xworm | fe7fe23e0022d5c01eb91e3a9f0e9306868075ed9baacb78fe565204c6576120

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fe7fe23e0022d5c01eb91e3a9f0e9306868075ed9baacb78fe565204c6576120.exe
Size 2.6MB
Sample260925-sn8dca1w7p
SHA256 fe7fe23e0022d5c01eb91e3a9f0e9306868075ed9baacb78fe565204c6576120
MD5 5ddbf34d0c12ee05573fb7e21e68317b
SHA1 1476c34eb93938b4c29b0bffa3bf3fecb0b10980
SHA512 204a9aa523bdcb7342ef3e5d1d7a66260aed14b1f6a866f6493f52b0fbb01da46762ad4ae68501279fd14b54352a2d703b696f6f94f0b3ce57eca8578540d5c4
SSDEEP 49152:/xlkSNDFq7Di2a4Dot5Vq7/dV9y+QzS5hpcYg+0BVg6Fc1VaMh9Q:/xlkSN572a4DCg7oxzSzpciygwuQ
TLSH
T1D9D533178E0D96FAEBB7C979FC64F8CAA4E540AC7557D14CE2037AAEEC42C51B0A3111
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence rat trojan upx

Malware Config

Extracted

Family

xworm

Version

hxtes3a-40114.portmap.host:40114

Mutex

CrirQpGRl8Am1h1Z

Attributes

Install_directory
%Userprofile%
install_file
Realtek HD Audio Universal Service.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c482-14.dat	family_xworm
behavioral2/memory/5136-20-0x0000000000460000-0x0000000000470000-memory.dmp	family_xworm

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
1448	Bluestacks.exe
5136	Realtek HD Audio Universal Service.exe
2884	abuser.exe
4232	Bluestacks.exe
4812	Music Player.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bluestacks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Bluestacks.exe"	Bluestacks.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bluestacks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Bluestacks.exe"	Bluestacks.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4812 set thread context of 4880	4812	Music Player.exe	107
PID 4812 set thread context of 5992	4812	Music Player.exe	108

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5992-46-0x0000000140000000-0x00000001408CB000-memory.dmp	upx
behavioral2/memory/5992-45-0x0000000140000000-0x00000001408CB000-memory.dmp	upx
behavioral2/memory/5992-47-0x0000000140000000-0x00000001408CB000-memory.dmp	upx

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4708	sc.exe
708	sc.exe
2332	sc.exe
1560	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Realtek HD Audio Universal Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Realtek HD Audio Universal Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Bluestacks.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Bluestacks.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Bluestacks.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Bluestacks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2884	abuser.exe
2884	abuser.exe
2884	abuser.exe
2884	abuser.exe
4812	Music Player.exe
4812	Music Player.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5136	Realtek HD Audio Universal Service.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5668 wrote to memory of 1448	5668	fe7fe23e0022d5c01eb91e3a9f0e9306868075ed9baacb78fe565204c6576120.exe	89
PID 5668 wrote to memory of 5136	5668	fe7fe23e0022d5c01eb91e3a9f0e9306868075ed9baacb78fe565204c6576120.exe	90
PID 5668 wrote to memory of 2884	5668	fe7fe23e0022d5c01eb91e3a9f0e9306868075ed9baacb78fe565204c6576120.exe	91
PID 4812 wrote to memory of 4880	4812	Music Player.exe	107
PID 4812 wrote to memory of 4880	4812	Music Player.exe	107
PID 4812 wrote to memory of 4880	4812	Music Player.exe	107
PID 4812 wrote to memory of 4880	4812	Music Player.exe	107
PID 4812 wrote to memory of 4880	4812	Music Player.exe	107
PID 4812 wrote to memory of 4880	4812	Music Player.exe	107
PID 4812 wrote to memory of 4880	4812	Music Player.exe	107
PID 4812 wrote to memory of 4880	4812	Music Player.exe	107
PID 4812 wrote to memory of 5992	4812	Music Player.exe	108
PID 4812 wrote to memory of 5992	4812	Music Player.exe	108
PID 4812 wrote to memory of 5992	4812	Music Player.exe	108

C:\Users\Admin\AppData\Local\Temp\fe7fe23e0022d5c01eb91e3a9f0e9306868075ed9baacb78fe565204c6576120.exe
"C:\Users\Admin\AppData\Local\Temp\fe7fe23e0022d5c01eb91e3a9f0e9306868075ed9baacb78fe565204c6576120.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Users\Admin\AppData\Local\Temp\Bluestacks.exe
  "C:\Users\Admin\AppData\Local\Temp\Bluestacks.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  PID:1448
- C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe
  "C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:5136
- C:\Users\Admin\AppData\Local\Temp\abuser.exe
  "C:\Users\Admin\AppData\Local\Temp\abuser.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2884
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "Music"
    3⤵
    - Launches sc.exe
    PID:1560
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "Music" binpath= "C:\ProgramData\Music\Music Player.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:2332
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:708
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "Music"
    3⤵
    - Launches sc.exe
    PID:4708

C:\Users\Admin\AppData\Local\Temp\Bluestacks.exe
C:\Users\Admin\AppData\Local\Temp\Bluestacks.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
PID:4232

C:\ProgramData\Music\Music Player.exe
"C:\ProgramData\Music\Music Player.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:4880
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Bluestacks.exe

Path C:\Users\Admin\AppData\Local\Temp\Bluestacks.exe
Size 126KB
SHA256 0a2ff195c415dbb07a74626c721447e3f381578e78dacf8bdcc72dcc385be894
MD5 64b7e7eadda7ab3134699bc1cb273ab0
SHA1 cb2bdf87760cc6d7ef3816e55982c2693b6dab97
SHA512 0738655acf554ad8371f50ba17120d79b201af79d3b7af930d23c41c060ab3e195e51a1b5657fcfd15935052b8439d21a93083124d3dc6c6186482959d077033
SSDEEP 768:B6VDe5VJIbb8ey64eG1wcwX6u79Sbh9Sb:B6VDesh7Fn7C
TLSH
T144C340138AEC3CDBC13897B0B77B87C5DB2EDC959292D14E96C00991D8BD9177A227C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Realtek HD Audio Universal Service.exe

Path C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe
Size 40KB
SHA256 7149e1692b88cefb278151f087eb08d1d1a02c4782abaa7a4048307b9eee9c7d
MD5 9df037d21a334e191853637714bbc749
SHA1 d61fe5a0812646903f7ad59ff6c2d58be52310de
SHA512 7197999b735eb75cd87305c992cc39fc9983435ebe7710504a09b7d053e6c368e71a75fa7e2972a33468df097fb9b1ebd4a0a1fa4bea7b2809cf7761a2ee699a
SSDEEP 768:Z8jjwxDHzSI+eTN4GwH/0R8+6vJF5P/9Oy2l6BOMh53/mJ:u+TSIduGwHL+6BFp9rk6BOMjO
TLSH
T14B134A05BB954625E5FEABF459B366030B31A6038A13D74D08E8D2EB2F277C5CE407D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abuser.exe

Path C:\Users\Admin\AppData\Local\Temp\abuser.exe
Size 3.0MB
SHA256 cbebada5f4e5801c3c264afb28bd86126964bceb118653ed7eff526f7a638304
MD5 288da52c9bb952f5a4ba8b02023b573e
SHA1 27a9664f1890e25a4eb16a05072829e94535676e
SHA512 676845c65f65bd18b59065ad1324b011d94480739a163d073b27d52143c36f1c3cd8272463cd7ba117a188415ca8212d6d7fe473f6d637335c181595fcc62ffd
SSDEEP 49152:qHRFTS5G8G9aOTpErKZuC50FUydXA5kTS3+khEoCYgsuLQ:qxFSo9XpQC50FHO5kTzk2egr
TLSH
T13EE5330F55081AF4ECE3F0785C919E266B9A7CC00F751AD33B8E42B628B57D055BB9B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4880-38-0x0000000140000000-0x0000000140013000-memory.dmp

Download

memory/4880-39-0x0000000140000000-0x0000000140013000-memory.dmp

Download

memory/4880-40-0x0000000140000000-0x0000000140013000-memory.dmp

Download

memory/4880-42-0x0000000140000000-0x0000000140013000-memory.dmp

Download

memory/4880-41-0x0000000140000000-0x0000000140013000-memory.dmp

Download

memory/5136-20-0x0000000000460000-0x0000000000470000-memory.dmp

Download

memory/5136-27-0x00007FFDAB2E0000-0x00007FFDABC84000-memory.dmp

Download

memory/5136-26-0x00007FFDAB2E0000-0x00007FFDABC84000-memory.dmp

Download

memory/5136-33-0x00007FFDAB2E0000-0x00007FFDABC84000-memory.dmp

Download

memory/5136-34-0x00007FFDAB2E0000-0x00007FFDABC84000-memory.dmp

Download

memory/5668-31-0x00007FFDAB2E0000-0x00007FFDABC84000-memory.dmp

Download

memory/5668-0-0x00007FFDAB46F000-0x00007FFDAB470000-memory.dmp

Download

memory/5668-4-0x00007FFDAB2E0000-0x00007FFDABC84000-memory.dmp

Download

memory/5668-2-0x00007FFDAB2E0000-0x00007FFDABC84000-memory.dmp

Download

memory/5668-1-0x0000000000C90000-0x0000000000F36000-memory.dmp

Download

memory/5992-46-0x0000000140000000-0x00000001408CB000-memory.dmp

Download

memory/5992-45-0x0000000140000000-0x00000001408CB000-memory.dmp

Download

memory/5992-47-0x0000000140000000-0x00000001408CB000-memory.dmp

Download