818db47a4989714ad71f2fa5b.exe

Path C:\Users\Admin\AppData\Local\Temp\465b5fccf1dd40a194b6508891d983d9\66d849d818db47a4989714ad71f2fa5b.exe
Size 252KB
SHA256 50f3277d921b865c8e7e6d8e72f11cf53315d21a306a23b4bf40aebc301cb05d
MD5 93b1983c96a7edcbd453c3885a19e137
SHA1 4f01bfd5b85cb8552639016760230c74833b4eca
SHA512 a22e5f1afc1cb158559f796bdbd731bcf8a8a538269400e04bb26ecde9e09f57ddb45790eeb6a9e00afd47ecf92295b4a1c5085cb04c65a2240fc2b9da409be0
SSDEEP 3072:3vkrMskjXk4Kw1t91p1JXRwdlQyqyiwwyfU1aq2S3v283p0bijlgY7IsS:Zk4T1t9Z9WHnfUL3pmc
TLSH
T152448D15B7A51CF9ED77823DCD524545EB727C5247A0EACF03A00AA64F236E0AE3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dll1.dll

Path C:\Users\Admin\AppData\Local\Temp\465b5fccf1dd40a194b6508891d983d9\Dll1.dll
Size 2.6MB
SHA256 1b1a0b2cacaf08aee4c68c2353a278e9d1696a142ebb473466aa515ba341c381
MD5 653bc4910c4a3c881836a4949931723d
SHA1 f35da846180438dfc9db5bcab0aa235ca904925b
SHA512 2662888af861fda28c1b2b4c4d16f32c97fe85d2a8d41ec185ca8ca165c31defcd6a12801466b7c74038757d5d16117d8cf55b6e5bde9767172256c7491b32a0
SSDEEP 49152:R4Y5UJexyuJ7AO4jFOM0W5XknN1rin8R9Ej2PG2/t:VWkSXknak
TLSH
T1CDC5C5B1B25400EED813EDBE444F5FAB59F236A70F2C49C7A2E4E0A4A9711D08375DE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ypi5tfgt.0mn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ypi5tfgt.0mn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3360-30-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3360-31-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3360-28-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3360-26-0x0000000000070000-0x0000000000094000-memory.dmp

Download

memory/3360-29-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3360-27-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3664-9-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3664-25-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3664-0-0x00007FF8B90BF000-0x00007FF8B90C0000-memory.dmp

Download

memory/3664-7-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3664-6-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3664-5-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3664-2-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3664-1-0x00000000007C0000-0x0000000000ABE000-memory.dmp

Download

memory/4996-34-0x0000013447A60000-0x0000013447A82000-memory.dmp

Download

memory/4996-37-0x000001345FF50000-0x000001345FF6E000-memory.dmp

Download

memory/4996-38-0x00000134601B0000-0x0000013460262000-memory.dmp

Download

memory/4996-39-0x000001345FF70000-0x000001345FF7A000-memory.dmp

Download