xworm | bbd9197767896d6730137ec8c36ae91cdd8980af2f9c275f670824de215e7507

Analysis

max time kernel
149s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/09/2026, 23:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XWorm REC.exe
Size 569KB
Sample260901-3gyknsfc66
SHA256 bbd9197767896d6730137ec8c36ae91cdd8980af2f9c275f670824de215e7507
MD5 4bffde918b6138d365fb3fc3bd1b93f0
SHA1 7acc7c28acd690bb7a54b3febce7a7768d3cbfbd
SHA512 e4ad5de258f02fa2b4555cc970ba865de6d25420ae73324abfc0e34012e5dfd8c61de45c93231c10ae2601202d3fab733a9222bb27e00db67643455219eea2ed
SSDEEP 12288:MpMLK6jZH41G9PMvD3qjR4925qaKpmLQXt9Ns+F:Mj64G9KTqdjqbV
TLSH
T1A3C4CF117DC5FED3E916217C3E800275905885AF8DEB068B35C4BAAE76E784F0F8994E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm persistence rat trojan

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral3/files/0x00050000000067b8-7.dat	family_xworm

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\Control Panel\International\Geo\Nation	XWorm REC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\Control Panel\International\Geo\Nation	rce .exe
Key value queried	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\Control Panel\International\Geo\Nation	svshost.exe

Executes dropped EXE 7 IoCs

pid	Process
4128	rce .exe
3700	XWormExploit.exe
2360	svshost.exe
4452	svshost.exe
1920	svshost.exe
4700	svshost.exe
2900	svshost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3120	schtasks.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2360	svshost.exe
Token: SeDebugPrivilege	4452	svshost.exe
Token: SeDebugPrivilege	1920	svshost.exe
Token: SeDebugPrivilege	4700	svshost.exe
Token: SeDebugPrivilege	2900	svshost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 4128	4916	XWorm REC.exe	82
PID 4128 wrote to memory of 3700	4128	rce .exe	83
PID 4128 wrote to memory of 2360	4128	rce .exe	86
PID 2360 wrote to memory of 3120	2360	svshost.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XWorm REC.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm REC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4916
- C:\ProgramData\rce .exe
  "C:\ProgramData\rce .exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Users\Admin\AppData\Local\Temp\MasonDrop\XWormExploit.exe
    "C:\Users\Admin\AppData\Local\Temp\MasonDrop\XWormExploit.exe"
    3⤵
    - Executes dropped EXE
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\MasonDrop\svshost.exe
    "C:\Users\Admin\AppData\Local\Temp\MasonDrop\svshost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "svshost" /tr "C:\Users\Admin\AppData\Roaming\svshost.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3120

C:\Users\Admin\AppData\Roaming\svshost.exe
C:\Users\Admin\AppData\Roaming\svshost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Users\Admin\AppData\Roaming\svshost.exe
"C:\Users\Admin\AppData\Roaming\svshost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Users\Admin\AppData\Roaming\svshost.exe
"C:\Users\Admin\AppData\Roaming\svshost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Users\Admin\AppData\Roaming\svshost.exe
"C:\Users\Admin\AppData\Roaming\svshost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rce .exe

Path C:\ProgramData\rce .exe
Size 401KB
SHA256 eef59b2a1d8f53db30a69df5b04551cd7e87e9302550106e0c1a8869e86eecb3
MD5 e1faf4300591d4fd25159d8d04b3350d
SHA1 12d0f7a74414e6e63f52ec3a8cfc38f69c994417
SHA512 ade3cc92214efd1f0b5cf8c5c5ec56c7f67bb7ea21a50ae195c5944ecfbcab26c9f902e396d4a2863e41c1cff74de100b9d2e63b2163048cc3a135529f477e8e
SSDEEP 6144:J6P5/GWGwqqm1BcmeLFKiIyfqpLbq+hCy:a+F9IzIDhCy
TLSH
T1DB943A29B884BCD2F996513D3E8862214374416F8EE707AF35C466AF36B35CB4F8458E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svshost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svshost.exe.log
Size 654B
SHA256 d39a78fabca39532fcb85ce908781a75132e1bd01cc50a3b290dd87127837d63
MD5 11c6e74f0561678d2cf7fc075a6cc00c
SHA1 535ee79ba978554abcb98c566235805e7ea18490
SHA512 32c63d67bf512b42e7f57f71287b354200126cb417ef9d869c72e0b9388a7c2f5e3b61f303f1353baa1bf482d0f17e06e23c9f50b2f1babd4d958b6da19c40b0
TLSH
T136F0783432A2E1D5C9127F111C1D298452AF8386B6A0AF1C7A68935DD8261376F313F3
MD5 SHA1 SHA512 TLSH

Submit Download

XWormExploit.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\XWormExploit.exe
Size 151KB
SHA256 a4e7373746cce8039c09a6bcae96d1c809d59f72f428b029757d4744cd4e28b5
MD5 b2099cbdf3543a508446e930e440f3ea
SHA1 fe5d3578c265d1f17dc4da7e0fe1915f3a11d2d5
SHA512 50aefeba5880df59fc06fb76c8fd93c93bba582e6fb6beb18a3ec937439fe2d80363fcf51802acf7182c1e7c26f5c45bdb4e0ff6007b478ec353dfb8a5370f91
SSDEEP 1536:RIPXlnVNi2AP+ew+ksEvCwVwLM+uvpIVyXJyozbGyMqmyVttdGFQeOPigp3dIHyU:aVn5A2ewhLapuvpAsZOyMqmyBeYVYB
TLSH
T19EE37B65AEDFDDA3D2AB25748D658130203C9C6F58F7411716813B8CEBBFAAD0395A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svshost.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\svshost.exe
Size 224KB
SHA256 9393422930c95ab3bd6218520dc61f643c4ea26577de8de870eff788a2da4822
MD5 2de7d70b20e19cf7616e7d6d3d5163d7
SHA1 17c1b4265c9fda826a49ec48f8bdfab422edc0cc
SHA512 fd978fb55e4febf477e99368806e576f9e32d28fcfa9819318cfea7208f6f7def64f8cb345c9d1a85f390eaff38ce89e842460189a943e2b38cb81e19b51ed6c
SSDEEP 3072:OI05ustFdkxB0UE+PwDuyj/Z1xy2rKGL2ehHWRIBfWlz1kILbqEB5C98hhCp:jcmeLFKiIyfqpLbq+hC
TLSH
T1BE24E529B040BCD2F995923D3B8862528364416FCF9707EE35D866AF32A35CB4F895CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2360-44-0x0000000000D40000-0x0000000000D84000-memory.dmp

Download

memory/2360-45-0x0000000001540000-0x0000000001548000-memory.dmp

Download

memory/3700-34-0x0000000000660000-0x000000000068C000-memory.dmp

Download

memory/4128-46-0x00007FF751900000-0x00007FF75190D000-memory.dmp

Download

memory/4916-0-0x0000000000560000-0x00000000005F6000-memory.dmp

Download

memory/4916-1-0x000000001B3A0000-0x000000001B3B0000-memory.dmp

Download

memory/4916-2-0x0000000002580000-0x00000000025EA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads