xworm | 0be14df0c5bd8d9cd0871229217d5c920b7a780156eaf9ac777f98cdd5ec4106

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New folder/V1.exe
Size 174KB
Sample260901-vt57aatbpd
SHA256 0be14df0c5bd8d9cd0871229217d5c920b7a780156eaf9ac777f98cdd5ec4106
MD5 ab200c576e4c303cde48d87b30ad3d1a
SHA1 1b9cbce1479accb1c64a83539ac6b9ed611cc368
SHA512 9b484095331913a0610b548aa1bc0ac8ef8a8e6a1b27a4dd9ccccb558698fb9c41684725612f7716e01c4c3286eacc20439c80e09a76d18f81dee33184809715
SSDEEP 3072:U7oNgA02bb9cQ0OP8KBz65/M6If+3Js+3JFkKeTno:U0gA02buQJxBt25
TLSH
T1CD045B41B791C2A1E4BD4B33D4A6E5F14F32BD2BEF06691F3484BB4739331419D22A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

162.120.184.44:50538

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4352-1-0x0000000000040000-0x0000000000072000-memory.dmp	family_xworm
behavioral2/files/0x001100000001c537-51.dat	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3612	powershell.exe
4304	powershell.exe
2464	powershell.exe
1212	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	V1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	V1.exe

Executes dropped EXE 3 IoCs

pid	Process
2492	XClient.exe
4008	XClient.exe
5776	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	V1.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1188	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4352	V1.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3612	powershell.exe
3612	powershell.exe
3612	powershell.exe
4304	powershell.exe
4304	powershell.exe
4304	powershell.exe
2464	powershell.exe
2464	powershell.exe
2464	powershell.exe
1212	powershell.exe
1212	powershell.exe
1212	powershell.exe
4352	V1.exe
4352	V1.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4352	V1.exe
Token: SeDebugPrivilege	3612	powershell.exe
Token: SeIncreaseQuotaPrivilege	3612	powershell.exe
Token: SeSecurityPrivilege	3612	powershell.exe
Token: SeTakeOwnershipPrivilege	3612	powershell.exe
Token: SeLoadDriverPrivilege	3612	powershell.exe
Token: SeSystemProfilePrivilege	3612	powershell.exe
Token: SeSystemtimePrivilege	3612	powershell.exe
Token: SeProfSingleProcessPrivilege	3612	powershell.exe
Token: SeIncBasePriorityPrivilege	3612	powershell.exe
Token: SeCreatePagefilePrivilege	3612	powershell.exe
Token: SeBackupPrivilege	3612	powershell.exe
Token: SeRestorePrivilege	3612	powershell.exe
Token: SeShutdownPrivilege	3612	powershell.exe
Token: SeDebugPrivilege	3612	powershell.exe
Token: SeSystemEnvironmentPrivilege	3612	powershell.exe
Token: SeRemoteShutdownPrivilege	3612	powershell.exe
Token: SeUndockPrivilege	3612	powershell.exe
Token: SeManageVolumePrivilege	3612	powershell.exe
Token: 33	3612	powershell.exe
Token: 34	3612	powershell.exe
Token: 35	3612	powershell.exe
Token: 36	3612	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeIncreaseQuotaPrivilege	4304	powershell.exe
Token: SeSecurityPrivilege	4304	powershell.exe
Token: SeTakeOwnershipPrivilege	4304	powershell.exe
Token: SeLoadDriverPrivilege	4304	powershell.exe
Token: SeSystemProfilePrivilege	4304	powershell.exe
Token: SeSystemtimePrivilege	4304	powershell.exe
Token: SeProfSingleProcessPrivilege	4304	powershell.exe
Token: SeIncBasePriorityPrivilege	4304	powershell.exe
Token: SeCreatePagefilePrivilege	4304	powershell.exe
Token: SeBackupPrivilege	4304	powershell.exe
Token: SeRestorePrivilege	4304	powershell.exe
Token: SeShutdownPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeSystemEnvironmentPrivilege	4304	powershell.exe
Token: SeRemoteShutdownPrivilege	4304	powershell.exe
Token: SeUndockPrivilege	4304	powershell.exe
Token: SeManageVolumePrivilege	4304	powershell.exe
Token: 33	4304	powershell.exe
Token: 34	4304	powershell.exe
Token: 35	4304	powershell.exe
Token: 36	4304	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeIncreaseQuotaPrivilege	2464	powershell.exe
Token: SeSecurityPrivilege	2464	powershell.exe
Token: SeTakeOwnershipPrivilege	2464	powershell.exe
Token: SeLoadDriverPrivilege	2464	powershell.exe
Token: SeSystemProfilePrivilege	2464	powershell.exe
Token: SeSystemtimePrivilege	2464	powershell.exe
Token: SeProfSingleProcessPrivilege	2464	powershell.exe
Token: SeIncBasePriorityPrivilege	2464	powershell.exe
Token: SeCreatePagefilePrivilege	2464	powershell.exe
Token: SeBackupPrivilege	2464	powershell.exe
Token: SeRestorePrivilege	2464	powershell.exe
Token: SeShutdownPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeSystemEnvironmentPrivilege	2464	powershell.exe
Token: SeRemoteShutdownPrivilege	2464	powershell.exe
Token: SeUndockPrivilege	2464	powershell.exe
Token: SeManageVolumePrivilege	2464	powershell.exe
Token: 33	2464	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4352	V1.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 3612	4352	V1.exe	90
PID 4352 wrote to memory of 4304	4352	V1.exe	93
PID 4352 wrote to memory of 2464	4352	V1.exe	96
PID 4352 wrote to memory of 1212	4352	V1.exe	98
PID 4352 wrote to memory of 1188	4352	V1.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\New folder\V1.exe
"C:\Users\Admin\AppData\Local\Temp\New folder\V1.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\New folder\V1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'V1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1212
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1188

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
PID:2492

C:\Users\Admin\AppData\Roaming\XClient.exe
"C:\Users\Admin\AppData\Roaming\XClient.exe"
1⤵
- Executes dropped EXE
PID:4008

C:\Users\Admin\AppData\Roaming\XClient.exe
"C:\Users\Admin\AppData\Roaming\XClient.exe"
1⤵
- Executes dropped EXE
PID:5776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 120f661670b9c9bcef6fa45b38c693ea6166a266146df31d722eb6ed8a06b221
MD5 220d7629912a8fecde10014b46c1efba
SHA1 e041e3f3af622f37660165e7b68741875f7ec838
SHA512 9c5658995eea147b95774e8f0acb6eeba2cd715887b6fa497d0c82a154078ffc93356983fb8902fb00383745255939d0e874a4a0c7d38f2857882d0155bf8624
TLSH
T1B4216833F3DD8624D89A413A10CDAC1036B6C7DB41DFCFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 79e91509bb729729697fd44a5cb8647fa7d4e1e56d08f73df9ecf744e3fe0dac
MD5 846a10fd27e3aad4dfef1d3c56197adf
SHA1 2000391af2f6015cfff5a059fbac3f2f9bfda1a2
SHA512 2037c5fda8286422741b51cdbf0c85125508019c201fc8c0a5ec21c4f3b9be225c875a86e26ca334c9fb744afb8a0ad44c15e819033f721d7fd6a7e417360edd
TLSH
T15F219833F3CC8614C89A003A10CDAC0036B6CBCB40DECE5B6B80E659A43F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ocfok4i4.h3x.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ocfok4i4.h3x.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

XClient.exe

Path C:\Users\Admin\AppData\Roaming\XClient.exe
Size 174KB
SHA256 0be14df0c5bd8d9cd0871229217d5c920b7a780156eaf9ac777f98cdd5ec4106
MD5 ab200c576e4c303cde48d87b30ad3d1a
SHA1 1b9cbce1479accb1c64a83539ac6b9ed611cc368
SHA512 9b484095331913a0610b548aa1bc0ac8ef8a8e6a1b27a4dd9ccccb558698fb9c41684725612f7716e01c4c3286eacc20439c80e09a76d18f81dee33184809715
SSDEEP 3072:U7oNgA02bb9cQ0OP8KBz65/M6If+3Js+3JFkKeTno:U0gA02buQJxBt25
TLSH
T1CD045B41B791C2A1E4BD4B33D4A6E5F14F32BD2BEF06691F3484BB4739331419D22A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3612-18-0x00000291CE460000-0x00000291CE512000-memory.dmp

Download

memory/3612-20-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp

Download

memory/3612-7-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp

Download

memory/3612-10-0x00000291B5F30000-0x00000291B5F52000-memory.dmp

Download

memory/3612-11-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp

Download

memory/3612-12-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp

Download

memory/3612-13-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp

Download

memory/3612-14-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp

Download

memory/3612-17-0x00000291CE420000-0x00000291CE43E000-memory.dmp

Download

memory/3612-28-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp

Download

memory/3612-19-0x00000291CE410000-0x00000291CE41A000-memory.dmp

Download

memory/3612-27-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp

Download

memory/3612-21-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp

Download

memory/3612-22-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp

Download

memory/3612-23-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp

Download

memory/3612-24-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp

Download

memory/3612-25-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp

Download

memory/4352-6-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp

Download

memory/4352-0-0x00007FFE9769F000-0x00007FFE976A0000-memory.dmp

Download

memory/4352-5-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp

Download

memory/4352-4-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp

Download

memory/4352-3-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp

Download

memory/4352-2-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp

Download

memory/4352-1-0x0000000000040000-0x0000000000072000-memory.dmp

Download