xworm | e4c42b2810d153c09bad4a77b62c0a0b9cd9bdfb2fe36d8bffda78df1e710c5b

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OC_68156306.js
Size 132KB
Sample261001-ppm71sxwcs
SHA256 e4c42b2810d153c09bad4a77b62c0a0b9cd9bdfb2fe36d8bffda78df1e710c5b
MD5 e3d3c028e71cb88873ce53962ab1b2e2
SHA1 e3fde2c0ba37b1e52d14b30998bdb57a652121ea
SHA512 1c44c399e8d0b0dcb72928f36527017014815bbbdd6eb0f6483ec76a9b50db34875d5aab140dc4d77035d917011d488b7fccaf31abab67db1793abea25f51617
SSDEEP 3072:Bf7YW+ROTT+8yeQb4DARXONy4ffdl4ZalbLx1sT3KvExB29:Bf7kQm54wXGffoIl51s2vKBm
TLSH
T113D39E7053A8D01C4F23794A973FA1925A5EB76AD08ED14841BDC2C628F51FFD23786E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

23.132.164.57:7007

Mutex

qVUdZf2DflzoRTDS

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/5192-15-0x0000000000750000-0x000000000075E000-memory.dmp	family_xworm
behavioral2/memory/2288-18-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Executes dropped EXE 2 IoCs

pid	Process
4004	packagehubfz.exe
5872	packagehubfz.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4004 set thread context of 5192	4004	packagehubfz.exe	95
PID 5872 set thread context of 2288	5872	packagehubfz.exe	96

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RegAsm.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	packagehubfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	packagehubfz.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1956	schtasks.exe
3848	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5192	RegAsm.exe
Token: SeDebugPrivilege	2288	RegAsm.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 4004	2104	wscript.exe	88
PID 4004 wrote to memory of 1956	4004	packagehubfz.exe	89
PID 5872 wrote to memory of 3848	5872	packagehubfz.exe	93
PID 4004 wrote to memory of 5192	4004	packagehubfz.exe	95
PID 4004 wrote to memory of 5192	4004	packagehubfz.exe	95
PID 4004 wrote to memory of 5192	4004	packagehubfz.exe	95
PID 4004 wrote to memory of 5192	4004	packagehubfz.exe	95
PID 4004 wrote to memory of 5192	4004	packagehubfz.exe	95
PID 5872 wrote to memory of 2288	5872	packagehubfz.exe	96
PID 5872 wrote to memory of 2288	5872	packagehubfz.exe	96
PID 5872 wrote to memory of 2288	5872	packagehubfz.exe	96
PID 5872 wrote to memory of 2288	5872	packagehubfz.exe	96
PID 5872 wrote to memory of 2288	5872	packagehubfz.exe	96

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\OC_68156306.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\AppData\Local\Temp\rad68439.tmp\packagehubfz.exe
  "C:\Users\Admin\AppData\Local\Temp\rad68439.tmp\packagehubfz.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn PolicyCacheRefresh /xml "C:\Users\Admin\AppData\Local\Temp\lxC00A.tmp" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1956
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5192

C:\Users\Admin\AppData\Local\PolicyCache\packagehubfz.exe
C:\Users\Admin\AppData\Local\PolicyCache\packagehubfz.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Windows\SysWOW64\schtasks.exe
  schtasks.exe /create /tn PolicyCacheRefresh /xml "C:\Users\Admin\AppData\Local\Temp\lxC4AE.tmp" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lxC00A.tmp

Path C:\Users\Admin\AppData\Local\Temp\lxC00A.tmp
Size 1KB
SHA256 875358a194caebc53e995a94059326a1c6417623bf7bb33c3cb4422b2c2b34bc
MD5 0387d58dd61cdaf9d9c3c29177e0d730
SHA1 5cf74a29dac0d6adc85255a088c8af5f48b0bfe9
SHA512 4bbee45f6288f155bac95038d0e3e40911bb73f37aeec021f4ad8d4d457773765e663d15ac88c0b2fee5f7be4942d8dd1e6c1d0283d64c17c327c01ecf3a685e
TLSH
T1D8318743ABFD220DF2F3AB9CAEBAA45199BAFD615D28D46C0070090D0530D71C9B0B37
MD5 SHA1 SHA512 TLSH

Submit Download

packagehubfz.exe

Path C:\Users\Admin\AppData\Local\Temp\rad68439.tmp\packagehubfz.exe
Size 26KB
SHA256 cda97e8cd986f79f29e71208d6ca65eac4b213d0e5754fd4ddf7c5a336f889be
MD5 0f61554dfa26b7962401ad051d78f840
SHA1 04c3cedc949f6c1ea92362a07ed4685d87bce80a
SHA512 efd2b594e6591de698e25d9194bdeccb91a72c562427c708e3a667ab536e15ba1648750b8311e4dd5915f0264ac141f8c66f6e0cbbb66d3fa293603e41b204a2
SSDEEP 768:QuerVMYVy92uqPrInPNdp3VbgrGC1ltOT4JfWuKgLa10H:LerVMXFUrkJC1ltQ4J+SLa
TLSH
T195C2F96BB7CFB926E10D53B351A181A3A675A23036B34A69F283DFB8FD715C0561430E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

runtimefz.dat

Path C:\Users\Admin\AppData\Local\Temp\rad68439.tmp\runtimefz.dat
Size 17KB
SHA256 e83bb139d9e924748a872f9907382b3c3a90ee17234b0002d7af1b887de88528
MD5 51a7272c52112bbd58192d1adf94200c
SHA1 f7e9ab8d0816f34fd7f40d694443663d70cd4fdb
SHA512 f30a2d9c19f8c98f9786d15f480d6b8f1ef0442aecd44d141e9605dc71cefefe5c4f94756649d167f762802654db4dae95b05a791ca21e821ea72620c819a56c
SSDEEP 384:R5LejlevbHMWjP5joRlEsUvK1IMg/QeBI/5oAzGR:ReGljP1oRlEsUibgYeBOKR
TLSH
T16882D0D8D08E13CFB143EB6279FAB5637E626B1D70525A634171BD62EEB4A30823C44C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2288-18-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/5192-15-0x0000000000750000-0x000000000075E000-memory.dmp

Download

memory/5192-16-0x0000000074D42000-0x0000000074D43000-memory.dmp

Download

memory/5192-17-0x0000000004D70000-0x0000000004E0C000-memory.dmp

Download

memory/5192-19-0x0000000005470000-0x00000000054D6000-memory.dmp

Download

memory/5192-20-0x0000000074D42000-0x0000000074D43000-memory.dmp

Download

memory/5192-21-0x0000000006990000-0x0000000006A22000-memory.dmp

Download

memory/5192-22-0x0000000006FF0000-0x00000000075AA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads