xworm | 3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 16:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47.exe
Size 835KB
Sample260824-t7264s1bmd
SHA256 3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47
MD5 452f620d652867f9e390cdeedd5713ab
SHA1 5313645ec460968956998c5092542f86fda885fb
SHA512 9efedbf0307f90bce53ff2db31b158ba745ebd2812ecf52824b2010608256651eb1a28ffb7d37e134cf77c75daf180070d19223d782ba1b85fdf524c8a13e4bf
SSDEEP 24576:D/9TnWhXVs2Y5Xg5dWbOgK3GsD3z4ge8:DlT8Xu2DaOgK3GsB
TLSH
T1D205F1283365DF02D5AA27B41870E3711B706E9AB912C3069FF67DDFBA35B0169482D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

217.60.195.172:443

Mutex

DpdAFlHclG8utvvu

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/712-12-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2284	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5436	JcNcQdhWtKWy.exe
4128	JcNcQdhWtKWy.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\JcNcQdhWtKWy = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\j1y0yilgptw.ps1\""	3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1772 set thread context of 712	1772	3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47.exe	90
PID 5436 set thread context of 4128	5436	JcNcQdhWtKWy.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JcNcQdhWtKWy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JcNcQdhWtKWy.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1772	3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47.exe
1772	3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47.exe
2284	powershell.exe
2284	powershell.exe
5436	JcNcQdhWtKWy.exe
5436	JcNcQdhWtKWy.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1772	3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47.exe
Token: SeDebugPrivilege	712	3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	5436	JcNcQdhWtKWy.exe
Token: SeDebugPrivilege	4128	JcNcQdhWtKWy.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 712	1772	3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47.exe	90
PID 1772 wrote to memory of 712	1772	3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47.exe	90
PID 1772 wrote to memory of 712	1772	3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47.exe	90
PID 1772 wrote to memory of 712	1772	3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47.exe	90
PID 1772 wrote to memory of 712	1772	3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47.exe	90
PID 2284 wrote to memory of 5436	2284	powershell.exe	93
PID 5436 wrote to memory of 4128	5436	JcNcQdhWtKWy.exe	95
PID 5436 wrote to memory of 4128	5436	JcNcQdhWtKWy.exe	95
PID 5436 wrote to memory of 4128	5436	JcNcQdhWtKWy.exe	95
PID 5436 wrote to memory of 4128	5436	JcNcQdhWtKWy.exe	95
PID 5436 wrote to memory of 4128	5436	JcNcQdhWtKWy.exe	95

C:\Users\Admin\AppData\Local\Temp\3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47.exe
"C:\Users\Admin\AppData\Local\Temp\3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Local\Temp\3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47.exe
  "C:\Users\Admin\AppData\Local\Temp\3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:712

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\j1y0yilgptw.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Roaming\JcNcQdhWtKWy.exe
  "C:\Users\Admin\AppData\Roaming\JcNcQdhWtKWy.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5436
- - C:\Users\Admin\AppData\Roaming\JcNcQdhWtKWy.exe
    "C:\Users\Admin\AppData\Roaming\JcNcQdhWtKWy.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

j1y0yilgptw.ps1

Path C:\Users\Admin\AppData\Local\Temp\j1y0yilgptw.ps1
Size 1KB
SHA256 1e8ea79486e2e88bf52c6b657bfe13ad7341383b084a29cd3ee7aa091010219a
MD5 5ac1ceb5182b1c5801176bbe48749102
SHA1 c9e1106f27463cfb3c16b9c1e5f5f96734ae07eb
SHA512 46fc39088827a6f3d2781814ec6c3065bde5ca02366807bc9b6b0ee3ee2abd8b3586b5d7d805233d75298d3aa1c278a886fa1ff55062d00c17d8ac0597c71f43
TLSH
T1F221E70B8E4957C5006407F58A1335CDB55E60CB276F018055ECA4EEB32FD633469CE8
MD5 SHA1 SHA512 TLSH

Submit Download

JcNcQdhWtKWy.exe

Path C:\Users\Admin\AppData\Roaming\JcNcQdhWtKWy.exe
Size 835KB
SHA256 3b7312f5ac728c79d8b4a6fb249fe308885adcc78787b5a4e272ffe878e92f47
MD5 452f620d652867f9e390cdeedd5713ab
SHA1 5313645ec460968956998c5092542f86fda885fb
SHA512 9efedbf0307f90bce53ff2db31b158ba745ebd2812ecf52824b2010608256651eb1a28ffb7d37e134cf77c75daf180070d19223d782ba1b85fdf524c8a13e4bf
SSDEEP 24576:D/9TnWhXVs2Y5Xg5dWbOgK3GsD3z4ge8:DlT8Xu2DaOgK3GsB
TLSH
T1D205F1283365DF02D5AA27B41870E3711B706E9AB912C3069FF67DDFBA35B0169482D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/712-12-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/712-33-0x00000000060B0000-0x0000000006116000-memory.dmp

Download

memory/712-34-0x0000000074950000-0x000000007510C000-memory.dmp

Download

memory/712-35-0x0000000074950000-0x000000007510C000-memory.dmp

Download

memory/712-15-0x0000000074950000-0x000000007510C000-memory.dmp

Download

memory/712-13-0x0000000074950000-0x000000007510C000-memory.dmp

Download

memory/1772-5-0x0000000005400000-0x000000000549C000-memory.dmp

Download

memory/1772-9-0x0000000074950000-0x000000007510C000-memory.dmp

Download

memory/1772-10-0x0000000009240000-0x00000000092E2000-memory.dmp

Download

memory/1772-8-0x0000000074962000-0x0000000074963000-memory.dmp

Download

memory/1772-7-0x0000000008D70000-0x0000000008D90000-memory.dmp

Download

memory/1772-14-0x0000000074950000-0x000000007510C000-memory.dmp

Download

memory/1772-6-0x0000000074950000-0x000000007510C000-memory.dmp

Download

memory/1772-4-0x0000000005260000-0x000000000526A000-memory.dmp

Download

memory/1772-0-0x0000000074962000-0x0000000074963000-memory.dmp

Download

memory/1772-3-0x00000000052C0000-0x0000000005352000-memory.dmp

Download

memory/1772-2-0x0000000005880000-0x0000000005E3A000-memory.dmp

Download

memory/1772-1-0x00000000007A0000-0x0000000000878000-memory.dmp

Download

memory/2284-17-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2284-24-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2284-23-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2284-26-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2284-27-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2284-28-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2284-29-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2284-22-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2284-32-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2284-20-0x00000291FD070000-0x00000291FD092000-memory.dmp

Download

memory/2284-21-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2284-16-0x00007FFD609FF000-0x00007FFD60A00000-memory.dmp

Download