xworm | 3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe
Size 867KB
Sample260824-pybwcatvfs
SHA256 3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9
MD5 a74f4a593e04a6f840422168d47a05e6
SHA1 e7e3e5b4368ed53a934da69fa76d05b200816969
SHA512 cb078f3af74eadedb2320b12b21a46631bfb6cf246e4e4baa9f25e6df1bd6600b192d66abcfb0ecac92c644920a5a65031c40ee098765877d5182f5e9d088835
SSDEEP 12288:+u5tqgwIWA1vXDfZryvvzKGAe0UaeUBIpBtUoJliXtfn9Afm8zxbfmFE+d5bi+Q4:L5V3WA1vbZue8yqBtUoJluCfm8zxG
TLSH
T11415CF9C355075DFC457CD768AA8AC70EA206C7B831BD20395931AEABA0DA97CF141F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

217.217.97.75:4445

Mutex

jDsTVbMEbOAobzRN

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/572-18-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2448	powershell.exe
5780	powershell.exe
2772	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1228	GREEUCRIujzk.exe
3836	GREEUCRIujzk.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\GREEUCRIujzk = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dszyqzublxb.ps1\""	3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4676 set thread context of 572	4676	3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe	91
PID 1228 set thread context of 3836	1228	GREEUCRIujzk.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GREEUCRIujzk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GREEUCRIujzk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4676	3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe
4676	3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe
4676	3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe
2448	powershell.exe
4676	3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe
2772	powershell.exe
2772	powershell.exe
2448	powershell.exe
2448	powershell.exe
2772	powershell.exe
1228	GREEUCRIujzk.exe
1228	GREEUCRIujzk.exe
5780	powershell.exe
5780	powershell.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	4676	3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	572	3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe
Token: SeIncreaseQuotaPrivilege	2448	powershell.exe
Token: SeSecurityPrivilege	2448	powershell.exe
Token: SeTakeOwnershipPrivilege	2448	powershell.exe
Token: SeLoadDriverPrivilege	2448	powershell.exe
Token: SeSystemProfilePrivilege	2448	powershell.exe
Token: SeSystemtimePrivilege	2448	powershell.exe
Token: SeProfSingleProcessPrivilege	2448	powershell.exe
Token: SeIncBasePriorityPrivilege	2448	powershell.exe
Token: SeCreatePagefilePrivilege	2448	powershell.exe
Token: SeBackupPrivilege	2448	powershell.exe
Token: SeRestorePrivilege	2448	powershell.exe
Token: SeShutdownPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeSystemEnvironmentPrivilege	2448	powershell.exe
Token: SeRemoteShutdownPrivilege	2448	powershell.exe
Token: SeUndockPrivilege	2448	powershell.exe
Token: SeManageVolumePrivilege	2448	powershell.exe
Token: 33	2448	powershell.exe
Token: 34	2448	powershell.exe
Token: 35	2448	powershell.exe
Token: 36	2448	powershell.exe
Token: SeDebugPrivilege	1228	GREEUCRIujzk.exe
Token: SeDebugPrivilege	5780	powershell.exe
Token: SeDebugPrivilege	3836	GREEUCRIujzk.exe
Token: SeIncreaseQuotaPrivilege	5780	powershell.exe
Token: SeSecurityPrivilege	5780	powershell.exe
Token: SeTakeOwnershipPrivilege	5780	powershell.exe
Token: SeLoadDriverPrivilege	5780	powershell.exe
Token: SeSystemProfilePrivilege	5780	powershell.exe
Token: SeSystemtimePrivilege	5780	powershell.exe
Token: SeProfSingleProcessPrivilege	5780	powershell.exe
Token: SeIncBasePriorityPrivilege	5780	powershell.exe
Token: SeCreatePagefilePrivilege	5780	powershell.exe
Token: SeBackupPrivilege	5780	powershell.exe
Token: SeRestorePrivilege	5780	powershell.exe
Token: SeShutdownPrivilege	5780	powershell.exe
Token: SeDebugPrivilege	5780	powershell.exe
Token: SeSystemEnvironmentPrivilege	5780	powershell.exe
Token: SeRemoteShutdownPrivilege	5780	powershell.exe
Token: SeUndockPrivilege	5780	powershell.exe
Token: SeManageVolumePrivilege	5780	powershell.exe
Token: 33	5780	powershell.exe
Token: 34	5780	powershell.exe
Token: 35	5780	powershell.exe
Token: 36	5780	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 2448	4676	3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe	88
PID 4676 wrote to memory of 2980	4676	3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe	90
PID 4676 wrote to memory of 572	4676	3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe	91
PID 4676 wrote to memory of 572	4676	3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe	91
PID 4676 wrote to memory of 572	4676	3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe	91
PID 4676 wrote to memory of 572	4676	3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe	91
PID 4676 wrote to memory of 572	4676	3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe	91
PID 2772 wrote to memory of 1228	2772	powershell.exe	94
PID 1228 wrote to memory of 5780	1228	GREEUCRIujzk.exe	97
PID 1228 wrote to memory of 3836	1228	GREEUCRIujzk.exe	99
PID 1228 wrote to memory of 3836	1228	GREEUCRIujzk.exe	99
PID 1228 wrote to memory of 3836	1228	GREEUCRIujzk.exe	99
PID 1228 wrote to memory of 3836	1228	GREEUCRIujzk.exe	99
PID 1228 wrote to memory of 3836	1228	GREEUCRIujzk.exe	99

C:\Users\Admin\AppData\Local\Temp\3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe
"C:\Users\Admin\AppData\Local\Temp\3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Users\Admin\AppData\Local\Temp\3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe
  "C:\Users\Admin\AppData\Local\Temp\3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe"
  2⤵
  PID:2980
- C:\Users\Admin\AppData\Local\Temp\3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe
  "C:\Users\Admin\AppData\Local\Temp\3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:572

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\dszyqzublxb.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Roaming\GREEUCRIujzk.exe
  "C:\Users\Admin\AppData\Roaming\GREEUCRIujzk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GREEUCRIujzk.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5780
- - C:\Users\Admin\AppData\Roaming\GREEUCRIujzk.exe
    "C:\Users\Admin\AppData\Roaming\GREEUCRIujzk.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 5d4572b4dddf023d2b57c3d1fdf46d300947596a2ea04e51903f817c946f1d57
MD5 fdb4a85773f06b706acdf5d457496229
SHA1 8e1015ee9791f7ddbddcbc47e11e81c8519671e8
SHA512 a550905891473bf857a3af0eb31dc88203dc2576509f40073c0dcd31fc0800ae68f870bdd7e0be7fa4804b636fc13d6237334cc29cc2a0c46332a0b45e335e5e
SSDEEP 384:hSEboT1iBG+GW14b5YXU7PW+geCrh0M32PwlIAXr4B+lWoV/cKwcvYbhNaPIWRt+:H0Z6GNWieETW+chAWIAXrq+F4TbhNaPi
TLSH
T1CEA2A478213F6DC7D8D216B010D20AF7FBE4D489DAF65194AF2BDA2F4C90EB64E60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ykkzymyy.4vw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ykkzymyy.4vw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dszyqzublxb.ps1

Path C:\Users\Admin\AppData\Local\Temp\dszyqzublxb.ps1
Size 1KB
SHA256 b855bffe9fe8bb851ed2bbdd58305c14dfc456607cc16946a63924ef5bd2894a
MD5 685fadf7610e419ecba9ac3f3c11807b
SHA1 a4751b7e33a250b9533ecd231dc6493e6d729047
SHA512 e35a904e2f14e98982227a88972fc99a940237cf36895559682d1603f0a5f11bad78ca61c0f4492a1c1f0be2f607a613996a6e82455e7047074945750e0f73ee
TLSH
T1C021764B8E8947CA006403F04A1335CD746D60DB2B7F018059ECB4EEB32BE23786ACE4
MD5 SHA1 SHA512 TLSH

Submit Download

GREEUCRIujzk.exe

Path C:\Users\Admin\AppData\Roaming\GREEUCRIujzk.exe
Size 867KB
SHA256 3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9
MD5 a74f4a593e04a6f840422168d47a05e6
SHA1 e7e3e5b4368ed53a934da69fa76d05b200816969
SHA512 cb078f3af74eadedb2320b12b21a46631bfb6cf246e4e4baa9f25e6df1bd6600b192d66abcfb0ecac92c644920a5a65031c40ee098765877d5182f5e9d088835
SSDEEP 12288:+u5tqgwIWA1vXDfZryvvzKGAe0UaeUBIpBtUoJliXtfn9Afm8zxbfmFE+d5bi+Q4:L5V3WA1vbZue8yqBtUoJluCfm8zxG
TLSH
T11415CF9C355075DFC457CD768AA8AC70EA206C7B831BD20395931AEABA0DA97CF141F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/572-18-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/572-50-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/572-49-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/572-33-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/572-19-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/2448-26-0x00000000062B0000-0x000000000660B000-memory.dmp

Download

memory/2448-45-0x0000000007D50000-0x0000000007DE6000-memory.dmp

Download

memory/2448-12-0x0000000002F50000-0x0000000002F86000-memory.dmp

Download

memory/2448-14-0x0000000005A60000-0x00000000060AA000-memory.dmp

Download

memory/2448-13-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/2448-15-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/2448-17-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/2448-48-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/2448-44-0x0000000007B50000-0x0000000007B5A000-memory.dmp

Download

memory/2448-21-0x00000000061D0000-0x0000000006236000-memory.dmp

Download

memory/2448-22-0x0000000006240000-0x00000000062A6000-memory.dmp

Download

memory/2448-43-0x0000000007AE0000-0x0000000007AFA000-memory.dmp

Download

memory/2448-20-0x0000000006130000-0x0000000006152000-memory.dmp

Download

memory/2448-42-0x0000000008130000-0x00000000087AC000-memory.dmp

Download

memory/2448-41-0x0000000007990000-0x0000000007A33000-memory.dmp

Download

memory/2448-30-0x0000000006780000-0x000000000679E000-memory.dmp

Download

memory/2448-40-0x0000000006D70000-0x0000000006D90000-memory.dmp

Download

memory/2448-31-0x0000000006B00000-0x0000000006B4C000-memory.dmp

Download

memory/2448-37-0x0000000075850000-0x000000007589C000-memory.dmp

Download

memory/2448-36-0x0000000007940000-0x0000000007976000-memory.dmp

Download

memory/2772-27-0x000001BFB98D0000-0x000001BFB98F2000-memory.dmp

Download

memory/4676-10-0x000000000B270000-0x000000000B31C000-memory.dmp

Download

memory/4676-9-0x000000000B1D0000-0x000000000B26C000-memory.dmp

Download

memory/4676-7-0x0000000074FA2000-0x0000000074FA3000-memory.dmp

Download

memory/4676-4-0x0000000001140000-0x000000000114A000-memory.dmp

Download

memory/4676-0-0x0000000074FA2000-0x0000000074FA3000-memory.dmp

Download

memory/4676-25-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/4676-6-0x0000000002F80000-0x0000000002F8C000-memory.dmp

Download

memory/4676-8-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/4676-3-0x0000000007770000-0x0000000007802000-memory.dmp

Download

memory/4676-5-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/4676-2-0x0000000007D30000-0x00000000082EA000-memory.dmp

Download

memory/4676-1-0x0000000000620000-0x0000000000700000-memory.dmp

Download

memory/5780-55-0x0000000006130000-0x000000000648B000-memory.dmp

Download

memory/5780-57-0x0000000006C60000-0x0000000006CAC000-memory.dmp

Download

memory/5780-58-0x0000000071200000-0x000000007124C000-memory.dmp

Download

memory/5780-61-0x0000000007920000-0x00000000079C3000-memory.dmp

Download