xworm | 3e8758dc4351bf1868de049745018d22b2d5f28cf6c3d2b92b1de3d9ef05a3dd

Analysis

user interaction
yes
max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XBinderOutput.exe
Size 12.8MB
Sample260905-mthf8aar5t
SHA256 3e8758dc4351bf1868de049745018d22b2d5f28cf6c3d2b92b1de3d9ef05a3dd
MD5 0df65b9a739009b526dd7270fc58cb0a
SHA1 7de5108ea42e148684c192b380023dc6b3b2864c
SHA512 30bd7c0d6494d87d368baf3fae795d4d3efad11ccc2ab4557604778697960f32bb561818a315de2fe7ea488839645356d3c51765348b219866cbc9bd3d2baa38
SSDEEP 393216:4Dl20nxLL2EljFNYc0b64kSxz4mq/pkOYxehohbt:4DNnx2+5NYZbDEZ/pjY
TLSH
T1BFD63317AF62678FC0C6D13E29DF731493E850F07AE6F62E37908742946D8C1924AD6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

gkjfndgkzdfhngfkh-30595.portmap.host:30595

Mutex

QVDhErkvmrwTXjyw

Attributes

install_file
USB.exe
localhost
127.0.0.1

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c613-51.dat	family_xworm
behavioral2/memory/3476-56-0x0000000000F40000-0x0000000000F4E000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3404	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
6508	Xworm V5.6.exe
3476	XClient.exe
6964	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Windows\\System32\\XClient.exe"	XBinderOutput.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\XClient.exe	XBinderOutput.exe
File opened for modification	C:\Windows\System32\XClient.exe	XBinderOutput.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Xworm V5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Xworm V5.6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Xworm V5.6.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	XBinderOutput.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3404	powershell.exe
3404	powershell.exe
3404	powershell.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeIncreaseQuotaPrivilege	3404	powershell.exe
Token: SeSecurityPrivilege	3404	powershell.exe
Token: SeTakeOwnershipPrivilege	3404	powershell.exe
Token: SeLoadDriverPrivilege	3404	powershell.exe
Token: SeSystemProfilePrivilege	3404	powershell.exe
Token: SeSystemtimePrivilege	3404	powershell.exe
Token: SeProfSingleProcessPrivilege	3404	powershell.exe
Token: SeIncBasePriorityPrivilege	3404	powershell.exe
Token: SeCreatePagefilePrivilege	3404	powershell.exe
Token: SeBackupPrivilege	3404	powershell.exe
Token: SeRestorePrivilege	3404	powershell.exe
Token: SeShutdownPrivilege	3404	powershell.exe
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeSystemEnvironmentPrivilege	3404	powershell.exe
Token: SeRemoteShutdownPrivilege	3404	powershell.exe
Token: SeUndockPrivilege	3404	powershell.exe
Token: SeManageVolumePrivilege	3404	powershell.exe
Token: 33	3404	powershell.exe
Token: 34	3404	powershell.exe
Token: 35	3404	powershell.exe
Token: 36	3404	powershell.exe
Token: SeDebugPrivilege	3476	XClient.exe
Token: SeDebugPrivilege	6964	XClient.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4796	OpenWith.exe
4936	OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 6508	4084	XBinderOutput.exe	91
PID 4084 wrote to memory of 3404	4084	XBinderOutput.exe	94
PID 4084 wrote to memory of 3476	4084	XBinderOutput.exe	97

C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe
"C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
  "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates system info in registry
  PID:6508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3404
- C:\Windows\System32\XClient.exe
  "C:\Windows\System32\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3476

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4936

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4796

C:\Windows\System32\XClient.exe
C:\Windows\System32\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GeoIP.dat

Path C:\Users\Admin\AppData\Local\Temp\GeoIP.dat
Size 1.2MB
SHA256 bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
MD5 8ef41798df108ce9bd41382c9721b1c9
SHA1 1e6227635a12039f4d380531b032bf773f0e6de0
SHA512 4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
SSDEEP 24576:0L/59ah0USm3uwl00odi9AnW1fUmdbxv6bA3wOzRAc3InsZLONMrZb:+/59a6USdi9Ues6bV6boLO6rZ
TLSH
T10C457B47FF0A85DB5845B91EF9019EDC5810EE76BD0A1335226E37ACA0B8360ECD71A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Guna.UI2.dll

Path C:\Users\Admin\AppData\Local\Temp\Guna.UI2.dll
Size 1.9MB
SHA256 c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
MD5 bcc0fe2b28edd2da651388f84599059b
SHA1 44d7756708aafa08730ca9dbdc01091790940a4f
SHA512 3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
SSDEEP 24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw
TLSH
T1EE9508007ED0DB26D16B4E33D5E75010D3F2B4A26BB2E70F72D5A77C145378AA88A366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xworm V5.6.exe

Path C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
Size 14.9MB
SHA256 90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405
MD5 56ccb739926a725e78a7acf9af52c4bb
SHA1 5b01b90137871c3c8f0d04f510c4d56b23932cbc
SHA512 2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1
SSDEEP 196608:P4/BAe1d4ihvy85JhhYc3BSL1kehn4inje:PuyIhhkRka4i
TLSH
T10EF69D107BD68006E47269B00A946AE199BEBEAF2B15D8AD30C4335C17F64CCF953BF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xworm V5.6.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe.config
Size 183B
SHA256 7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7
MD5 66f09a3993dcae94acfe39d45b553f58
SHA1 9d09f8e22d464f7021d7f713269b8169aed98682
SHA512 c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed
TLSH
T171C0122940A8BD269D328A279252C962FFB022A2A024000CF02FAA670B3105D4257326
MD5 SHA1 SHA512 TLSH

Submit Download

XClient.exe

Path C:\Windows\System32\XClient.exe
Size 32KB
SHA256 47a80e14338b15060133dd4cc4328314d1793570cb81e355ceb1f5b8c5004153
MD5 6ee96317949ca359c96832912006fe01
SHA1 fec0a4e2eb510feb045faf9dd581e17f85e02a96
SHA512 749d9bd5abdee64df1f74575e027b9651e7ecea4f8fa1db402a1f6c6999f2f161e9ea9443de6ba9ee3b0d509a112451ab9ee24eddea19e52a77126d68c64e264
SSDEEP 384:5cmKc71F3BUaMbGf/JLbFt3Tm2eaFO4FzRApkFTBLTsOZwpGd2v99Ikuis32VFxz:ia1LxMC1Jt3Tw49FzVFE9jmsOjhGb3
TLSH
T1AAE23A4877944312DAFEAFB52DF362061271D517E813EFAE0CE485E62F67AC087407A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3404-44-0x0000015B6CB70000-0x0000015B6CC22000-memory.dmp

Download

memory/3404-40-0x0000015B6CAB0000-0x0000015B6CAD2000-memory.dmp

Download

memory/3404-45-0x0000015B6CC30000-0x0000015B6CC3A000-memory.dmp

Download

memory/3404-43-0x0000015B6CB50000-0x0000015B6CB6E000-memory.dmp

Download

memory/3476-65-0x0000000003130000-0x000000000313C000-memory.dmp

Download

memory/3476-56-0x0000000000F40000-0x0000000000F4E000-memory.dmp

Download

memory/4084-3-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/4084-0-0x00007FFB0B1BF000-0x00007FFB0B1C0000-memory.dmp

Download

memory/4084-5-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/4084-1-0x0000000000240000-0x0000000000F10000-memory.dmp

Download

memory/4084-57-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/4084-4-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/4084-2-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/4084-6-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6508-24-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6508-17-0x0000028599180000-0x000002859A068000-memory.dmp

Download

memory/6508-19-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6508-18-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6508-25-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6508-20-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6508-23-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6508-22-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6508-59-0x00000285B62C0000-0x00000285B64B4000-memory.dmp

Download

memory/6508-64-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6508-21-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download