xworm | 90c2655130733bc1680627754c107c9d8cfd033df0ff40613868e027125b2981

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/10/2026, 18:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SECURE BYTE GUI.exe
Size 9.7MB
Sample261016-w5flfaba67
SHA256 90c2655130733bc1680627754c107c9d8cfd033df0ff40613868e027125b2981
MD5 7d422cc9f11fb105ee11dd00ff43b8ad
SHA1 688b78961d938249531980af04a02781d6ea6fa0
SHA512 69170cc57af4b0490bee8e72ee588a5c25debb42b450b12e041a41028314b755e786722fc17057b8cac700986e6d55464a89a0c24e64d3eb29c5ca8a9112a8f1
SSDEEP 98304:2mzLl2SADPtxo/DEkMx/HUYDGSXr5Y3BPyU2WQ:yDVe/D7MFBGSbO3L2
TLSH
T1B3A6877951CF7227CB6121F2FE03A8EDDA5B75CAA372810876851C96C5CF9C2A478CE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

crypter defense_evasion discovery execution xworm hacktool packer persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

m7mnga-38338.portmap.host:38338

Mutex

JigXrL7925vRQAGo

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4924-90-0x0000000001660000-0x000000000166E000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3236	powershell.exe
2392	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	SECURE BYTE GUI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	window.exe

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\winlogon.exe	winlogon.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\winlogon.exe	winlogon.exe

Executes dropped EXE 4 IoCs

pid	Process
2052	SECURE BYTE GUI.exe
3468	window.exe
3336	winlogon.exe
4924	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
2052	SECURE BYTE GUI.exe
2052	SECURE BYTE GUI.exe

Packer/crypter tool: SecureByte 2 IoCs

SecureByte: an open-source packer/crypter that encrypts payloads and produces obfuscated executables.

hacktool packer crypter

resource	yara_rule
behavioral1/files/0x000700000002443f-21.dat	securebyte
behavioral1/memory/2052-31-0x0000000000770000-0x00000000009C2000-memory.dmp	securebyte

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/files/0x0007000000024439-38.dat	ConfuserEx

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4208	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	winlogon.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SECURE BYTE GUI.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2820	timeout.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	SECURE BYTE GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3236	powershell.exe
3236	powershell.exe
2392	powershell.exe
2392	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3468	window.exe
Token: SeDebugPrivilege	3236	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	3336	winlogon.exe
Token: SeDebugPrivilege	4924	winlogon.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1488	OpenWith.exe
1912	OpenWith.exe
3892	OpenWith.exe
3452	OpenWith.exe
4192	OpenWith.exe
1892	OpenWith.exe
1668	OpenWith.exe
1404	OpenWith.exe
3028	OpenWith.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2052	2856	SECURE BYTE GUI.exe	95
PID 2856 wrote to memory of 3468	2856	SECURE BYTE GUI.exe	103
PID 3468 wrote to memory of 3236	3468	window.exe	104
PID 3468 wrote to memory of 2392	3468	window.exe	107
PID 3468 wrote to memory of 4208	3468	window.exe	113
PID 4208 wrote to memory of 2820	4208	cmd.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SECURE BYTE GUI.exe
"C:\Users\Admin\AppData\Local\Temp\SECURE BYTE GUI.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2856
- C:\ProgramData\SECURE BYTE GUI.exe
  "C:\ProgramData\SECURE BYTE GUI.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2052
- C:\ProgramData\window.exe
  "C:\ProgramData\window.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\winlogon.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'winlogon.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA090.tmp.bat""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1488

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1912

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3892

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3452

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4192

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1892

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1668

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1404

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3028

C:\Users\Admin\AppData\Roaming\winlogon.exe
C:\Users\Admin\AppData\Roaming\winlogon.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3336

C:\Users\Admin\AppData\Roaming\winlogon.exe
C:\Users\Admin\AppData\Roaming\winlogon.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Guna.UI2.dll

Path C:\ProgramData\Guna.UI2.dll
Size 3.8MB
SHA256 040b166676f61ceca68a3282b2dc77de9b90b5351e77808fd52b03f9870586fc
MD5 faece6fabb59a0f659a1f79f2b73d663
SHA1 e73e7d99547fdbf61ecf4b282902bbbde7da588a
SHA512 36ad18f495491e2d5b902acf9e16f672f607c701244e8f7b5431e20e86169b9c65c2a388f4167f13bc04a88af80084ca9a2d1ad2593627a6b074b886436eab2e
SSDEEP 24576:91ZtInJ42jeNjFRUMusmC5bI/Bw+xFdkHZQhHNh0kBU+AvsTmE+LHQ/jz4Au3K:9wMNjFOgmUI/Bw+xFdC1kBUgr+PA
TLSH
T1C9065A023B919817D16EFF77A463101C87F1F951EAABF74E3685F2AC1A9B35058423A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SECURE BYTE GUI.exe

Path C:\ProgramData\SECURE BYTE GUI.exe
Size 2.3MB
SHA256 68ddb91f213689bf335a3f7140ac8d3992c6cb1b9e6821bfa9a251a365c32468
MD5 0ef95374a9d2a9585f2480ee0f997126
SHA1 ef4bba9de74f562390d601eb3482fa4610cbf708
SHA512 d599789d1019b0163e1022b81e17329b7cbd2518efe711d16ea70ccab0d9a5d75c6b59ea3b93c576aa8ac6058edf52abb3bb0f4a821b6eb31d2fd7fd01bfb8b4
SSDEEP 12288:LJRPtG12TodQXQHnoK+TN0IJIoI7vFR2rubhkfJIT+I:HPtVodQmsQYfG
TLSH
T142B51865EB54B40DECB927F48521970A87FBEC068A4ECB4BFE5534FA4F567818E10283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SECURE BYTE GUI.exe.config

Path C:\ProgramData\SECURE BYTE GUI.exe.config
Size 532B
SHA256 9c57e0aa56a2e086a674c39080765b349c7ffbccd8ec77c4e30c8cc8e3588260
MD5 9fca48d74c2f1f8ae46c270c7a9fb5dc
SHA1 91b4d72dba8e0e1ee533c56b6962b5a9acdc02cc
SHA512 5d09fec5ad0e64b1e95ba61c666eea4ab05f062fef2922ffb48764a71d584f7aa19a9ccec9b1f4901315f18930022545270cd214fd4330e74396d4ea3ce931e8
TLSH
T123F02E1094C4BE96DF334EA37A539468DFB943B7344C014DB06E6A974F35A594107277
MD5 SHA1 SHA512 TLSH

Submit Download

window.exe

Path C:\ProgramData\window.exe
Size 223KB
SHA256 feb1ca4bc92051b3b536fc0d3821db56874d73658d01e552212ce1e3ae5a6e4b
MD5 57e5ca802207296595be786b41542bd9
SHA1 339484154e94141759fb8af92e99780ebca491b6
SHA512 6dbae206946176b7cb4d9ca132afc0fb46e8665eaa754bccc395019290a574cc515c42c544910d802c07c443bd95f658484af8c732cf0f8576220dda14ab5b46
SSDEEP 3072:Xr2VF0kz0lZ4x4ilDjn2szgjm4EHBAnpK37nXS8J0uAQ7KvPsd74tyJhIGKl13vG:b0ulCxZPn2BjmA83IvPYA1TQre2
TLSH
T1FC244A4127E4CA2AEABE57B5F4B112106775F10B9121EBCA7C8C19F95B2334099633BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

winlogon.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log
Size 1KB
SHA256 471356f5b299eaaaf1856e0f3d93a94c68321a326f5210a952e93ddb3848647c
MD5 fe1d7aaec1f8e21554b2dea87bb42a6e
SHA1 950dd9254713ada2269bd96aaf12a08c4828f0bc
SHA512 7ada22e7d6902659e998ef5e3987ace84f79533dc42696a20aa7a75d21b5a1fcc70076ec85b0951ac72880947083ce4854eeae64ea0b614fbdac369dfe52e01d
TLSH
T17C21CD312276E1D88D163F412C1D2A8013BF0766B650EE1C7994639EDD3611B5F212F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2ae6e3f473d1bb5d3fb350e7f4361420068d8fc4ca9bb770d8d97c946217e553
MD5 0d95621f05cfdf1332d6f39c2f62c8fd
SHA1 b7b0762a256c6763314a7453c754a0225e39aae0
SHA512 81c5e7f8b96d46ca7db6385e68ed95af85d4751d79b67b88f63bb516d3529f116cac0bf18841bc89da8c6e2fced76ef1cc892bc806461fa2eb8f4303647dabae
TLSH
T1E2112223F38C8920CC96163A509DAC5172B686CB81AEDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zy0qq2bf.4xp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zy0qq2bf.4xp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpA090.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpA090.tmp.bat
Size 139B
SHA256 961b7a2920c8df8bb4deb7a1b599a0f2ee198ee25faf2c3d582adea18294265c
MD5 1989c5303ab16adacf8815ae0350325b
SHA1 c10dc6cebbfd886200c53d94dea376a181381dc6
SHA512 8314707adf5f3be4b26a9bd530b0020b9c32997215f85f9295efde9b2d8c0f4b8888a2968ba69093e4f8898f308c1658514940e36bd9584d64bf81e3b24f764b
TLSH
T17FC02B0014C7B38125062801036AC0DAD313DC0F29805B20E38C0308B84046DF47C344
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2052-37-0x0000000005450000-0x000000000545A000-memory.dmp

Download

memory/2052-41-0x0000000006230000-0x0000000006606000-memory.dmp

Download

memory/2052-33-0x00000000058A0000-0x0000000005E44000-memory.dmp

Download

memory/2052-34-0x0000000005390000-0x0000000005422000-memory.dmp

Download

memory/2052-32-0x0000000005280000-0x0000000005292000-memory.dmp

Download

memory/2052-31-0x0000000000770000-0x00000000009C2000-memory.dmp

Download

memory/2856-0-0x0000000000810000-0x00000000011BE000-memory.dmp

Download

memory/3236-59-0x000001E0E6250000-0x000001E0E6272000-memory.dmp

Download

memory/3468-58-0x0000000000C60000-0x0000000000C9E000-memory.dmp

Download

memory/4924-90-0x0000000001660000-0x000000000166E000-memory.dmp

Download