xworm | e78a5ac79774c68cf42d1ab02e6cf8f4e46b60d42a3c1553e49e0b88db34cab8

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INFORME JUDICIAL RADICADO FMI0156923511 FORMATO IMPUESTO JUZGADO CIVILpdf.js
Size 206KB
Sample260826-wxaefstfna
SHA256 e78a5ac79774c68cf42d1ab02e6cf8f4e46b60d42a3c1553e49e0b88db34cab8
MD5 9f3ce2a278a40279c2b009be1879cfc8
SHA1 a538aa52e4f0aa399a0effa5995f1a4f23d75b2f
SHA512 7448cf85e9200985f95fbd5468dd16b163f179d3d4f1a3f867c1ec4c84a6cadd788f5a684f5d5f01de78ae8218b0a0236e2633be855f3a7e4a5ac89e10f94247
SSDEEP 3072:KwQqWgtZm8b2YNJ++eeWlE35Ezn/9BTjVvCVKt2KMQFFVGZLXVw1tvk:luuma++Vb35erjx2dQchw1Rk
TLSH
T140246CC81B580D7C924258E5942F250764FADDEA7D3861927FF3EAD3BA37D8180E07A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

loganwolverin2041.webredirect.org:4521

Mutex

3XBTthjGvF0tr4jL

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/6016-31-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2776	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2776 set thread context of 6016	2776	powershell.exe	95

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2776	powershell.exe
2776	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	6016	jsc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5992 wrote to memory of 2776	5992	wscript.exe	91
PID 2776 wrote to memory of 2444	2776	powershell.exe	93
PID 2444 wrote to memory of 4288	2444	csc.exe	94
PID 2776 wrote to memory of 6016	2776	powershell.exe	95
PID 2776 wrote to memory of 6016	2776	powershell.exe	95
PID 2776 wrote to memory of 6016	2776	powershell.exe	95
PID 2776 wrote to memory of 6016	2776	powershell.exe	95
PID 2776 wrote to memory of 6016	2776	powershell.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\INFORME JUDICIAL RADICADO FMI0156923511 FORMATO IMPUESTO JUZGADO CIVILpdf.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:5992
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\wzixdgrp\svc_53365_d66a.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\klwp0zzg\klwp0zzg.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E53.tmp" "c:\Users\Admin\AppData\Local\Temp\klwp0zzg\CSC9DE8FE5C43EC4EA58E136F89ABCF9E3.TMP"
      4⤵
      PID:4288
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6016

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5E53.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5E53.tmp
Size 1KB
SHA256 975912d5eb6fc7d954faef6b4a558b8340ac8ed555fb48ce0e38ddd19097a08b
MD5 a59d07ad8f06b0e853da6d9233082b56
SHA1 94b3756e1af360a91bf7fc71dbca5aa1b4fdd5bf
SHA512 ebde02124b46bb942ebf4a1f82a03c7e3663a583d2501a58f96e54fc237a071f752a86a636d1ada16685458c65acc08b21c7da1dde5fa0d8b97a05607410552b
TLSH
T1AC218C0693E9470EF0774731ADF5572FA278FD55EFA3639A454042292C41544DEA0B73
MD5 SHA1 SHA512 TLSH

Submit Download

klwp0zzg.dll

Path C:\Users\Admin\AppData\Local\Temp\klwp0zzg\klwp0zzg.dll
Size 5KB
SHA256 a2b4154e02ba4b518a818b0aaa03d99eb7cb1c545a972b6502079f913221f8c6
MD5 477df0fc3a3163722b8eda0c9295c729
SHA1 7afca33c7521027b41540bfabaf9eee4d615ec89
SHA512 819231fc51e66e62a7b4dc71cb81acee9ece0ebce058143d4bd76ae67a3242f3e0c7aa5329dfcd8574987cc98f9585c6a0be025dda908406ff02424b90ec0327
SSDEEP 48:6o1WqBYjSJHNDZMSaJD5a+5iFNaVjqbIIfib1gbmgDngdJdpjB8o+1ulFa3pq:g4YjSJHpZMnJNtiKere8s3K
TLSH
T122B1511AD3DC0592F5AB033CBCF70716E774E8944B2BCB6F19C0412A2C7BB641925BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_53365_d66a.ps1

Path C:\Users\Admin\AppData\Local\Temp\wzixdgrp\svc_53365_d66a.ps1
Size 51KB
SHA256 1d1106cfef2d8996f7fcc958f5e7bafb71f32f88647e18186ec5fe265a5a502e
MD5 3d0feb899be2028ca57ca74044a2a62f
SHA1 e21730655c6fd3b9381a6a071e7b76b244dfa349
SHA512 12172f9798ec6913ea21c6e406396719785f9627fab46b157520fa289022f8f14d8dc4be57c3344fd216a2438552eab74d4303db2dfda35dde41c8a35b080dfd
SSDEEP 1536:Gwzy/62+SClCWTtgOm+2FQfRL7vVA2MPtdMNBV7Y:W/62adTtObFQZLL22M1CNBi
TLSH
T19D33BE162DD5BBA365E7046479C271862907632B2CBE2F26F46CD5F0EF4B24DE024AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC9DE8FE5C43EC4EA58E136F89ABCF9E3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\klwp0zzg\CSC9DE8FE5C43EC4EA58E136F89ABCF9E3.TMP
Size 652B
SHA256 77f04e4371cfc97bd20d69fbbf18bab36eff511ace3da26bd276374cb6155133
MD5 856b04b47805c274aabbacade2c03435
SHA1 361c54f5338c25f7442963f9a427f26a79bfc1ee
SHA512 34dc78be8777385ce85ac58f535813e29eb5d6466dac30812c8d4ea5813783456be2285bdd39a8d06ed83d09bd4add953b249e7d13d21b48126fc6071ff40670
TLSH
T1D7F05E0A63F8020EF4F34B71BDF6536791ACBC64DF3393ED148003192864A108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

klwp0zzg.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\klwp0zzg\klwp0zzg.0.cs
Size 3KB
SHA256 d7603f5d018b5911bec49d7b9f4af4432a1bfe65569477fd3e2380cc439fe0f9
MD5 2a206de1a016d16431401f75cef137da
SHA1 b39ba632fb7d9b4788b9bd1829782977f3be84b9
SHA512 b39b6a8259eb47678b1e865a96260c88ffbf2cdc04e550c03a1a5599c73d5535050c1eb9155c96e364e009712cc46c7af435250467b5fc6e7be4eca3accc4c2f
TLSH
T15F613328136687A024D71025FA87A08BF613407329FF9C3079FD47261F8B249E4B2B6E
MD5 SHA1 SHA512 TLSH

Submit Download

klwp0zzg.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\klwp0zzg\klwp0zzg.cmdline
Size 369B
SHA256 3257225378a252a8094e886b2d54ca8feaaad8bc22af7da609f76173a53f3459
MD5 2b37d4ccd9469fbf79e8ecfed38b7ecc
SHA1 40dd41b3c00cd54da4db5e4b63a18f47c2b1dbfc
SHA512 7ddd2bed2d282a1e576fd80161c9515e2e1f5f6d1f4b4b85e105ee30044abd134929e189a999314b119293ba7504876a57039f87de21c2b15629952c3e7a148e
TLSH
T179E0682B424FC67D01D9100725A9C4AC83B207433940BFC85045442ED01B04227E2771
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2776-8-0x0000000005520000-0x0000000005586000-memory.dmp

Download

memory/2776-6-0x0000000074A20000-0x00000000751DC000-memory.dmp

Download

memory/2776-12-0x00000000056C0000-0x0000000005A1B000-memory.dmp

Download

memory/2776-13-0x0000000005C00000-0x0000000005C1E000-memory.dmp

Download

memory/2776-14-0x0000000005C60000-0x0000000005CAC000-memory.dmp

Download

memory/2776-2-0x0000000074A32000-0x0000000074A33000-memory.dmp

Download

memory/2776-16-0x0000000007370000-0x00000000079EC000-memory.dmp

Download

memory/2776-17-0x0000000006170000-0x000000000618A000-memory.dmp

Download

memory/2776-7-0x0000000004E30000-0x0000000004E52000-memory.dmp

Download

memory/2776-9-0x0000000005590000-0x00000000055F6000-memory.dmp

Download

memory/2776-5-0x0000000004E60000-0x00000000054AA000-memory.dmp

Download

memory/2776-4-0x0000000074A20000-0x00000000751DC000-memory.dmp

Download

memory/2776-3-0x00000000026F0000-0x0000000002726000-memory.dmp

Download

memory/2776-30-0x00000000061E0000-0x00000000061E8000-memory.dmp

Download

memory/2776-37-0x0000000074A20000-0x00000000751DC000-memory.dmp

Download

memory/2776-32-0x0000000006EF0000-0x0000000006F86000-memory.dmp

Download

memory/2776-34-0x0000000006C60000-0x0000000006C82000-memory.dmp

Download

memory/2776-35-0x0000000007FB0000-0x000000000856A000-memory.dmp

Download

memory/6016-33-0x0000000005880000-0x000000000591C000-memory.dmp

Download

memory/6016-31-0x0000000000400000-0x000000000040E000-memory.dmp

Download