xworm | 57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
Size 754KB
Sample260910-nefjrabm7s
SHA256 57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2
MD5 6ff3cc67b35a5caed0468ea9352506e9
SHA1 e1de54b8f46e5c4fa38052f0cf5891e7d35549a9
SHA512 20142dbad5fc1bdd642ee64dee3cd9742d5c7f81a8d801f152850f64be1bf8e1bb6b2b575bc578ca4b89096cc6b9ebf19615018690e65bbe79140708cb2f66fa
SSDEEP 12288:Ruo+0HjJ35LZ6LxWq76MSlNl5tuinL5CiPAwq4r/QGmuQv4lRl4e:Io+qz6LoqIlNHtu0VfP1q4r/QNv4Ll
TLSH
T116F412687726FE52C9AD4B750A77E33413A59E5DE111C327CBEE9DEF3C20245AC08682
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

45.154.98.168:9019

Mutex

U1HTpom8klWxOpDd

Attributes

Install_directory
%AppData%
install_file
XWormClient.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/364-11-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4708	powershell.exe
1920	powershell.exe
944	powershell.exe
4012	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe

Executes dropped EXE 4 IoCs

pid	Process
2476	XWormClient.exe
3564	XWormClient.exe
3608	XWormClient.exe
3140	XWormClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\XWormClient = "C:\\Users\\Admin\\AppData\\Roaming\\XWormClient.exe"	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/4792-7-0x00000000050E0000-0x00000000050F4000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4792 set thread context of 364	4792	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	90
PID 2476 set thread context of 3564	2476	XWormClient.exe	105
PID 3608 set thread context of 3140	3608	XWormClient.exe	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1616	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4792	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
4792	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
4792	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
4792	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
4708	powershell.exe
4708	powershell.exe
1920	powershell.exe
1920	powershell.exe
944	powershell.exe
944	powershell.exe
4012	powershell.exe
4012	powershell.exe
2476	XWormClient.exe
2476	XWormClient.exe
2476	XWormClient.exe
3608	XWormClient.exe
3608	XWormClient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4792	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
Token: SeDebugPrivilege	364	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeIncreaseQuotaPrivilege	4708	powershell.exe
Token: SeSecurityPrivilege	4708	powershell.exe
Token: SeTakeOwnershipPrivilege	4708	powershell.exe
Token: SeLoadDriverPrivilege	4708	powershell.exe
Token: SeSystemProfilePrivilege	4708	powershell.exe
Token: SeSystemtimePrivilege	4708	powershell.exe
Token: SeProfSingleProcessPrivilege	4708	powershell.exe
Token: SeIncBasePriorityPrivilege	4708	powershell.exe
Token: SeCreatePagefilePrivilege	4708	powershell.exe
Token: SeBackupPrivilege	4708	powershell.exe
Token: SeRestorePrivilege	4708	powershell.exe
Token: SeShutdownPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeSystemEnvironmentPrivilege	4708	powershell.exe
Token: SeRemoteShutdownPrivilege	4708	powershell.exe
Token: SeUndockPrivilege	4708	powershell.exe
Token: SeManageVolumePrivilege	4708	powershell.exe
Token: 33	4708	powershell.exe
Token: 34	4708	powershell.exe
Token: 35	4708	powershell.exe
Token: 36	4708	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeIncreaseQuotaPrivilege	1920	powershell.exe
Token: SeSecurityPrivilege	1920	powershell.exe
Token: SeTakeOwnershipPrivilege	1920	powershell.exe
Token: SeLoadDriverPrivilege	1920	powershell.exe
Token: SeSystemProfilePrivilege	1920	powershell.exe
Token: SeSystemtimePrivilege	1920	powershell.exe
Token: SeProfSingleProcessPrivilege	1920	powershell.exe
Token: SeIncBasePriorityPrivilege	1920	powershell.exe
Token: SeCreatePagefilePrivilege	1920	powershell.exe
Token: SeBackupPrivilege	1920	powershell.exe
Token: SeRestorePrivilege	1920	powershell.exe
Token: SeShutdownPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeSystemEnvironmentPrivilege	1920	powershell.exe
Token: SeRemoteShutdownPrivilege	1920	powershell.exe
Token: SeUndockPrivilege	1920	powershell.exe
Token: SeManageVolumePrivilege	1920	powershell.exe
Token: 33	1920	powershell.exe
Token: 34	1920	powershell.exe
Token: 35	1920	powershell.exe
Token: 36	1920	powershell.exe
Token: SeDebugPrivilege	944	powershell.exe
Token: SeIncreaseQuotaPrivilege	944	powershell.exe
Token: SeSecurityPrivilege	944	powershell.exe
Token: SeTakeOwnershipPrivilege	944	powershell.exe
Token: SeLoadDriverPrivilege	944	powershell.exe
Token: SeSystemProfilePrivilege	944	powershell.exe
Token: SeSystemtimePrivilege	944	powershell.exe
Token: SeProfSingleProcessPrivilege	944	powershell.exe
Token: SeIncBasePriorityPrivilege	944	powershell.exe
Token: SeCreatePagefilePrivilege	944	powershell.exe
Token: SeBackupPrivilege	944	powershell.exe
Token: SeRestorePrivilege	944	powershell.exe
Token: SeShutdownPrivilege	944	powershell.exe
Token: SeDebugPrivilege	944	powershell.exe
Token: SeSystemEnvironmentPrivilege	944	powershell.exe
Token: SeRemoteShutdownPrivilege	944	powershell.exe
Token: SeUndockPrivilege	944	powershell.exe
Token: SeManageVolumePrivilege	944	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 252	4792	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	89
PID 4792 wrote to memory of 364	4792	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	90
PID 4792 wrote to memory of 364	4792	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	90
PID 4792 wrote to memory of 364	4792	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	90
PID 4792 wrote to memory of 364	4792	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	90
PID 4792 wrote to memory of 364	4792	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	90
PID 364 wrote to memory of 4708	364	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	91
PID 364 wrote to memory of 1920	364	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	94
PID 364 wrote to memory of 944	364	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	97
PID 364 wrote to memory of 4012	364	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	99
PID 364 wrote to memory of 1616	364	57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe	101
PID 2476 wrote to memory of 3564	2476	XWormClient.exe	105
PID 2476 wrote to memory of 3564	2476	XWormClient.exe	105
PID 2476 wrote to memory of 3564	2476	XWormClient.exe	105
PID 2476 wrote to memory of 3564	2476	XWormClient.exe	105
PID 2476 wrote to memory of 3564	2476	XWormClient.exe	105
PID 3608 wrote to memory of 3140	3608	XWormClient.exe	107
PID 3608 wrote to memory of 3140	3608	XWormClient.exe	107
PID 3608 wrote to memory of 3140	3608	XWormClient.exe	107
PID 3608 wrote to memory of 3140	3608	XWormClient.exe	107
PID 3608 wrote to memory of 3140	3608	XWormClient.exe	107

C:\Users\Admin\AppData\Local\Temp\57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
"C:\Users\Admin\AppData\Local\Temp\57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Users\Admin\AppData\Local\Temp\57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
  "C:\Users\Admin\AppData\Local\Temp\57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe"
  2⤵
  PID:252
- C:\Users\Admin\AppData\Local\Temp\57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe
  "C:\Users\Admin\AppData\Local\Temp\57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe"
  2⤵
  - Creates a file in the Startup directory
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:364
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1920
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XWormClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:944
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4012
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XWormClient" /tr "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1616

C:\Users\Admin\AppData\Roaming\XWormClient.exe
C:\Users\Admin\AppData\Roaming\XWormClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Users\Admin\AppData\Roaming\XWormClient.exe
  "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3564

C:\Users\Admin\AppData\Roaming\XWormClient.exe
"C:\Users\Admin\AppData\Roaming\XWormClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Users\Admin\AppData\Roaming\XWormClient.exe
  "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 b736732362edaf9eb392d6484336397d3a4fc1fc91be420c66f84659374dd0e2
MD5 10f8d1236beb66d3a0faa93a8aaf8ee0
SHA1 c8a2867bad43a41b9445daceb3cf20ffc5e38139
SHA512 7fc95400324229c597b487b9fe19fff4fbf5d770c55d0e39c84f752530d90d770e3821bfaed79da7a6056246413a934a75b3d544728e944c655f4cb045d4e212
SSDEEP 384:OI1eBaoT1iBGDGW14b6Rl64bI0+T+ge3ry2Pn9IAXz48+FWbitzKw8vYbhNaPkle:OEexZ6GKWiu36+Iv+Fj1IAXzX+xVzbho
TLSH
T132A2B478213F6DC7D8D226B410D10AA7FBE4D489DAF611D4BF1BDE2F4C90EBA4A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 91ac5234995a0a42533d3ade50698b26f2d7ed1c3864a5f1a04b53f14033d4aa
MD5 2102ce0b2e9c8543ad0681f605272ba9
SHA1 50a9d80a662f892a6003f93f0e95209707250356
SHA512 2b69753263557e7dc7e2b2d80979afdbb7ceff7e2718d39b808e0454f2d735f5b79a478ee7d937ef04491cb5d33329a2193efe576feaa1e2df25fa3613159e31
SSDEEP 384:PSEboT1iBGtVGlbSln2JiK2a0c+geTrO2P1EPiUDzdboIAYbQBoaqB3K6Kwf7hii:d0Z6Gtglmnm92a9+pvG6UFboIA5BoaM/
TLSH
T1ACA2F82D266F59CBC89062B800824346FBF4D559EBE192DBEB4FC91F2C41A7D9E500F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 f42c87c0756d3ead6446f28136b53143e310593f17d5abebe427c429dd696549
MD5 67483fc36606d06c11a7fb40dc6b52cc
SHA1 9616a976a3fe878ae203fa25037bdfbe16f82e4f
SHA512 e28ce4cb3428de5b7fc7236239ededd653a0d7588f2e89b78b6ad1a6be01e90804982fedd0e508e8ac807b4f22d5e522fbabc62c5ba84ed88ea0d1be235efac2
SSDEEP 384:CSEboT1iBGQcPyUOgbWZ5Hb3XlB2sIAYlRCXtoaqB66KwUv27hNIeUJhxRWhjNCw:W0Z6GQcPnOgbW73X1IAeYXtoaM6eHhNR
TLSH
T189A2F81D666F59CBC491626810824383FBB8D568EBF252CBFF0BC91F2C45A7E5E501E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_kee0btch.wnx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kee0btch.wnx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

XWormClient.exe

Path C:\Users\Admin\AppData\Roaming\XWormClient.exe
Size 754KB
SHA256 57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2
MD5 6ff3cc67b35a5caed0468ea9352506e9
SHA1 e1de54b8f46e5c4fa38052f0cf5891e7d35549a9
SHA512 20142dbad5fc1bdd642ee64dee3cd9742d5c7f81a8d801f152850f64be1bf8e1bb6b2b575bc578ca4b89096cc6b9ebf19615018690e65bbe79140708cb2f66fa
SSDEEP 12288:Ruo+0HjJ35LZ6LxWq76MSlNl5tuinL5CiPAwq4r/QGmuQv4lRl4e:Io+qz6LoqIlNHtu0VfP1q4r/QNv4Ll
TLSH
T116F412687726FE52C9AD4B750A77E33413A59E5DE111C327CBEE9DEF3C20245AC08682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/364-45-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/364-70-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/364-67-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/364-12-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/364-11-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/944-52-0x00000000709E0000-0x0000000070A2C000-memory.dmp

Download

memory/944-49-0x0000000006320000-0x000000000667B000-memory.dmp

Download

memory/944-51-0x0000000006870000-0x00000000068BC000-memory.dmp

Download

memory/1920-42-0x0000000070A10000-0x0000000070A5C000-memory.dmp

Download

memory/4012-59-0x0000000070A10000-0x0000000070A5C000-memory.dmp

Download

memory/4708-24-0x0000000005E10000-0x0000000005E2E000-memory.dmp

Download

memory/4708-34-0x00000000071A0000-0x00000000071BA000-memory.dmp

Download

memory/4708-20-0x0000000005860000-0x00000000058C6000-memory.dmp

Download

memory/4708-19-0x00000000057F0000-0x0000000005856000-memory.dmp

Download

memory/4708-18-0x0000000005D10000-0x0000000005D32000-memory.dmp

Download

memory/4708-17-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/4708-21-0x0000000005960000-0x0000000005CBB000-memory.dmp

Download

memory/4708-14-0x0000000004950000-0x0000000004986000-memory.dmp

Download

memory/4708-25-0x0000000005E50000-0x0000000005E9C000-memory.dmp

Download

memory/4708-26-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/4708-27-0x0000000006E70000-0x0000000006EA6000-memory.dmp

Download

memory/4708-28-0x0000000070A10000-0x0000000070A5C000-memory.dmp

Download

memory/4708-31-0x0000000006410000-0x0000000006430000-memory.dmp

Download

memory/4708-32-0x00000000070B0000-0x0000000007153000-memory.dmp

Download

memory/4708-33-0x00000000077E0000-0x0000000007E5C000-memory.dmp

Download

memory/4708-16-0x0000000004FE0000-0x000000000562A000-memory.dmp

Download

memory/4708-35-0x0000000007210000-0x000000000721A000-memory.dmp

Download

memory/4708-36-0x0000000007410000-0x00000000074A6000-memory.dmp

Download

memory/4708-38-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/4708-15-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/4792-0-0x0000000074682000-0x0000000074683000-memory.dmp

Download

memory/4792-13-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/4792-10-0x0000000006760000-0x000000000680C000-memory.dmp

Download

memory/4792-9-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/4792-8-0x0000000074682000-0x0000000074683000-memory.dmp

Download

memory/4792-7-0x00000000050E0000-0x00000000050F4000-memory.dmp

Download

memory/4792-6-0x0000000074670000-0x0000000074E2C000-memory.dmp

Download

memory/4792-5-0x0000000004E40000-0x0000000004E4A000-memory.dmp

Download

memory/4792-4-0x0000000004F10000-0x0000000004FAC000-memory.dmp

Download

memory/4792-3-0x0000000004E70000-0x0000000004F02000-memory.dmp

Download

memory/4792-2-0x0000000005430000-0x00000000059EA000-memory.dmp

Download

memory/4792-1-0x0000000000260000-0x0000000000324000-memory.dmp

Download