xworm | d9e29bbdc13c8d2005de811a81272c1dcd472f321c2d1e0c0fe894414dd81b25

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9e29bbdc13c8d2005de811a81272c1dcd472f321c2d1e0c0fe894414dd81b25.ps1
Size 46KB
Sample260825-sqettavanf
SHA256 d9e29bbdc13c8d2005de811a81272c1dcd472f321c2d1e0c0fe894414dd81b25
MD5 6808d5bb691299f36f76bf9bafb6a1b1
SHA1 b28d8d372482644eb61a7a5059d5f2592fd049a9
SHA512 aff472874ff807a776e1a402c143056d716ab5415a41fd2955cb4158bd8bc0fca833e980dcb28b0673f45db78a37418bf191c087ccfc630f013564ee4f9e98e8
SSDEEP 768:dyJSxyKWiEJml/i9UeAapxEmNFvxdOpBJ82xKukpSd/FoKEtuXNebA/7/Jk+S8J4:K2ySEJml/i2exxvxdOpBJ82xKDU2dS3G
TLSH
T1F52338371A43FCD07B7F2E94F05838A00CA5395797659578FAC4098A29F2990DF2ADF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

SaDDaM11-49041.portmap.host:49041

Mutex

EfAn9VzhGpVfcehZ

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0009000000024621-14.dat	family_xworm
behavioral1/memory/1948-23-0x0000000000780000-0x0000000000790000-memory.dmp	family_xworm

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\drettg.lnk	drettg.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\drettg.lnk	drettg.exe

Executes dropped EXE 1 IoCs

pid	Process
1948	drettg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4296	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4296	powershell.exe
4296	powershell.exe
1948	drettg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeDebugPrivilege	1948	drettg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1948	drettg.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 1948	4296	powershell.exe	85

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\d9e29bbdc13c8d2005de811a81272c1dcd472f321c2d1e0c0fe894414dd81b25.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Users\Admin\AppData\Local\Temp\drettg.exe
  "C:\Users\Admin\AppData\Local\Temp\drettg.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_q4ijubkp.iqo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q4ijubkp.iqo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

drettg.exe

Path C:\Users\Admin\AppData\Local\Temp\drettg.exe
Size 35KB
SHA256 78fef8b9eddd5c5067e5326dd43d60e606cc7b562689858af55fde81d8d814fe
MD5 a16f93ee5324e0474864098a2fd5d78e
SHA1 9b724b6505a932dab12b004903ce98d430cddd83
SHA512 f876d888648c440075ef73e215a4984bc4fb594c9c440f710956a58aa24437e6cec29d744d2a3d1b96db6e59bb21270645b46a4b99a977fc4ebf5848155c4701
SSDEEP 384:5gg9j00WbqxAMTayV5N+5maFZZL31UpJm3/KNm0s0VgtFMAmNLToZw/RZCvK9IkU:3B4QBTOl3153CN0VFQ92zOMhruXlNY
TLSH
T107F25D083BD4831DC9FF2BFA6973A6010274E6078A13EB4E5DC845AE6B33B8189457D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1948-23-0x0000000000780000-0x0000000000790000-memory.dmp

Download

memory/1948-28-0x000000001B440000-0x000000001B450000-memory.dmp

Download

memory/1948-29-0x000000001B440000-0x000000001B450000-memory.dmp

Download

memory/4296-0-0x000001CB6B400000-0x000001CB6B410000-memory.dmp

Download

memory/4296-1-0x000001CB6B400000-0x000001CB6B410000-memory.dmp

Download

memory/4296-9-0x000001CB6D580000-0x000001CB6D5A2000-memory.dmp

Download