xworm | 57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
Size 754KB
Sample260910-nefjrabm7s
SHA256 57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2
MD5 6ff3cc67b35a5caed0468ea9352506e9
SHA1 e1de54b8f46e5c4fa38052f0cf5891e7d35549a9
SHA512 20142dbad5fc1bdd642ee64dee3cd9742d5c7f81a8d801f152850f64be1bf8e1bb6b2b575bc578ca4b89096cc6b9ebf19615018690e65bbe79140708cb2f66fa
SSDEEP 12288:Ruo+0HjJ35LZ6LxWq76MSlNl5tuinL5CiPAwq4r/QGmuQv4lRl4e:Io+qz6LoqIlNHtu0VfP1q4r/QNv4Ll
TLSH
T116F412687726FE52C9AD4B750A77E33413A59E5DE111C327CBEE9DEF3C20245AC08682
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

45.154.98.168:9019

Mutex

U1HTpom8klWxOpDd

Attributes

Install_directory
%AppData%
install_file
XWormClient.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1736-9-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3328	powershell.exe
3340	powershell.exe
4020	powershell.exe
4540	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe

Executes dropped EXE 6 IoCs

pid	Process
4408	XWormClient.exe
3540	XWormClient.exe
3824	XWormClient.exe
2744	XWormClient.exe
2480	XWormClient.exe
1012	XWormClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XWormClient = "C:\\Users\\Admin\\AppData\\Roaming\\XWormClient.exe"	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe

SmartAssembly .NET packer 3 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/2504-6-0x00000000058F0000-0x0000000005904000-memory.dmp	SmartAssembly
behavioral1/memory/3540-117-0x0000000005390000-0x00000000053A4000-memory.dmp	SmartAssembly
behavioral1/memory/2480-127-0x0000000004C00000-0x0000000004C14000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2504 set thread context of 1736	2504	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	97
PID 4408 set thread context of 3824	4408	XWormClient.exe	115
PID 3540 set thread context of 2744	3540	XWormClient.exe	116
PID 2480 set thread context of 1012	2480	XWormClient.exe	120

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2504	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
2504	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
3328	powershell.exe
3328	powershell.exe
3340	powershell.exe
3340	powershell.exe
4020	powershell.exe
4020	powershell.exe
4540	powershell.exe
4540	powershell.exe
4408	XWormClient.exe
4408	XWormClient.exe
4408	XWormClient.exe
3540	XWormClient.exe
3540	XWormClient.exe
2480	XWormClient.exe
2480	XWormClient.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2504	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
Token: SeDebugPrivilege	1736	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
Token: SeDebugPrivilege	3328	powershell.exe
Token: SeDebugPrivilege	3340	powershell.exe
Token: SeDebugPrivilege	4020	powershell.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	4408	XWormClient.exe
Token: SeDebugPrivilege	3824	XWormClient.exe
Token: SeDebugPrivilege	3540	XWormClient.exe
Token: SeDebugPrivilege	2744	XWormClient.exe
Token: SeDebugPrivilege	2480	XWormClient.exe
Token: SeDebugPrivilege	1012	XWormClient.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 1736	2504	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	97
PID 2504 wrote to memory of 1736	2504	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	97
PID 2504 wrote to memory of 1736	2504	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	97
PID 2504 wrote to memory of 1736	2504	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	97
PID 2504 wrote to memory of 1736	2504	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	97
PID 1736 wrote to memory of 3328	1736	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	98
PID 1736 wrote to memory of 3340	1736	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	100
PID 1736 wrote to memory of 4020	1736	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	102
PID 1736 wrote to memory of 4540	1736	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	105
PID 1736 wrote to memory of 792	1736	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	107
PID 4408 wrote to memory of 3824	4408	XWormClient.exe	115
PID 4408 wrote to memory of 3824	4408	XWormClient.exe	115
PID 4408 wrote to memory of 3824	4408	XWormClient.exe	115
PID 4408 wrote to memory of 3824	4408	XWormClient.exe	115
PID 4408 wrote to memory of 3824	4408	XWormClient.exe	115
PID 3540 wrote to memory of 2744	3540	XWormClient.exe	116
PID 3540 wrote to memory of 2744	3540	XWormClient.exe	116
PID 3540 wrote to memory of 2744	3540	XWormClient.exe	116
PID 3540 wrote to memory of 2744	3540	XWormClient.exe	116
PID 3540 wrote to memory of 2744	3540	XWormClient.exe	116
PID 2480 wrote to memory of 1012	2480	XWormClient.exe	120
PID 2480 wrote to memory of 1012	2480	XWormClient.exe	120
PID 2480 wrote to memory of 1012	2480	XWormClient.exe	120
PID 2480 wrote to memory of 1012	2480	XWormClient.exe	120
PID 2480 wrote to memory of 1012	2480	XWormClient.exe	120

C:\Users\Admin\AppData\Local\Temp\57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
"C:\Users\Admin\AppData\Local\Temp\57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
  "C:\Users\Admin\AppData\Local\Temp\57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe"
  2⤵
  - Checks computer location settings
  - Creates a file in the Startup directory
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3328
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3340
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XWormClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4020
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XWormClient" /tr "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:792

C:\Users\Admin\AppData\Roaming\XWormClient.exe
C:\Users\Admin\AppData\Roaming\XWormClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Users\Admin\AppData\Roaming\XWormClient.exe
  "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3824

C:\Users\Admin\AppData\Roaming\XWormClient.exe
C:\Users\Admin\AppData\Roaming\XWormClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Users\Admin\AppData\Roaming\XWormClient.exe
  "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2744

C:\Users\Admin\AppData\Roaming\XWormClient.exe
C:\Users\Admin\AppData\Roaming\XWormClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Roaming\XWormClient.exe
  "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe.log
Size 1KB
SHA256 e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
MD5 84e77a587d94307c0ac1357eb4d3d46f
SHA1 83cc900f9401f43d181207d64c5adba7a85edc1e
SHA512 aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691
TLSH
T13D219B303222B5D84D022F530C0869C513EF4759BB64EE2CB959231EDD2A457AB211E3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 91d72a0f29f8b5ed013f493a6f460c45fc427981b9bd625bdb0536851aa7d283
MD5 cfa5161c206a3156596508e27748c5de
SHA1 4094fb6f5f38a7ed0226d48922cf415f823923ba
SHA512 21816dc5e77f1e0c139d7b94fd4a72dfcbebe6cd5d547881a49036fb0acaf6d6f2fa990cc1b39a055e6f2d03d07c9d6940b4ee54f6af5ba1baa041eec56c9675
SSDEEP 384:fsf+B/9i+C2QFs2izMkNxoUtFLK6seYwME/x03SoZVfYSgQjEDkiQ0gdotkKhD:UfxD2LXoUtFLNfraSoWuEDPCK3
TLSH
T15D82E76E211F16C3C49613B8E11B051FE8F2DD8D431A13D9BB1E9F3B8AAC69E903D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 bd692fa2571a0288822b06b6540d8756e4428642a431178d6a61be91566b02ab
MD5 97f636d0eec6518c30624cb98944fef9
SHA1 dc1b4299f33bdbabfa95d4e944618f3eabcd8bb4
SHA512 fc0bf531ac9bc1031af126b0a817d1fff042fceaffa01ffc2c779810b9e1a5b832846f16bc7e334bcebc9f18df15629dfece18868af2d7bb8c2d35b0c372b7ee
SSDEEP 384:T6+Bf91Ft8LH/BBizJkDF1Muo4wNY19zGZcifKDS5nvq+nLkki0SO1:GwFt8L5oe/Bo4wNANifQS5nnIki0H
TLSH
T19382075E222F2ADBC6A613F4C43A43EBDDF09DCF834407DE1748193A05DA26650E95F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 ca9e4d3c1c6b605f03e2340cd5322ffd8b82016d8f52b0df550681d621ab274f
MD5 797a9ffbf57b9fac20374f9f6f4137bc
SHA1 058a8cf0f16a57968590d859c6f14731a98aaa52
SHA512 22a7364f235b7ed26841384fe15450dff8996357caf69bf1d5dfa18d8afbfc1e5ecf236258ef6e529958e0190f1128d4c0e2a008ebbc83e780084d037227a7f8
SSDEEP 384:16+BL991Zw5LcdoZ+k6VtKeY19U/8G3oZqIi5dVdq+nUshi0SO1:UCZwKa6VtNAUxzIi5dvUsi0H
TLSH
T1448218AD212F29D7C1A613F4C427479BEDF09DCFC30447DD6A891E2B06DA67A54A80EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_rxwgjf1q.ltb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rxwgjf1q.ltb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

XWormClient.exe

Path C:\Users\Admin\AppData\Roaming\XWormClient.exe
Size 754KB
SHA256 57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2
MD5 6ff3cc67b35a5caed0468ea9352506e9
SHA1 e1de54b8f46e5c4fa38052f0cf5891e7d35549a9
SHA512 20142dbad5fc1bdd642ee64dee3cd9742d5c7f81a8d801f152850f64be1bf8e1bb6b2b575bc578ca4b89096cc6b9ebf19615018690e65bbe79140708cb2f66fa
SSDEEP 12288:Ruo+0HjJ35LZ6LxWq76MSlNl5tuinL5CiPAwq4r/QGmuQv4lRl4e:Io+qz6LoqIlNHtu0VfP1q4r/QNv4Ll
TLSH
T116F412687726FE52C9AD4B750A77E33413A59E5DE111C327CBEE9DEF3C20245AC08682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1736-9-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/1736-113-0x0000000005760000-0x0000000005770000-memory.dmp

Download

memory/1736-118-0x0000000005760000-0x0000000005770000-memory.dmp

Download

memory/2480-127-0x0000000004C00000-0x0000000004C14000-memory.dmp

Download

memory/2504-0-0x0000000000AB0000-0x0000000000B74000-memory.dmp

Download

memory/2504-7-0x0000000005790000-0x00000000057A0000-memory.dmp

Download

memory/2504-8-0x0000000006400000-0x00000000064AC000-memory.dmp

Download

memory/2504-6-0x00000000058F0000-0x0000000005904000-memory.dmp

Download

memory/2504-5-0x0000000005550000-0x000000000555A000-memory.dmp

Download

memory/2504-4-0x0000000005790000-0x00000000057A0000-memory.dmp

Download

memory/2504-3-0x0000000005680000-0x000000000571C000-memory.dmp

Download

memory/2504-2-0x00000000055E0000-0x0000000005672000-memory.dmp

Download

memory/2504-1-0x0000000005B90000-0x0000000006134000-memory.dmp

Download

memory/3328-38-0x00000000069F0000-0x0000000006A0E000-memory.dmp

Download

memory/3328-16-0x0000000005470000-0x0000000005492000-memory.dmp

Download

memory/3328-27-0x0000000006440000-0x000000000645E000-memory.dmp

Download

memory/3328-28-0x00000000064D0000-0x000000000651C000-memory.dmp

Download

memory/3328-29-0x0000000006A10000-0x0000000006A42000-memory.dmp

Download

memory/3328-30-0x0000000070050000-0x000000007009C000-memory.dmp

Download

memory/3328-18-0x0000000005C90000-0x0000000005CF6000-memory.dmp

Download

memory/3328-39-0x0000000007410000-0x00000000074B3000-memory.dmp

Download

memory/3328-40-0x0000000007DB0000-0x000000000842A000-memory.dmp

Download

memory/3328-41-0x0000000007760000-0x000000000777A000-memory.dmp

Download

memory/3328-42-0x00000000077D0000-0x00000000077DA000-memory.dmp

Download

memory/3328-43-0x00000000079E0000-0x0000000007A76000-memory.dmp

Download

memory/3328-44-0x0000000007960000-0x0000000007971000-memory.dmp

Download

memory/3328-45-0x0000000007990000-0x000000000799E000-memory.dmp

Download

memory/3328-46-0x00000000079A0000-0x00000000079B4000-memory.dmp

Download

memory/3328-47-0x0000000007AA0000-0x0000000007ABA000-memory.dmp

Download

memory/3328-48-0x0000000007A80000-0x0000000007A88000-memory.dmp

Download

memory/3328-12-0x0000000004E80000-0x0000000004EB6000-memory.dmp

Download

memory/3328-14-0x0000000005020000-0x0000000005030000-memory.dmp

Download

memory/3328-13-0x0000000005020000-0x0000000005030000-memory.dmp

Download

memory/3328-15-0x0000000005660000-0x0000000005C88000-memory.dmp

Download

memory/3328-24-0x0000000005E30000-0x0000000006184000-memory.dmp

Download

memory/3328-17-0x0000000005590000-0x00000000055F6000-memory.dmp

Download

memory/3340-72-0x0000000007230000-0x0000000007244000-memory.dmp

Download

memory/3340-71-0x0000000007200000-0x0000000007211000-memory.dmp

Download

memory/3340-62-0x0000000070F10000-0x0000000070F5C000-memory.dmp

Download

memory/3340-70-0x0000000006F00000-0x0000000006FA3000-memory.dmp

Download

memory/3340-61-0x00000000061E0000-0x000000000622C000-memory.dmp

Download

memory/3340-59-0x00000000057F0000-0x0000000005B44000-memory.dmp

Download

memory/3540-117-0x0000000005390000-0x00000000053A4000-memory.dmp

Download

memory/4020-82-0x0000000070F10000-0x0000000070F5C000-memory.dmp

Download

memory/4540-99-0x00000000067B0000-0x00000000067FC000-memory.dmp

Download

memory/4540-100-0x0000000070F00000-0x0000000070F4C000-memory.dmp

Download