xworm | 66a76420bba2c68bd832f22b8af4f01061c1de5adb1828fc3dfa8cab24dcd49d

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/10/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
proceso.vbs
Size 137KB
Sample261005-vgetkazzbx
SHA256 66a76420bba2c68bd832f22b8af4f01061c1de5adb1828fc3dfa8cab24dcd49d
MD5 80e804d1361240f30e121dca2593acbd
SHA1 bd3b1ce8d1df07e5f69a27688f7f3e07df1c8244
SHA512 7142e6efbe8862f53d0fde9a8891d09f34368bcac0107e1fe2ca6ea6f3b7bab652713c702580eb5e0d7daba9806e00d01b5f34d030c156d7301a302fda40029b
SSDEEP 1536:AR4dRR88AEhG6+aKyF8VqiCGttj+EAqNLVcozGVHwrrhdKBq0rmXiu4oGhOoSi5j:6yCcNVlPoGmG
TLSH
T1FBD38DEA7C022DBC050B8675CC6A054F7FF8C933850964613E1E22A91F674B9E395FE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

medellin202156.duckdns.org:7777

Mutex

pLjLEBFnwxj0FXSY

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2448-42-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5676	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
696	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5676 set thread context of 2448	5676	powershell.exe	105

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	MSBuild.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4560	cmd.exe
4648	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4128	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5676	powershell.exe
5676	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5676	powershell.exe
Token: SeDebugPrivilege	2448	MSBuild.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 4560	696	WScript.exe	89
PID 696 wrote to memory of 4648	696	WScript.exe	91
PID 696 wrote to memory of 4128	696	WScript.exe	93
PID 696 wrote to memory of 2212	696	WScript.exe	95
PID 696 wrote to memory of 5676	696	WScript.exe	99
PID 5676 wrote to memory of 852	5676	powershell.exe	101
PID 852 wrote to memory of 300	852	csc.exe	102
PID 5676 wrote to memory of 3748	5676	powershell.exe	103
PID 3748 wrote to memory of 3892	3748	csc.exe	104
PID 5676 wrote to memory of 2448	5676	powershell.exe	105
PID 5676 wrote to memory of 2448	5676	powershell.exe	105
PID 5676 wrote to memory of 2448	5676	powershell.exe	105
PID 5676 wrote to memory of 2448	5676	powershell.exe	105
PID 5676 wrote to memory of 2448	5676	powershell.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\proceso.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if not exist "C:\Users\Admin\AppData\Local\Photo Studio" mkdir "C:\Users\Admin\AppData\Local\Photo Studio"
  2⤵
  - Executes a command shell one-liner
  PID:4560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if not exist "C:\Users\Admin\AppData\Local\Photo Studio\PhotoStudio.vbs" copy /y "C:\Users\Admin\AppData\Local\Temp\proceso.vbs" "C:\Users\Admin\AppData\Local\Photo Studio\PhotoStudio.vbs"
  2⤵
  - Executes a command shell one-liner
  PID:4648
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "PhotoStudioVBS" /xml "C:\Users\Admin\AppData\Local\Temp\mfp_x45768.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\mfp_x45768.xml"
  2⤵
  PID:2212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -EP Bypass -Sta -File "C:\Users\Admin\AppData\Local\Temp\23184.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tgww4d0s\tgww4d0s.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:852
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES37DF.tmp" "c:\Users\Admin\AppData\Local\Temp\tgww4d0s\CSCB1BE4BC5E32449E28C87BADA7E5EA8FA.TMP"
      4⤵
      PID:300
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kv4osc51\kv4osc51.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES38AA.tmp" "c:\Users\Admin\AppData\Local\Temp\kv4osc51\CSCCDD8A9EFDC1D40CE88D7A1868934C9.TMP"
      4⤵
      PID:3892
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Enumerates video capture drivers
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2448

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

23184.ps1

Path C:\Users\Admin\AppData\Local\Temp\23184.ps1
Size 67KB
SHA256 bf3642cd9856a251b6158faf73e82e7dcc7a091f0680146bf0530ad523b220cd
MD5 343a15823eb962409e09ccd56c9bc8b2
SHA1 f3d3d407bbaf2d664c6b467e8f899c8c69000f23
SHA512 400158c4880033a9bf2b110bf23dbceb0f8238011f0d12fa75f62eab4a5532341e193095052698cd8c6894840ee13f3a0b4f297e622b1181390cfc842bf60aae
SSDEEP 1536:BXLM9syXZmT1Ms9We3LNWOIB1YAXVDaYQlB46wZokafWdsjK7toaUMDSCdSC5CmL:tM9syXoTN1LAOI7Jrh6kodfuCaUMn
TLSH
T1D663061077E62088F1B3AF11DAFEA5969A2F7BA23A35C54E018C034E07B3945DD57B39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES37DF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES37DF.tmp
Size 1KB
SHA256 f18082f0b0ad2cf2f52aa5e28f990c092ec7ce6904169fd06084b62303066704
MD5 81d3d7e82f6014d9e853a7d8a9e93c02
SHA1 831620131bc209e32df0134693c3ed38d1d518fa
SHA512 f726b1df1fe4211e64382c812ab1b22432b67c231ad1ab46c9baa1e0122640ef164d89e82505a62e2f60864c5f6f1cdc96deb500e1ae779aac13995e3d5ce46d
TLSH
T1E8218C0547E9470FF0775731A9F6176FA238FD55EFA2939A8940422C2C51204EFA1B73
MD5 SHA1 SHA512 TLSH

Submit Download

RES38AA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES38AA.tmp
Size 1KB
SHA256 890abcce0752070c21f323266eaa218b5dd0613abb71cb7d84cec387c9548db2
MD5 4ead67148154706b4a3b908ef50db618
SHA1 8d8169c41443fd853038920f6141b278c9cddaa4
SHA512 e4c14d1ca059672c20dd291a53d59f2c4497b16897b9ef8ffe5247976c7a3fb16c239fc956f8de2dc5da2e066f3b2d513995887dc815317c9c961fa25a2db213
TLSH
T11521C90583E9471BF073073169FA032FA274FDA8EFA6539E894442282C01544EEE0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

kv4osc51.dll

Path C:\Users\Admin\AppData\Local\Temp\kv4osc51\kv4osc51.dll
Size 4KB
SHA256 73b4ffdc7aea9b137f8fab93ff8d37a36ade2faa35a58968745b26a8918cc903
MD5 838edd90ae272e7eee9ce0043138b21e
SHA1 0403169a0df356f883b4dd24f9ad3c5634f15d83
SHA512 61dc3afee055f3c3e7951521aa43d594ac44597b2a4abc0fcb0eec01713834571042cd473c48ecfcfe6039869dd4a608ed9d82db913ff81b8099113723734392
TLSH
T17881760677ED011AE47747759AF307636A34E5A0AF3773AF6DE043296C643608D21BB1
MD5 SHA1 SHA512 TLSH

Submit Download

mfp_x45768.xml

Path C:\Users\Admin\AppData\Local\Temp\mfp_x45768.xml
Size 1KB
SHA256 52b52f6433f20e07469df293e37618e4d96b73846f88c9e257c5f9b6533b2a7f
MD5 a7c18e35e18b3d41bafd4f945488d9b4
SHA1 1483d3206fa0c2a400616135ae07ff3636723631
SHA512 850251b64e0091465686f7d3b47a9daca05b0e48c313039c68a17e3f3bced0aa9f91e5f14efc67d197db39f7d546be6a6a3a88903bb15569a6c3ee4b9977de41
TLSH
T1A4318C43A7FD220DF1F3AF9CAAB6541199B6FD655D28D4AD00B40A0D0971E71C9B0B37
MD5 SHA1 SHA512 TLSH

Submit Download

tgww4d0s.dll

Path C:\Users\Admin\AppData\Local\Temp\tgww4d0s\tgww4d0s.dll
Size 5KB
SHA256 79d6e2ba0dde83e87121933967928937494a7f1ef5cf78670810fba8e3800ce9
MD5 df4bffe4f6ae1e5c58b5d0066e7a6bb3
SHA1 b57eda87572c6b8ea7d8dfd3982e9678fdfe4b49
SHA512 30f0dd69e418cd95ddfbe1b54825586eba45bb8f34bee9a6faf4a0cfb3c1b098f3f2ba305264df1f044caf6e65100e9da9e5365f216b874f4c7bac58cd53a2d9
SSDEEP 48:65WqBYjSJHNDZMSaJD5a+5iFNaVjZbIIfib1gbmgDngdJEpjBKo+1ul4a3kq:b4YjSJHpZMnJNtiKhrlKsWK
TLSH
T10BB1511AD3DC0593E5AB033CB9F70743E774E8884B6BCB6F19C041292C7BB641A25B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCCDD8A9EFDC1D40CE88D7A1868934C9.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\kv4osc51\CSCCDD8A9EFDC1D40CE88D7A1868934C9.TMP
Size 652B
SHA256 2f375676e1d6783d22ac29c367bb81c31131a122feff5fefce4b24a394357fc2
MD5 a731c093751947079cf3b685ab822eab
SHA1 c2ba49835605243a72b5e5ad8ecd5d6f676d518f
SHA512 0b3114d184e9306c61a0b1ac6ec2f4bf281ef3d9b2fcb3be25118bfc9bea7365413372517cd8ae3202edc76e27466669ca15ba63440c1641b4756f94383bde8e
TLSH
T1E5F05E0963F8020EF4F34F30BDF683A795A8BC64DE3293ED184113192C649108972FB6
MD5 SHA1 SHA512 TLSH

Submit Download

kv4osc51.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\kv4osc51\kv4osc51.0.cs
Size 2KB
SHA256 291785496efa7cf758790d1099c06384b3b4a6abae37d9f172f93ee7dce805ef
MD5 7b641fcc51c78df821f7ac51ca7c7dea
SHA1 d6a174f52d0ebd9afb24aafaffe6d41ca4292629
SHA512 fdf45d3b8216673851d652dc221a7653a9c662beb9e52cafc86ed48e2044f63650b8ad617bc0b3c9ed9baef980e657f0f3b5b3bde14f745caebf7be91780b4ce
TLSH
T1CB41AC41D9E3DA791A8784398F7DD5023798E03326E8FC48BD1DA6640F225511BF4A9E
MD5 SHA1 SHA512 TLSH

Submit Download

kv4osc51.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\kv4osc51\kv4osc51.cmdline
Size 369B
SHA256 c2cc2c458e7b3a5dedda056bd003be8fd222f229b2330eeb17e9ca5729f7b921
MD5 b62f60a7a45a96ec68d43fc066b8ad74
SHA1 f3d30f690ddd60af2cc915c3ebff592ca9ce10d5
SHA512 ba6f36fa652ef765d616c2cadc5a565c57373399f378d5e4597a54a27f7700cdb78d03825dfa9e12d0526dcff69b7c3be354424e024accd6c5b6c8ae86dd7206
TLSH
T1F6E06F2B4347C27E42E9100B266AD4BD92720BC32B803FC49248880FE0270002BD27B2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB1BE4BC5E32449E28C87BADA7E5EA8FA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\tgww4d0s\CSCB1BE4BC5E32449E28C87BADA7E5EA8FA.TMP
Size 652B
SHA256 221f91fb3c117da6624e34a19ce22de2f08203e252845b8466e10068f87d6622
MD5 e413363cf8023ea86033c82646049051
SHA1 6630d8accea28e0c0da77a64fe19217bd0769d9d
SHA512 6d936bd85597e3a0c8fa32a9b70a8a7f0cfac6aca0f4153b91f8f3709276bcd410f28a3ffc60193b26014255911bb5afc62d2157e62569473fea95d643b8d40c
TLSH
T1BAF03A0963F8020EF0F35B30BAF653A391ACFC64DE7293ED1440436D2C646249A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

tgww4d0s.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\tgww4d0s\tgww4d0s.0.cs
Size 3KB
SHA256 d7603f5d018b5911bec49d7b9f4af4432a1bfe65569477fd3e2380cc439fe0f9
MD5 2a206de1a016d16431401f75cef137da
SHA1 b39ba632fb7d9b4788b9bd1829782977f3be84b9
SHA512 b39b6a8259eb47678b1e865a96260c88ffbf2cdc04e550c03a1a5599c73d5535050c1eb9155c96e364e009712cc46c7af435250467b5fc6e7be4eca3accc4c2f
TLSH
T15F613328136687A024D71025FA87A08BF613407329FF9C3079FD47261F8B249E4B2B6E
MD5 SHA1 SHA512 TLSH

Submit Download

tgww4d0s.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\tgww4d0s\tgww4d0s.cmdline
Size 369B
SHA256 19d358606a5ae3c1349bf4f97e9feb2e1c94ce63f68db6edfbd1b3698d79d44f
MD5 a7340bd0479a0e8bec9977976a8f0b43
SHA1 31865e89af797609ac70490eb58a16866e2fd8df
SHA512 802731694d42308a5f86ca92d99dfd67becd2c561b1b9e17dc4ba14d5b5134af6e5ad222729647455d727c2b55fb8478ec938b8fd25bb8e4e991b897e8536a41
TLSH
T131E0C02A6287C67D89DD20572169ECECC373078B69423F847D40440DD02700067D1743
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2448-42-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2448-46-0x0000000007330000-0x00000000078EA000-memory.dmp

Download

memory/2448-45-0x0000000006BD0000-0x0000000006C62000-memory.dmp

Download

memory/2448-43-0x0000000005280000-0x000000000531C000-memory.dmp

Download

memory/5676-7-0x0000000006110000-0x0000000006176000-memory.dmp

Download

memory/5676-28-0x0000000006C20000-0x0000000006C28000-memory.dmp

Download

memory/5676-14-0x0000000007C80000-0x00000000082FC000-memory.dmp

Download

memory/5676-6-0x0000000005FF0000-0x0000000006056000-memory.dmp

Download

memory/5676-5-0x0000000005860000-0x0000000005882000-memory.dmp

Download

memory/5676-4-0x00000000059A0000-0x0000000005FEA000-memory.dmp

Download

memory/5676-3-0x0000000003130000-0x0000000003166000-memory.dmp

Download

memory/5676-41-0x0000000005460000-0x0000000005468000-memory.dmp

Download

memory/5676-10-0x0000000006340000-0x000000000669B000-memory.dmp

Download

memory/5676-11-0x00000000062C0000-0x00000000062DE000-memory.dmp

Download

memory/5676-12-0x00000000066A0000-0x00000000066EC000-memory.dmp

Download

memory/5676-15-0x0000000006BF0000-0x0000000006C0A000-memory.dmp

Download