xworm | 66a76420bba2c68bd832f22b8af4f01061c1de5adb1828fc3dfa8cab24dcd49d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/10/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
proceso.vbs
Size 137KB
Sample261005-vgetkazzbx
SHA256 66a76420bba2c68bd832f22b8af4f01061c1de5adb1828fc3dfa8cab24dcd49d
MD5 80e804d1361240f30e121dca2593acbd
SHA1 bd3b1ce8d1df07e5f69a27688f7f3e07df1c8244
SHA512 7142e6efbe8862f53d0fde9a8891d09f34368bcac0107e1fe2ca6ea6f3b7bab652713c702580eb5e0d7daba9806e00d01b5f34d030c156d7301a302fda40029b
SSDEEP 1536:AR4dRR88AEhG6+aKyF8VqiCGttj+EAqNLVcozGVHwrrhdKBq0rmXiu4oGhOoSi5j:6yCcNVlPoGmG
TLSH
T1FBD38DEA7C022DBC050B8675CC6A054F7FF8C933850964613E1E22A91F674B9E395FE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

medellin202156.duckdns.org:7777

Mutex

pLjLEBFnwxj0FXSY

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4740-49-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3944	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3332	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3944 set thread context of 4740	3944	powershell.exe	114

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	MSBuild.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3936	cmd.exe
5056	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3944	powershell.exe
3944	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeDebugPrivilege	4740	MSBuild.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 5056	3332	WScript.exe	87
PID 3332 wrote to memory of 3936	3332	WScript.exe	89
PID 3332 wrote to memory of 1948	3332	WScript.exe	91
PID 3332 wrote to memory of 2152	3332	WScript.exe	93
PID 3332 wrote to memory of 3944	3332	WScript.exe	105
PID 3944 wrote to memory of 4028	3944	powershell.exe	110
PID 4028 wrote to memory of 3352	4028	csc.exe	111
PID 3944 wrote to memory of 2780	3944	powershell.exe	112
PID 2780 wrote to memory of 4008	2780	csc.exe	113
PID 3944 wrote to memory of 4740	3944	powershell.exe	114
PID 3944 wrote to memory of 4740	3944	powershell.exe	114
PID 3944 wrote to memory of 4740	3944	powershell.exe	114
PID 3944 wrote to memory of 4740	3944	powershell.exe	114
PID 3944 wrote to memory of 4740	3944	powershell.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\proceso.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if not exist "C:\Users\Admin\AppData\Local\Photo Studio" mkdir "C:\Users\Admin\AppData\Local\Photo Studio"
  2⤵
  - Executes a command shell one-liner
  PID:5056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if not exist "C:\Users\Admin\AppData\Local\Photo Studio\PhotoStudio.vbs" copy /y "C:\Users\Admin\AppData\Local\Temp\proceso.vbs" "C:\Users\Admin\AppData\Local\Photo Studio\PhotoStudio.vbs"
  2⤵
  - Executes a command shell one-liner
  PID:3936
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "PhotoStudioVBS" /xml "C:\Users\Admin\AppData\Local\Temp\mfp_x45672.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\mfp_x45672.xml"
  2⤵
  PID:2152
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -EP Bypass -Sta -File "C:\Users\Admin\AppData\Local\Temp\65380.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nru2ohr1\nru2ohr1.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEA4B.tmp" "c:\Users\Admin\AppData\Local\Temp\nru2ohr1\CSCCACB85407484C50AC6174542E67BFF5.TMP"
      4⤵
      PID:3352
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\10jodf4q\10jodf4q.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEB36.tmp" "c:\Users\Admin\AppData\Local\Temp\10jodf4q\CSCCFBA0BA3AE3440E911F5D3C23AD36B6.TMP"
      4⤵
      PID:4008
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Enumerates video capture drivers
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4740

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:2708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10jodf4q.dll

Path C:\Users\Admin\AppData\Local\Temp\10jodf4q\10jodf4q.dll
Size 4KB
SHA256 4e355e35b224106902f87c3758a4aae0b03051ec56cc4fe4282a6c3fc84fa23d
MD5 81a1cdbd9073cde9e64eda6012f46059
SHA1 21814351efa7a0bda833fb2cbdfd5b96f7ab3a34
SHA512 d3e11ecbf8ba59be6a64fb40ef80d500b37b758775a49ed8ebb0e73a07b650e770f1ff2ec9fbfaa1af28b6aabb15c9e9172aab7394f14124ac7de022f776f2f1
TLSH
T1AB817606B7ED411AE07747715AF317636A74E9B0AA2773AF6CE043286C643A09921BF1
MD5 SHA1 SHA512 TLSH

Submit Download

65380.ps1

Path C:\Users\Admin\AppData\Local\Temp\65380.ps1
Size 67KB
SHA256 bf3642cd9856a251b6158faf73e82e7dcc7a091f0680146bf0530ad523b220cd
MD5 343a15823eb962409e09ccd56c9bc8b2
SHA1 f3d3d407bbaf2d664c6b467e8f899c8c69000f23
SHA512 400158c4880033a9bf2b110bf23dbceb0f8238011f0d12fa75f62eab4a5532341e193095052698cd8c6894840ee13f3a0b4f297e622b1181390cfc842bf60aae
SSDEEP 1536:BXLM9syXZmT1Ms9We3LNWOIB1YAXVDaYQlB46wZokafWdsjK7toaUMDSCdSC5CmL:tM9syXoTN1LAOI7Jrh6kodfuCaUMn
TLSH
T1D663061077E62088F1B3AF11DAFEA5969A2F7BA23A35C54E018C034E07B3945DD57B39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESEA4B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEA4B.tmp
Size 1KB
SHA256 145f56aff661e2cf811ffcb30328a70fc2c3d6cac3c0e8bbd7ff778887699a13
MD5 0ee2017e8433a5e7251655050a09bc63
SHA1 5438892a20e5dd05afea0bc2c94863dc64627d2e
SHA512 4f3b159ae63e06483a855434bc6496b217eb92696adf14609a4fea63f7df0250f7057f87779cac729d1654f37a2d4c0df92e2a5967c1238cf338798e145ff008
TLSH
T1D2218C0583E9471EF0B3473169F6132F9278FD59EF62636B868041381C51544EEA1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESEB36.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEB36.tmp
Size 1KB
SHA256 4de26962a74e02b3d59fc02094f58c77a4ac82cc982aa26368cc94f29ed1187c
MD5 b1c7de838da3c62dedfe23b769aeef9a
SHA1 3596ceacb481705d2d51242ffe6e45f4151ab1ab
SHA512 4d19ac8055f4b9ba1c3de3d5ce194f87b914fa705573221040dbe9285c2c793a6b1e6e5f971f08b5e8f33570aac965ffd90086a6c0824bbc6c22c1aefcbf1537
TLSH
T123217F0543F84B1BF077573169F6172F9238FD65DF62935B854042282C51144EEB1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_q23kb1pn.w0n.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q23kb1pn.w0n.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mfp_x45672.xml

Path C:\Users\Admin\AppData\Local\Temp\mfp_x45672.xml
Size 1KB
SHA256 6c43d483fee89f269270023d0152d0b9c99b913f759e57d4eb0759281f49990c
MD5 0d498068c0313b4bd91bb96a521132aa
SHA1 67be1925107c3ed04984bbfd3442efc8227e09de
SHA512 a8401d8e0dc47ca362598f33d7402b9d1b411a60ceca33b15808c92859b86e91990d57ab56109dfd0b34e8cb543162ec5da0265c4c4c3879595f0b797d83a491
TLSH
T102318C43A7FD220DF1F39F9CAABA641159B6FD655D28D4AD00B40A0D0971A71C9B0B37
MD5 SHA1 SHA512 TLSH

Submit Download

nru2ohr1.dll

Path C:\Users\Admin\AppData\Local\Temp\nru2ohr1\nru2ohr1.dll
Size 5KB
SHA256 345ceb716c080b5c9ecfa419c58c01df5df9b61e8683c879567afe5c75d169a0
MD5 c07b50304b654774ab0b8a766b528b9b
SHA1 364639113a86d689e3413d8097e722e08e8911bb
SHA512 fe4ab1bbd5f05dac77dd4350db952cfed3ea9fe738fa229ad25aa38489fe4d6f0a7dd9fc274468ac757beba528f61de3cc45231a589daf284a1280b134dc26a0
SSDEEP 48:6MWqBYjSJHNDZMSaJD5a+5iFNaVjNwbIIfib1gbmgDngdJgEpjBSo+1ulda3hq:Y4YjSJHpZMnJNtiKHSrDmSs/K
TLSH
T17EB1821AD3DC0593F5AB033CBDB70B02E7B4E8844B2BCB6F09C451292C7BB641925BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10jodf4q.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\10jodf4q\10jodf4q.0.cs
Size 2KB
SHA256 291785496efa7cf758790d1099c06384b3b4a6abae37d9f172f93ee7dce805ef
MD5 7b641fcc51c78df821f7ac51ca7c7dea
SHA1 d6a174f52d0ebd9afb24aafaffe6d41ca4292629
SHA512 fdf45d3b8216673851d652dc221a7653a9c662beb9e52cafc86ed48e2044f63650b8ad617bc0b3c9ed9baef980e657f0f3b5b3bde14f745caebf7be91780b4ce
TLSH
T1CB41AC41D9E3DA791A8784398F7DD5023798E03326E8FC48BD1DA6640F225511BF4A9E
MD5 SHA1 SHA512 TLSH

Submit Download

10jodf4q.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\10jodf4q\10jodf4q.cmdline
Size 369B
SHA256 a32b8178a3e2da1ffae7fdd95e0903a0b1553ec117d90a42dd67f21ee20a2fd7
MD5 4679df9d398866eb675323d15eb98366
SHA1 b347bb716830cdeb9eaf4f243708746b4bdeff35
SHA512 88154546da6c8d292f09deca1e2b9b0b1697de38162bd95bf27e46ff5e0bbbd19c2de51847e325ff806ac6649d731865c0b81c0066a0ec1f7262c51e167bdd33
TLSH
T1DFE0203B52D6CB7D15DD20072169C9BCD6F3974729417FC4515044ADD467008BFD27D5
MD5 SHA1 SHA512 TLSH

Submit Download

CSCCFBA0BA3AE3440E911F5D3C23AD36B6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\10jodf4q\CSCCFBA0BA3AE3440E911F5D3C23AD36B6.TMP
Size 652B
SHA256 7823be05f5e688afe6300593f450ff2814471b495420f02033837dc328c1a72f
MD5 501f2bb489f7052c605f989be39fca10
SHA1 356dd58065902c237696fd3586de14fec9a28e76
SHA512 e0e0605affee613b7e3d82720124371f404506bbf4a688f9679c1d6b9eb94d544617daf34e51678c0979dd8280069a5db4eead3b4e26c311d98717847c4c2c9f
TLSH
T139F05E0963F8420EF0F34B30BEF6536391B8BD64DE3293ED184043192C646108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCCACB85407484C50AC6174542E67BFF5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\nru2ohr1\CSCCACB85407484C50AC6174542E67BFF5.TMP
Size 652B
SHA256 12ac783d6ce25cebc6953b51a0ebf7e5c4c398b09560760e4012de34b18b5f1d
MD5 f62d2d2c63969401df8369d411ecd446
SHA1 7ce0f8bf74b46741a801ae7d83a399b2ba8cadb5
SHA512 503de7b6b221bff2dcc9f4d234a9221ff0c903faf456cf1536a7b1c45eadf0cf2500e36a2dc4bf5bbec3012fb2da5725ac274fc9723520f3142f1e20c923d686
TLSH
T1A5F05E4963F8020EF0F34B30BEF6436791B9BC65DE32A3ED158013592C749109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

nru2ohr1.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\nru2ohr1\nru2ohr1.0.cs
Size 3KB
SHA256 d7603f5d018b5911bec49d7b9f4af4432a1bfe65569477fd3e2380cc439fe0f9
MD5 2a206de1a016d16431401f75cef137da
SHA1 b39ba632fb7d9b4788b9bd1829782977f3be84b9
SHA512 b39b6a8259eb47678b1e865a96260c88ffbf2cdc04e550c03a1a5599c73d5535050c1eb9155c96e364e009712cc46c7af435250467b5fc6e7be4eca3accc4c2f
TLSH
T15F613328136687A024D71025FA87A08BF613407329FF9C3079FD47261F8B249E4B2B6E
MD5 SHA1 SHA512 TLSH

Submit Download

nru2ohr1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\nru2ohr1\nru2ohr1.cmdline
Size 369B
SHA256 1d1bd86186d8e03c14c2854553e869336febaafdea84e1e6432fbde5c0b96c86
MD5 ee74696a195ed665358573bc9bd09497
SHA1 9e6d4db33beb837fed7092bcec96b6e134ffc34d
SHA512 07f955a96d1c0998121bf85f07787a2f3c20e9425b2a03af98e03e0e6eb9fb0c512b4e0d70ee8ba3edc185b4a7c5e043af57b8a271e1a3b67d412e440cab0470
TLSH
T105E06F3B4287C27D02EA100B226AC4BC82B20A832BC03F849488882DE1670002FD2782
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3944-8-0x0000000005770000-0x00000000057D6000-memory.dmp

Download

memory/3944-6-0x0000000005040000-0x0000000005668000-memory.dmp

Download

memory/3944-19-0x0000000005F90000-0x0000000005FDC000-memory.dmp

Download

memory/3944-18-0x0000000005F50000-0x0000000005F6E000-memory.dmp

Download

memory/3944-17-0x0000000005920000-0x0000000005C74000-memory.dmp

Download

memory/3944-35-0x0000000006500000-0x0000000006508000-memory.dmp

Download

memory/3944-21-0x00000000078D0000-0x0000000007F4A000-memory.dmp

Download

memory/3944-9-0x00000000057E0000-0x0000000005846000-memory.dmp

Download

memory/3944-7-0x0000000004F90000-0x0000000004FB2000-memory.dmp

Download

memory/3944-22-0x00000000064A0000-0x00000000064BA000-memory.dmp

Download

memory/3944-48-0x0000000006510000-0x0000000006518000-memory.dmp

Download

memory/3944-5-0x0000000004930000-0x0000000004966000-memory.dmp

Download

memory/4740-49-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4740-52-0x00000000054E0000-0x000000000557C000-memory.dmp

Download

memory/4740-53-0x00000000068D0000-0x0000000006962000-memory.dmp

Download

memory/4740-54-0x0000000006F20000-0x00000000074C4000-memory.dmp

Download