xworm | 64d49ad85df52654e9c6365a75daea6cd7ec00d326ca1a7146acdf40173f4cd4

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_8a32204427cd6104d988c47e0c7107bf_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 35.9MB
Sample260831-kfpx2afd73
SHA256 64d49ad85df52654e9c6365a75daea6cd7ec00d326ca1a7146acdf40173f4cd4
MD5 8a32204427cd6104d988c47e0c7107bf
SHA1 b4c4b928a30b2c493ed89bffc3d1875164bcfaf6
SHA512 44d80823adf95dc06853541d1fdedf4eb76be57d46ef00b64f0e90e943d69df77c1841f3fda7508f82de7782dc7d4c510c4509f6f85bda779756a5864592b19d
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYft:fMguj8Q4VfvjqFTrYu
TLSH
T17D878B0773E60095E9B7D1388AA65507D773B8638331CBDF329D06152FABAD09A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

Mutex

YoU3NMvZy6ey3l5u

Attributes

Install_directory
%ProgramData%
install_file
svchost.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c25f-4.dat	family_xworm
behavioral2/memory/2740-6-0x0000000000730000-0x0000000000740000-memory.dmp	family_xworm

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c25f-4.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/2740-6-0x0000000000730000-0x0000000000740000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
840	powershell.exe
5988	powershell.exe
2824	powershell.exe
460	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe

Executes dropped EXE 5 IoCs

pid	Process
2740	svchost.exe
5404	svchost.exe
3544	svchost.exe
1528	svchost.exe
4992	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\ProgramData\\svchost.exe"	svchost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
8	raw.githubusercontent.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4820	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4152	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5316	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
840	powershell.exe
840	powershell.exe
5988	powershell.exe
5988	powershell.exe
5988	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
460	powershell.exe
460	powershell.exe
460	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	svchost.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeIncreaseQuotaPrivilege	840	powershell.exe
Token: SeSecurityPrivilege	840	powershell.exe
Token: SeTakeOwnershipPrivilege	840	powershell.exe
Token: SeLoadDriverPrivilege	840	powershell.exe
Token: SeSystemProfilePrivilege	840	powershell.exe
Token: SeSystemtimePrivilege	840	powershell.exe
Token: SeProfSingleProcessPrivilege	840	powershell.exe
Token: SeIncBasePriorityPrivilege	840	powershell.exe
Token: SeCreatePagefilePrivilege	840	powershell.exe
Token: SeBackupPrivilege	840	powershell.exe
Token: SeRestorePrivilege	840	powershell.exe
Token: SeShutdownPrivilege	840	powershell.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeSystemEnvironmentPrivilege	840	powershell.exe
Token: SeRemoteShutdownPrivilege	840	powershell.exe
Token: SeUndockPrivilege	840	powershell.exe
Token: SeManageVolumePrivilege	840	powershell.exe
Token: 33	840	powershell.exe
Token: 34	840	powershell.exe
Token: 35	840	powershell.exe
Token: 36	840	powershell.exe
Token: SeDebugPrivilege	5988	powershell.exe
Token: SeIncreaseQuotaPrivilege	5988	powershell.exe
Token: SeSecurityPrivilege	5988	powershell.exe
Token: SeTakeOwnershipPrivilege	5988	powershell.exe
Token: SeLoadDriverPrivilege	5988	powershell.exe
Token: SeSystemProfilePrivilege	5988	powershell.exe
Token: SeSystemtimePrivilege	5988	powershell.exe
Token: SeProfSingleProcessPrivilege	5988	powershell.exe
Token: SeIncBasePriorityPrivilege	5988	powershell.exe
Token: SeCreatePagefilePrivilege	5988	powershell.exe
Token: SeBackupPrivilege	5988	powershell.exe
Token: SeRestorePrivilege	5988	powershell.exe
Token: SeShutdownPrivilege	5988	powershell.exe
Token: SeDebugPrivilege	5988	powershell.exe
Token: SeSystemEnvironmentPrivilege	5988	powershell.exe
Token: SeRemoteShutdownPrivilege	5988	powershell.exe
Token: SeUndockPrivilege	5988	powershell.exe
Token: SeManageVolumePrivilege	5988	powershell.exe
Token: 33	5988	powershell.exe
Token: 34	5988	powershell.exe
Token: 35	5988	powershell.exe
Token: 36	5988	powershell.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeIncreaseQuotaPrivilege	2824	powershell.exe
Token: SeSecurityPrivilege	2824	powershell.exe
Token: SeTakeOwnershipPrivilege	2824	powershell.exe
Token: SeLoadDriverPrivilege	2824	powershell.exe
Token: SeSystemProfilePrivilege	2824	powershell.exe
Token: SeSystemtimePrivilege	2824	powershell.exe
Token: SeProfSingleProcessPrivilege	2824	powershell.exe
Token: SeIncBasePriorityPrivilege	2824	powershell.exe
Token: SeCreatePagefilePrivilege	2824	powershell.exe
Token: SeBackupPrivilege	2824	powershell.exe
Token: SeRestorePrivilege	2824	powershell.exe
Token: SeShutdownPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeSystemEnvironmentPrivilege	2824	powershell.exe
Token: SeRemoteShutdownPrivilege	2824	powershell.exe
Token: SeUndockPrivilege	2824	powershell.exe
Token: SeManageVolumePrivilege	2824	powershell.exe
Token: 33	2824	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5272 wrote to memory of 4152	5272	2026-08-30_8a32204427cd6104d988c47e0c7107bf_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	90
PID 4152 wrote to memory of 4820	4152	cmd.exe	91
PID 4820 wrote to memory of 2740	4820	wscript.exe	92
PID 2740 wrote to memory of 840	2740	svchost.exe	93
PID 2740 wrote to memory of 5988	2740	svchost.exe	96
PID 2740 wrote to memory of 2824	2740	svchost.exe	98
PID 2740 wrote to memory of 460	2740	svchost.exe	100
PID 2740 wrote to memory of 5316	2740	svchost.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-30_8a32204427cd6104d988c47e0c7107bf_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_8a32204427cd6104d988c47e0c7107bf_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript "C:\Users\Admin\AppData\Roaming\run.vbs""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\system32\wscript.exe
    wscript "C:\Users\Admin\AppData\Roaming\run.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:4820
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Creates a file in the Startup directory
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:460
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5316

C:\PROGRA~3\svchost.exe
C:\PROGRA~3\svchost.exe
1⤵
- Executes dropped EXE
PID:3544

C:\ProgramData\svchost.exe
C:\ProgramData\svchost.exe
1⤵
- Executes dropped EXE
PID:5404

C:\ProgramData\svchost.exe
"C:\ProgramData\svchost.exe"
1⤵
- Executes dropped EXE
PID:1528

C:\ProgramData\svchost.exe
"C:\ProgramData\svchost.exe"
1⤵
- Executes dropped EXE
PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b699e97f0868b0b8ae799388aa2d95ea7363a34f2e9cf5a6685ff4d17df64f11
MD5 683c586de389277568abf3b07f6b5a9a
SHA1 9e6659e78a58e5ccfb2dbf5bc9cc8df2ebc2aed2
SHA512 de7dc73a47ed9d41d93b33b4deb4d111c1d75b94e2ba016cb4413f5e0694f57ca1b71045c594acb5aaebbec072f339ec070b6f428840abe4a2560917ba487fd2
TLSH
T1D1216837B3DC8611C89A413A10CDAC1036B6C7DB80DECFAB7B85E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1006a9c8a4e3a0eedd19c26eeab7a525fd616d6b5d6de8406201431838418eb6
MD5 7d0e58403b25df13d6c5f88004225dc3
SHA1 b833123d265eec32aa0f279a49e173aa048664e1
SHA512 bfb2b85cc050db93c2e6cf242df29841af5746dc283eebabfdd6a22d5a6e8d65149451ceca5af3bc827634cc14beb02a052cc2835b9e4a5e223ec9d34057f1aa
TLSH
T18B216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 250fd1562b505953bb079fe3666d695fd9ee78c4b5975f2a9a6e2bc3dc4be691
MD5 a9a331de30a7df0484402b2482f7ac2a
SHA1 30f81742d20ac1b92061cd40d80181e789ec6df8
SHA512 52f97c446c15989bdd7853fc7dadab2f45fa5c164edb0bcdc5338ada29ab0190e20b0823c59d31bb99619ec6f92b53493ed00079298f114d3664ced40be696d0
TLSH
T1A3219833B3CC8614C89E003A10CDAC0036B6CBCB40DECE5B6B80E659A43F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ud1qow4v.bbk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ud1qow4v.bbk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

run.vbs

Path C:\Users\Admin\AppData\Roaming\run.vbs
Size 120B
SHA256 411a8d8e60f0c81d6dbd17f7ee06b2548db2f1b7f8bdc4c6b7bf1ab6b07b5aff
MD5 7c7053ecd0fc2df9cd51dba02aacdf0c
SHA1 d97baff870d10ba70ccdddecfc77c6c49b56a166
SHA512 1847167d33fd7a6b42d1ba85f2c81796e60ea3c87accade5c6f093fa8d494ed4ea7728d7ec027af97cf26b8c10c3cae6a9cb66ae0be2836b8c8085c22de7468b
TLSH
T18DB01225188CC92D509EC0C30B72A40DE9E5AC96B7097C4C8B11E8DC734042CF92B143
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 36KB
SHA256 ac8f7cb7e603a4e24356037f0e586da2984212be236a410f68d95b3b2c29cbcf
MD5 dc503287788dc92a9250987c781e7089
SHA1 b24892b834d5e14b04b2e42503bd1a86cc10d0ac
SHA512 ed03ce4b63edde8c0d5ef29db023e6403a205f28e345aeb4d95d135eb95fea8bd160da9d03edf6295d9a8afd64813e17687fe3e75d9b0895a159ffb704b13102
SSDEEP 768:w5266qeqRyTd7OSFyw9sQQ76KO/hKN7Kiq:w5F6qejTdpFr9sn6KO/QZrq
TLSH
T116F25B0837C04721D6EDAFB469B3A1530679B6178D27EB5E0CD4899B2B37AC18A013F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/840-9-0x0000015574D80000-0x0000015574DA2000-memory.dmp

Download

memory/840-12-0x00000155751A0000-0x00000155751BE000-memory.dmp

Download

memory/840-13-0x0000015575250000-0x0000015575302000-memory.dmp

Download

memory/840-14-0x0000015575190000-0x000001557519A000-memory.dmp

Download

memory/2740-6-0x0000000000730000-0x0000000000740000-memory.dmp

Download