Overview

overview

10

Static

static

1

XWormClient.rar

windows10-2004-x64

10

XWormClient.rar

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 12:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    XWormClient.rar
  • Size 42KB
  • Sample261002-pp6dlawyet
  • SHA256 1c880993a9374bf293f63e82d2a88f3ea3bf03b06b5c56913e0055c59d891865
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

Malware Config

Signatures

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Detect Xworm Payload 2 IoCs
  • Creates a file in the Startup directory 1 TTPs 3 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWormClient.rar"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4140
    • C:\Users\Admin\AppData\Local\Temp\7zOC207A6E9\XWormClient.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC207A6E9\XWormClient.exe"
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4708
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XWormClient" /tr "C:\ProgramData\XWormClient.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2572
  • C:\ProgramData\XWormClient.exe
    C:\ProgramData\XWormClient.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1128
  • C:\PROGRA~3\XWormClient.exe
    C:\PROGRA~3\XWORMC~1.EXE
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3484
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:2140
    • C:\ProgramData\XWormClient.exe
      "C:\ProgramData\XWormClient.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:5208
    • C:\ProgramData\XWormClient.exe
      "C:\ProgramData\XWormClient.exe"
      1⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4592
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XWormClient" /tr "C:\ProgramData\XWormClient.exe"
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5340

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          XWormClient.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zOC207A6E9\XWormClient.exe
          • Size 88KB
          • SHA256 827000eef8e4902f2cc3cf028923654d6cb46736324ae7742df2403c34e8878c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          XWormClient.lnk
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk
          • Size 692B
          • SHA256 2cc5a41bfd8fda2fba68f9c2fd7d43ba8a5f7649f0f4102ed0c7005513dfae14
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/4708-9-0x0000000000A50000-0x0000000000A6C000-memory.dmp
          Download

          memory/4708-10-0x00007FF99BCFF000-0x00007FF99BD00000-memory.dmp
          Download

          memory/4708-11-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
          Download

          memory/4708-12-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
          Download

          memory/4708-17-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
          Download

          memory/4708-21-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
          Download

          memory/4708-22-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
          Download

          memory/4708-24-0x000000001D4D0000-0x000000001D51E000-memory.dmp
          Download

          memory/4708-25-0x0000000002B50000-0x0000000002B56000-memory.dmp
          Download

          memory/4708-27-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
          Download