xworm | 179674548ffb392b2165e1e4cfbd4f288f7a283418ff9a908b73ae63e3c5cacc

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
COTIZACIÓN-AUTOMÓVILES SANTA ANA, S.A.js
Size 780KB
Sample260930-j99zmax19q
SHA256 179674548ffb392b2165e1e4cfbd4f288f7a283418ff9a908b73ae63e3c5cacc
MD5 c7b39c275ba1864e3df3ccdd989172f4
SHA1 e990d02a920ea70b77473460ebd7e6ed08ef1e7f
SHA512 b5cc83bf3a07428aa050c4631b97f8180fe48709ed50f0e359852e6ffab43153246b7267475f126050bbdea0ef69a8f1e59423977fe405b58474bbe3f0628176
SSDEEP 12288:iLylYJD3mOlkMCGKMqIkC10I2ZCuh970jcGDN4ujy7O5cvZLv6QBz6:4x3aHGKMqIkCgR70jcAN4eKvZLvph6
TLSH
T1AB051204249A707F5476E12A938E4104E1BDD7434A6CE216B4ADF2D85FB38A052EFFDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

207.189.14.71:7007

Mutex

u8VgslsPr6X7TU2m

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4508-25-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	wscript.exe
\??\F:\	wscript.exe
\??\F:\	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4168 set thread context of 4508	4168	powershell.exe	94

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4168	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RegAsm.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4168	powershell.exe
4168	powershell.exe
4508	RegAsm.exe
4508	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeDebugPrivilege	4508	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4508	RegAsm.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 5856	4524	wscript.exe	89
PID 5856 wrote to memory of 4168	5856	wscript.exe	90
PID 4168 wrote to memory of 4508	4168	powershell.exe	94
PID 4168 wrote to memory of 4508	4168	powershell.exe	94
PID 4168 wrote to memory of 4508	4168	powershell.exe	94
PID 4168 wrote to memory of 4508	4168	powershell.exe	94
PID 4168 wrote to memory of 4508	4168	powershell.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\COTIZACIÓN-AUTOMÓVILES SANTA ANA, S.A.js"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\system32\wscript.exe
  "C:\Windows\system32\wscript.exe" //B //NoLogo "C:\Users\Admin\AppData\Local\SpoolCache\ledger33913.js"
  2⤵
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -File "queue67904.ps1"
    3⤵
    - Enumerates connected drives
    - Suspicious use of SetThreadContext
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      4⤵
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4508

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ledger33913.js

Path C:\Users\Admin\AppData\Local\SpoolCache\ledger33913.js
Size 780KB
SHA256 179674548ffb392b2165e1e4cfbd4f288f7a283418ff9a908b73ae63e3c5cacc
MD5 c7b39c275ba1864e3df3ccdd989172f4
SHA1 e990d02a920ea70b77473460ebd7e6ed08ef1e7f
SHA512 b5cc83bf3a07428aa050c4631b97f8180fe48709ed50f0e359852e6ffab43153246b7267475f126050bbdea0ef69a8f1e59423977fe405b58474bbe3f0628176
SSDEEP 12288:iLylYJD3mOlkMCGKMqIkC10I2ZCuh970jcGDN4ujy7O5cvZLv6QBz6:4x3aHGKMqIkCgR70jcAN4eKvZLvph6
TLSH
T1AB051204249A707F5476E12A938E4104E1BDD7434A6CE216B4ADF2D85FB38A052EFFDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

queue67904.ps1

Path C:\Users\Admin\AppData\Local\SpoolCache\queue67904.ps1
Size 90KB
SHA256 0a0b63bcabe6c445620b60e506e2d8492213a04e4c5b19b772c92f7e64240666
MD5 b6a25547b86ff967a8034a147c3aa862
SHA1 6922342ab383c672b55bcda7dd2f77e9f3a0559e
SHA512 1adb360b445266ada2fe56953bffc314ff0615b2d88d016393a0ea9bcf796912e5ab577464cbbf1d8770fadad2e1ae79f529dfd9a0614eb0303c2f8da195c99b
SSDEEP 1536:Y+aEx1B1gWp4Fv3/+uEulpXl+DWSVF+hzhFeTBSrGF/upHxmLbl7XOgVHBmMrGX0:Vakj1xmFvPGwmb2eNYygmVXJhmEdP
TLSH
T1B6931242C57E154F84EC4B3AB2F208BAE2FC9EC758500CB47FC57098997AA58A15727B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4168-8-0x0000000005550000-0x0000000005572000-memory.dmp

Download

memory/4168-10-0x0000000005DE0000-0x0000000005E46000-memory.dmp

Download

memory/4168-6-0x0000000005670000-0x0000000005CBA000-memory.dmp

Download

memory/4168-7-0x0000000074680000-0x0000000074E3C000-memory.dmp

Download

memory/4168-4-0x0000000004E80000-0x0000000004EB6000-memory.dmp

Download

memory/4168-9-0x0000000005D70000-0x0000000005DD6000-memory.dmp

Download

memory/4168-17-0x0000000007310000-0x00000000073A6000-memory.dmp

Download

memory/4168-13-0x0000000005E50000-0x00000000061AB000-memory.dmp

Download

memory/4168-14-0x0000000006300000-0x000000000631E000-memory.dmp

Download

memory/4168-15-0x00000000066D0000-0x000000000671C000-memory.dmp

Download

memory/4168-5-0x0000000074680000-0x0000000074E3C000-memory.dmp

Download

memory/4168-3-0x0000000074692000-0x0000000074693000-memory.dmp

Download

memory/4168-22-0x00000000078D0000-0x000000000791A000-memory.dmp

Download

memory/4168-19-0x0000000006900000-0x0000000006922000-memory.dmp

Download

memory/4168-20-0x00000000079D0000-0x0000000007F8A000-memory.dmp

Download

memory/4168-21-0x0000000008610000-0x0000000008C8C000-memory.dmp

Download

memory/4168-18-0x00000000068B0000-0x00000000068CA000-memory.dmp

Download

memory/4168-23-0x0000000007980000-0x000000000799A000-memory.dmp

Download

memory/4168-24-0x0000000007960000-0x0000000007968000-memory.dmp

Download

memory/4168-30-0x0000000074680000-0x0000000074E3C000-memory.dmp

Download

memory/4508-26-0x0000000005440000-0x00000000054DC000-memory.dmp

Download

memory/4508-27-0x0000000005A00000-0x0000000005A92000-memory.dmp

Download

memory/4508-28-0x00000000063F0000-0x00000000063FA000-memory.dmp

Download

memory/4508-25-0x0000000000400000-0x0000000000410000-memory.dmp

Download