xworm | 8fe4071965b17c86f5a1c5f274147ee4d0fce05f54bf7e29e128b1ee3e75503a

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8fe4071965b17c86f5a1c5f274147ee4d0fce05f54bf7e29e128b1ee3e75503a.exe
Size 128KB
Sample260905-ndfhcsdd93
SHA256 8fe4071965b17c86f5a1c5f274147ee4d0fce05f54bf7e29e128b1ee3e75503a
MD5 8a8569c61b5692e2526ad463746de277
SHA1 e4113b3b182b9bc1c0ab04dd6b13059fe4f37984
SHA512 cacf42f3c8c3b09bb46c1fee6b2ee291700db1e9d65b4b8f93137bbb8d5cd65714e1852e15a4c1fbac68751cfd1e04e93c35bfbd39cc654dda8f6f2627b4f4c3
SSDEEP 3072:iBPereF+5yj4JbM15HyTOph9BeF+YzB1hXeiYY0I26QqZ:wPereFmyEJbgHyyBeYA/mIBp
TLSH
T1A8D3D09D77A04861D3FE0F7548F26361CB76EE639C239B0F54D8229E2633A888F01795
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

7.tcp.cpolar.top:2223

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/5052-1-0x0000000000060000-0x0000000000086000-memory.dmp	family_xworm
behavioral2/files/0x001200000001c503-54.dat	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3512	powershell.exe
4392	powershell.exe
4344	powershell.exe
2516	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	8fe4071965b17c86f5a1c5f274147ee4d0fce05f54bf7e29e128b1ee3e75503a.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	8fe4071965b17c86f5a1c5f274147ee4d0fce05f54bf7e29e128b1ee3e75503a.exe

Executes dropped EXE 3 IoCs

pid	Process
5732	XClient.exe
5640	XClient.exe
5116	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	8fe4071965b17c86f5a1c5f274147ee4d0fce05f54bf7e29e128b1ee3e75503a.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5272	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5052	8fe4071965b17c86f5a1c5f274147ee4d0fce05f54bf7e29e128b1ee3e75503a.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
4392	powershell.exe
4392	powershell.exe
4392	powershell.exe
4344	powershell.exe
4344	powershell.exe
4344	powershell.exe
2516	powershell.exe
2516	powershell.exe
2516	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5052	8fe4071965b17c86f5a1c5f274147ee4d0fce05f54bf7e29e128b1ee3e75503a.exe
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeIncreaseQuotaPrivilege	3512	powershell.exe
Token: SeSecurityPrivilege	3512	powershell.exe
Token: SeTakeOwnershipPrivilege	3512	powershell.exe
Token: SeLoadDriverPrivilege	3512	powershell.exe
Token: SeSystemProfilePrivilege	3512	powershell.exe
Token: SeSystemtimePrivilege	3512	powershell.exe
Token: SeProfSingleProcessPrivilege	3512	powershell.exe
Token: SeIncBasePriorityPrivilege	3512	powershell.exe
Token: SeCreatePagefilePrivilege	3512	powershell.exe
Token: SeBackupPrivilege	3512	powershell.exe
Token: SeRestorePrivilege	3512	powershell.exe
Token: SeShutdownPrivilege	3512	powershell.exe
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeSystemEnvironmentPrivilege	3512	powershell.exe
Token: SeRemoteShutdownPrivilege	3512	powershell.exe
Token: SeUndockPrivilege	3512	powershell.exe
Token: SeManageVolumePrivilege	3512	powershell.exe
Token: 33	3512	powershell.exe
Token: 34	3512	powershell.exe
Token: 35	3512	powershell.exe
Token: 36	3512	powershell.exe
Token: SeDebugPrivilege	4392	powershell.exe
Token: SeIncreaseQuotaPrivilege	4392	powershell.exe
Token: SeSecurityPrivilege	4392	powershell.exe
Token: SeTakeOwnershipPrivilege	4392	powershell.exe
Token: SeLoadDriverPrivilege	4392	powershell.exe
Token: SeSystemProfilePrivilege	4392	powershell.exe
Token: SeSystemtimePrivilege	4392	powershell.exe
Token: SeProfSingleProcessPrivilege	4392	powershell.exe
Token: SeIncBasePriorityPrivilege	4392	powershell.exe
Token: SeCreatePagefilePrivilege	4392	powershell.exe
Token: SeBackupPrivilege	4392	powershell.exe
Token: SeRestorePrivilege	4392	powershell.exe
Token: SeShutdownPrivilege	4392	powershell.exe
Token: SeDebugPrivilege	4392	powershell.exe
Token: SeSystemEnvironmentPrivilege	4392	powershell.exe
Token: SeRemoteShutdownPrivilege	4392	powershell.exe
Token: SeUndockPrivilege	4392	powershell.exe
Token: SeManageVolumePrivilege	4392	powershell.exe
Token: 33	4392	powershell.exe
Token: 34	4392	powershell.exe
Token: 35	4392	powershell.exe
Token: 36	4392	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeIncreaseQuotaPrivilege	4344	powershell.exe
Token: SeSecurityPrivilege	4344	powershell.exe
Token: SeTakeOwnershipPrivilege	4344	powershell.exe
Token: SeLoadDriverPrivilege	4344	powershell.exe
Token: SeSystemProfilePrivilege	4344	powershell.exe
Token: SeSystemtimePrivilege	4344	powershell.exe
Token: SeProfSingleProcessPrivilege	4344	powershell.exe
Token: SeIncBasePriorityPrivilege	4344	powershell.exe
Token: SeCreatePagefilePrivilege	4344	powershell.exe
Token: SeBackupPrivilege	4344	powershell.exe
Token: SeRestorePrivilege	4344	powershell.exe
Token: SeShutdownPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeSystemEnvironmentPrivilege	4344	powershell.exe
Token: SeRemoteShutdownPrivilege	4344	powershell.exe
Token: SeUndockPrivilege	4344	powershell.exe
Token: SeManageVolumePrivilege	4344	powershell.exe
Token: 33	4344	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 3512	5052	8fe4071965b17c86f5a1c5f274147ee4d0fce05f54bf7e29e128b1ee3e75503a.exe	90
PID 5052 wrote to memory of 4392	5052	8fe4071965b17c86f5a1c5f274147ee4d0fce05f54bf7e29e128b1ee3e75503a.exe	93
PID 5052 wrote to memory of 4344	5052	8fe4071965b17c86f5a1c5f274147ee4d0fce05f54bf7e29e128b1ee3e75503a.exe	96
PID 5052 wrote to memory of 2516	5052	8fe4071965b17c86f5a1c5f274147ee4d0fce05f54bf7e29e128b1ee3e75503a.exe	98
PID 5052 wrote to memory of 5272	5052	8fe4071965b17c86f5a1c5f274147ee4d0fce05f54bf7e29e128b1ee3e75503a.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8fe4071965b17c86f5a1c5f274147ee4d0fce05f54bf7e29e128b1ee3e75503a.exe
"C:\Users\Admin\AppData\Local\Temp\8fe4071965b17c86f5a1c5f274147ee4d0fce05f54bf7e29e128b1ee3e75503a.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\8fe4071965b17c86f5a1c5f274147ee4d0fce05f54bf7e29e128b1ee3e75503a.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '8fe4071965b17c86f5a1c5f274147ee4d0fce05f54bf7e29e128b1ee3e75503a.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2516
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5272

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
PID:5732

C:\Users\Admin\AppData\Roaming\XClient.exe
"C:\Users\Admin\AppData\Roaming\XClient.exe"
1⤵
- Executes dropped EXE
PID:5640

C:\Users\Admin\AppData\Roaming\XClient.exe
"C:\Users\Admin\AppData\Roaming\XClient.exe"
1⤵
- Executes dropped EXE
PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
MD5 81b56f1dad28119d54bf23c83fc570b9
SHA1 cb9a89a716465611149ce3c700bd60681d434faf
SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
TLSH
T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f7680072ca5221cf2d0f5ef9769a208e6ade25923ae1978cfe80fbdc4748dc3a
MD5 eb72d559eabf90cedffc8b7cf6f6f8c4
SHA1 d6e019d739b4449f763fe58f6328967e2ca1dd0e
SHA512 077a72e9235386248102f36ab70fd5691aed539416f813bed543681cd2d1caf0d40edd1647933f49412f83cf7d422518cbf1602043709365b25c4cc7267e92a5
TLSH
T16B216837B3DD8614C89A413A10CDAD1036B6CBDB40DECF5B6B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d6adf751a6c0c74bed0bd08508cb3078afcaaba6514718c0db9792bb6a1a02fa
MD5 b20ad66a34d257086e53a5b2b34a7b45
SHA1 65acca05f0cb24d786b137cdb05f8af99ccbf9b7
SHA512 4fe111c650bbe2fb71c9be6826f810c97faa9f05e84c2d31c41f1651f91575fa66dc6bb5c2d85cddb9861b3864bbe52823e1bb46971b1e34dfa34dadf40cd558
TLSH
T181219833B3DC8614C89A003A10CDAC1036B6CBCB40DECE5B6B80E655A43F698CE60060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_l3crl2g5.3hj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l3crl2g5.3hj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

XClient.exe

Path C:\Users\Admin\AppData\Roaming\XClient.exe
Size 128KB
SHA256 8fe4071965b17c86f5a1c5f274147ee4d0fce05f54bf7e29e128b1ee3e75503a
MD5 8a8569c61b5692e2526ad463746de277
SHA1 e4113b3b182b9bc1c0ab04dd6b13059fe4f37984
SHA512 cacf42f3c8c3b09bb46c1fee6b2ee291700db1e9d65b4b8f93137bbb8d5cd65714e1852e15a4c1fbac68751cfd1e04e93c35bfbd39cc654dda8f6f2627b4f4c3
SSDEEP 3072:iBPereF+5yj4JbM15HyTOph9BeF+YzB1hXeiYY0I26QqZ:wPereFmyEJbgHyyBeYA/mIBp
TLSH
T1A8D3D09D77A04861D3FE0F7548F26361CB76EE639C239B0F54D8229E2633A888F01795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3512-19-0x0000025CF3C50000-0x0000025CF3D02000-memory.dmp

Download

memory/3512-22-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/3512-7-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/3512-11-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/3512-10-0x0000025CF3960000-0x0000025CF3982000-memory.dmp

Download

memory/3512-12-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/3512-13-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/3512-14-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/3512-15-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/3512-18-0x0000025CF3A00000-0x0000025CF3A1E000-memory.dmp

Download

memory/3512-20-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/3512-31-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/3512-21-0x0000025CF3A20000-0x0000025CF3A2A000-memory.dmp

Download

memory/3512-29-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/3512-23-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/3512-24-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/3512-25-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/3512-26-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/3512-27-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/3512-28-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/5052-6-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/5052-0-0x00007FF908B6F000-0x00007FF908B70000-memory.dmp

Download

memory/5052-5-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/5052-4-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/5052-3-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/5052-2-0x00007FF9089E0000-0x00007FF909384000-memory.dmp

Download

memory/5052-1-0x0000000000060000-0x0000000000086000-memory.dmp

Download