xworm | 55841c189470fa4f70af18bebb3135c80d3a481076b4a93dc086256398705292

Analysis

max time kernel
149s
max time network
142s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/10/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XClient1.exe
Size 39KB
Sample261001-xp84gswfrc
SHA256 55841c189470fa4f70af18bebb3135c80d3a481076b4a93dc086256398705292
MD5 09a16d6562ff19a3e2babb34020caf87
SHA1 67513db57c4dfe6f0564cfcb003e69f16cb929bc
SHA512 d855eb7c8625ec7e68bdbc64d1ff5f1ea824c9fc361e289befa79668157730d463c6620f713d3d3f7db7dcd6b4cebddcb01e7a8d36dda1a0bd3336e1967bf433
SSDEEP 384:l4rvFV85K7QMXRKdqnJsoZW3U7rJI/z7LdLpNV5v6EHOid5xazLl0jpkFM/NLT5f:0855EuhRn5pVNHOi2RlFo9SVOMhlL0B
TLSH
T17D033C0437E44225D5FE7FFA6AB3A5021630F6079913EB4E4CD8895B2B2B7C089417EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.tcp.cpolar.cn:12508

Mutex

01hDaiJnKz0QaXPR

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3408-0-0x00000000003B0000-0x00000000003C0000-memory.dmp	family_xworm

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
6	ip-api.com

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	XClient1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	XClient1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3408	XClient1.exe

C:\Users\Admin\AppData\Local\Temp\XClient1.exe
"C:\Users\Admin\AppData\Local\Temp\XClient1.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3408-0-0x00000000003B0000-0x00000000003C0000-memory.dmp

Download

memory/3408-1-0x000000001B0D0000-0x000000001B0E0000-memory.dmp