xworm | c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe
Size 2.2MB
Sample260831-cpr5rawtcv
SHA256 c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc
MD5 24716e14e19d191b25146524d92544af
SHA1 069dcc1f535c674c90a389aaa07ede3e734281e9
SHA512 4178a40db0534e50756b2e31b170f240bd7954243e4eef0114684b0d0e7f16293be04bd1f0a622ab9bf5790b12f5c74d969d29983e4bad09cfb975ab45209700
SSDEEP 24576:Bgp5BNnvoCzuSiwznsebo1UsFonsbbHf1H2uAzlMfBNN0OzV6DNUOPXX3n5DpnFz:BgpNQCzziwuTAzlM2N+1ycnZlnm5uo
TLSH
T1DCA5BE14E3E811A9E463DA34CB51A333D6B178624775E49F0A99C30A1F77E928F7B702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

203.202.232.132:2828

Mutex

XUhZctuZtD9oWuI7

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3676-1-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Executes dropped EXE 2 IoCs

pid	Process
1500	c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe
2988	jsc.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppData = "cmd /c start \"\" /D \"C:\\ProgramData\\AppData\" c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe"	c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4100 set thread context of 3676	4100	c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe	88
PID 1500 set thread context of 4956	1500	c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3676	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
3676	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe
2988	jsc.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4100	c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe
Token: SeDebugPrivilege	1500	c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe
Token: SeDebugPrivilege	3676	jsc.exe
Token: SeDebugPrivilege	4956	jsc.exe
Token: SeDebugPrivilege	2988	jsc.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 3676	4100	c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe	88
PID 4100 wrote to memory of 3676	4100	c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe	88
PID 4100 wrote to memory of 3676	4100	c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe	88
PID 4100 wrote to memory of 3676	4100	c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe	88
PID 4100 wrote to memory of 3676	4100	c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe	88
PID 4380 wrote to memory of 1500	4380	cmd.exe	91
PID 1500 wrote to memory of 4956	1500	c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe	92
PID 1500 wrote to memory of 4956	1500	c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe	92
PID 1500 wrote to memory of 4956	1500	c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe	92
PID 1500 wrote to memory of 4956	1500	c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe	92
PID 1500 wrote to memory of 4956	1500	c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe	92
PID 3676 wrote to memory of 2972	3676	jsc.exe	95
PID 2972 wrote to memory of 5356	2972	csc.exe	97
PID 3676 wrote to memory of 2988	3676	jsc.exe	98
PID 3676 wrote to memory of 4496	3676	jsc.exe	99
PID 4496 wrote to memory of 3376	4496	csc.exe	101

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

C:\Users\Admin\AppData\Local\Temp\c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe
"C:\Users\Admin\AppData\Local\Temp\c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:3676
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\jsc.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_ba481b78a6d14c989d68e89d9622bd81.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES63F6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC549D8EB9E1604B5CAF6C87F9B119538A.TMP"
      4⤵
      PID:5356
- - C:\Users\Admin\AppData\Local\Temp\jsc.exe
    "C:\Users\Admin\AppData\Local\Temp\jsc.exe" 3676
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2988
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\jsc.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_dc51ccb44b41475a8e874ff037ffcb01.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC2C0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD72314E0462C4EB39875D3A6D8477668.TMP"
      4⤵
      PID:3376

C:\Windows\system32\cmd.exe
"cmd /c start "" /D "C:\ProgramData\AppData" c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4380
- C:\ProgramData\AppData\c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe
  "C:\ProgramData\AppData\c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe

Path C:\ProgramData\AppData\c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe
Size 2.2MB
SHA256 c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc
MD5 24716e14e19d191b25146524d92544af
SHA1 069dcc1f535c674c90a389aaa07ede3e734281e9
SHA512 4178a40db0534e50756b2e31b170f240bd7954243e4eef0114684b0d0e7f16293be04bd1f0a622ab9bf5790b12f5c74d969d29983e4bad09cfb975ab45209700
SSDEEP 24576:Bgp5BNnvoCzuSiwznsebo1UsFonsbbHf1H2uAzlMfBNN0OzV6DNUOPXX3n5DpnFz:BgpNQCzziwuTAzlM2N+1ycnZlnm5uo
TLSH
T1DCA5BE14E3E811A9E463DA34CB51A333D6B178624775E49F0A99C30A1F77E928F7B702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES63F6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES63F6.tmp
Size 1KB
SHA256 b56d095a225e456595e2c8bb7dc4290bef67935348afff7edc4da83e3e737676
MD5 de133379e57b7224eaf591286f8162d4
SHA1 cbc9d1232af852b32c5ad3a4243f039893628edd
SHA512 a102a34f3df58be3ca0f3ae1672f608e134f47c8c2b1c44e86a5f4133e3cd9822ae75da3ca3c321c97ce473d79ad1e349c20dd342a6d0710b667fd7824034518
TLSH
T11441534083D84B1FF072433168F7532AA678BD61AE9A475D7484032F1E02784DDC32B1
MD5 SHA1 SHA512 TLSH

Submit Download

RESC2C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC2C0.tmp
Size 1KB
SHA256 6e230a48eeb7db5870d7cc543fd153f7d3d041e5a3eae3e9964b4babde58fd24
MD5 7eeaffb2d0a213dd2dc9a9b2216ffec2
SHA1 b1bc5f708fe042a017834017db52c0d5d73966ca
SHA512 b838060b0920b7a1d643a70c9c62f407f4c8d2b97abdce5c09b63274d3459385c17ea632ac650e29a8779c7f80f265de9659baa3eb40f6b6d2d17ec7d775274f
TLSH
T1AF41534093EC8B1FF132433128F75329A678BD519EAE575D7584022F1E02740DDC32B1
MD5 SHA1 SHA512 TLSH

Submit Download

jsc.exe

Path C:\Users\Admin\AppData\Local\Temp\jsc.exe
Size 5KB
SHA256 353d2612ff89bc1679fcef85b94825d45cba1e757c011387faefef420f20b152
MD5 36eef0731217448dc4b232bd44473762
SHA1 29d2179214f500b3960b4c3f22d3a3a5f53c18eb
SHA512 a73f73aa52b8e645a14546e48de5884c7e49de08b974d8ca32aefcd13baa13a947680a695347bb42e69e09042ced637d992bb17e4f5a45b1744ac49d1ae142bc
SSDEEP 96:Zdew7V9c5p3Cdck8BynqgHlNxPvEO7M1ayFuzNt:ZvScoyqgHj+O7Mno
TLSH
T1B0C1D74787DC43AAE4660770B8B313512774D8124BBBAB9F29E4133B7EB635018536F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC549D8EB9E1604B5CAF6C87F9B119538A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC549D8EB9E1604B5CAF6C87F9B119538A.TMP
Size 1KB
SHA256 97d5b2464371cc9a0712dd5dcb1b83940b3c9e3bbe505e5a068f4126def9b567
MD5 989d1f618c8d6fa47385bb96fd7852f6
SHA1 9fdc9f62ad54d80d3c31523e9d126c0646d93a2e
SHA512 e70ef3f3fef6fad9f7a3fe8a5bc0cd2413716eb6ac8effe96640236c47f14ca28c9641929935ef63c06f370adc787807dcff40712ec9dbbaf15af49822362b9b
TLSH
T15A21CE81A3E8421EF2B34B7079F2C363956DBE668DBA47EC34C8175F1F15A1085936B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_ba481b78a6d14c989d68e89d9622bd81.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_ba481b78a6d14c989d68e89d9622bd81.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2988-25-0x0000000000980000-0x0000000000988000-memory.dmp

Download

memory/3676-8-0x0000000074982000-0x0000000074983000-memory.dmp

Download

memory/3676-1-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3676-12-0x00000000078D0000-0x0000000007E8A000-memory.dmp

Download

memory/3676-13-0x0000000001460000-0x00000000014DC000-memory.dmp

Download

memory/3676-14-0x0000000001420000-0x0000000001428000-memory.dmp

Download

memory/3676-10-0x0000000005E50000-0x0000000005EB6000-memory.dmp

Download

memory/3676-9-0x0000000074970000-0x000000007512C000-memory.dmp

Download

memory/3676-11-0x0000000007270000-0x0000000007302000-memory.dmp

Download

memory/3676-7-0x0000000074970000-0x000000007512C000-memory.dmp

Download

memory/3676-3-0x0000000005650000-0x00000000056EC000-memory.dmp

Download

memory/3676-26-0x0000000008190000-0x0000000008352000-memory.dmp

Download

memory/3676-27-0x0000000006E20000-0x0000000006E54000-memory.dmp

Download

memory/3676-28-0x0000000006E70000-0x0000000006E76000-memory.dmp

Download

memory/3676-2-0x0000000074982000-0x0000000074983000-memory.dmp

Download