xworm | 17fb280cc5ad5829eed30b6ef0438b08b42768bf1a44330bf75bc307c2fb1073

Analysis

max time kernel
298s
max time network
297s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Specification_Order_details-Oct-19th_Pdf.exe
Size 610KB
Sample261020-qdc4cabf92
SHA256 17fb280cc5ad5829eed30b6ef0438b08b42768bf1a44330bf75bc307c2fb1073
MD5 316a598b0d0f500bc69b39d3656b18ee
SHA1 ec4e9d91c8b664d2224da41f33f43c19f5d4c0ed
SHA512 dc1006f92805f90a01899105a898cecdfa7dedc0ed32a27c5286fbc2f4a7260841af3bc0dfb14b2159da4a08242e9e801cd88bc958d2826f21c7768479203dfd
SSDEEP 12288:CR4+5uaVNhwFv/4P+VcThtgSMBGjo0bvdVZvaYvw+Zs:OVYFIPkc3U0bvHMYI
TLSH
T180D4CE102265E711D5F277B5C9B1F2F453B8AEC9F821D20B4EE67DDBF831B005A0A692
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution xworm persistence privilege_escalation rat spyware stealer trojan

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2576-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5236	powershell.exe
5768	powershell.exe
4388	powershell.exe
2828	powershell.exe
3400	powershell.exe
6072	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	Specification_Order_details-Oct-19th_Pdf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	Specification_Order_details-Oct-19th_Pdf.exe

Executes dropped EXE 13 IoCs

pid	Process
1764	XWormClient.exe
4752	bnigfu.bat
5908	XWormClient.exe
3032	bnigfu.bat
1500	XWormClient.exe
252	XWormClient.exe
696	XWormClient.exe
1432	XWormClient.exe
3972	XWormClient.exe
4636	XWormClient.exe
3268	XWormClient.exe
4720	XWormClient.exe
1268	XWormClient.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Specification_Order_details-Oct-19th_Pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Specification_Order_details-Oct-19th_Pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Specification_Order_details-Oct-19th_Pdf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\XWormClient = "C:\\Users\\Admin\\AppData\\Roaming\\XWormClient.exe"	Specification_Order_details-Oct-19th_Pdf.exe

SmartAssembly .NET packer 4 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/4884-7-0x0000000005AD0000-0x0000000005AE6000-memory.dmp	SmartAssembly
behavioral2/memory/1764-50-0x00000000057E0000-0x00000000057F6000-memory.dmp	SmartAssembly
behavioral2/memory/4752-72-0x000002173C270000-0x000002173C286000-memory.dmp	SmartAssembly
behavioral2/memory/3268-155-0x00000000053C0000-0x00000000053D6000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4884 set thread context of 2576	4884	Specification_Order_details-Oct-19th_Pdf.exe	93
PID 1764 set thread context of 5908	1764	XWormClient.exe	116
PID 4752 set thread context of 3032	4752	bnigfu.bat	120
PID 1500 set thread context of 252	1500	XWormClient.exe	124
PID 696 set thread context of 4636	696	XWormClient.exe	130
PID 3268 set thread context of 4720	3268	XWormClient.exe	134

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	Specification_Order_details-Oct-19th_Pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Specification_Order_details-Oct-19th_Pdf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Specification_Order_details-Oct-19th_Pdf.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Specification_Order_details-Oct-19th_Pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Specification_Order_details-Oct-19th_Pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
4884	Specification_Order_details-Oct-19th_Pdf.exe
4884	Specification_Order_details-Oct-19th_Pdf.exe
4884	Specification_Order_details-Oct-19th_Pdf.exe
4884	Specification_Order_details-Oct-19th_Pdf.exe
4388	powershell.exe
4388	powershell.exe
2576	Specification_Order_details-Oct-19th_Pdf.exe
2576	Specification_Order_details-Oct-19th_Pdf.exe
2576	Specification_Order_details-Oct-19th_Pdf.exe
2576	Specification_Order_details-Oct-19th_Pdf.exe
2576	Specification_Order_details-Oct-19th_Pdf.exe
2576	Specification_Order_details-Oct-19th_Pdf.exe
1764	XWormClient.exe
1764	XWormClient.exe
1764	XWormClient.exe
2828	powershell.exe
2828	powershell.exe
2828	powershell.exe
4752	bnigfu.bat
4752	bnigfu.bat
3400	powershell.exe
3400	powershell.exe
3400	powershell.exe
1500	XWormClient.exe
1500	XWormClient.exe
6072	powershell.exe
6072	powershell.exe
696	XWormClient.exe
696	XWormClient.exe
696	XWormClient.exe
696	XWormClient.exe
696	XWormClient.exe
696	XWormClient.exe
5236	powershell.exe
5236	powershell.exe
3268	XWormClient.exe
3268	XWormClient.exe
5768	powershell.exe
5768	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	Specification_Order_details-Oct-19th_Pdf.exe
Token: SeDebugPrivilege	2576	Specification_Order_details-Oct-19th_Pdf.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeIncreaseQuotaPrivilege	4388	powershell.exe
Token: SeSecurityPrivilege	4388	powershell.exe
Token: SeTakeOwnershipPrivilege	4388	powershell.exe
Token: SeLoadDriverPrivilege	4388	powershell.exe
Token: SeSystemProfilePrivilege	4388	powershell.exe
Token: SeSystemtimePrivilege	4388	powershell.exe
Token: SeProfSingleProcessPrivilege	4388	powershell.exe
Token: SeIncBasePriorityPrivilege	4388	powershell.exe
Token: SeCreatePagefilePrivilege	4388	powershell.exe
Token: SeBackupPrivilege	4388	powershell.exe
Token: SeRestorePrivilege	4388	powershell.exe
Token: SeShutdownPrivilege	4388	powershell.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeSystemEnvironmentPrivilege	4388	powershell.exe
Token: SeRemoteShutdownPrivilege	4388	powershell.exe
Token: SeUndockPrivilege	4388	powershell.exe
Token: SeManageVolumePrivilege	4388	powershell.exe
Token: 33	4388	powershell.exe
Token: 34	4388	powershell.exe
Token: 35	4388	powershell.exe
Token: 36	4388	powershell.exe
Token: SeDebugPrivilege	1764	XWormClient.exe
Token: SeDebugPrivilege	5908	XWormClient.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeIncreaseQuotaPrivilege	2828	powershell.exe
Token: SeSecurityPrivilege	2828	powershell.exe
Token: SeTakeOwnershipPrivilege	2828	powershell.exe
Token: SeLoadDriverPrivilege	2828	powershell.exe
Token: SeSystemProfilePrivilege	2828	powershell.exe
Token: SeSystemtimePrivilege	2828	powershell.exe
Token: SeProfSingleProcessPrivilege	2828	powershell.exe
Token: SeIncBasePriorityPrivilege	2828	powershell.exe
Token: SeCreatePagefilePrivilege	2828	powershell.exe
Token: SeBackupPrivilege	2828	powershell.exe
Token: SeRestorePrivilege	2828	powershell.exe
Token: SeShutdownPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeSystemEnvironmentPrivilege	2828	powershell.exe
Token: SeRemoteShutdownPrivilege	2828	powershell.exe
Token: SeUndockPrivilege	2828	powershell.exe
Token: SeManageVolumePrivilege	2828	powershell.exe
Token: 33	2828	powershell.exe
Token: 34	2828	powershell.exe
Token: 35	2828	powershell.exe
Token: 36	2828	powershell.exe
Token: SeDebugPrivilege	4752	bnigfu.bat
Token: SeDebugPrivilege	3400	powershell.exe
Token: SeIncreaseQuotaPrivilege	3400	powershell.exe
Token: SeSecurityPrivilege	3400	powershell.exe
Token: SeTakeOwnershipPrivilege	3400	powershell.exe
Token: SeLoadDriverPrivilege	3400	powershell.exe
Token: SeSystemProfilePrivilege	3400	powershell.exe
Token: SeSystemtimePrivilege	3400	powershell.exe
Token: SeProfSingleProcessPrivilege	3400	powershell.exe
Token: SeIncBasePriorityPrivilege	3400	powershell.exe
Token: SeCreatePagefilePrivilege	3400	powershell.exe
Token: SeBackupPrivilege	3400	powershell.exe
Token: SeRestorePrivilege	3400	powershell.exe
Token: SeShutdownPrivilege	3400	powershell.exe
Token: SeDebugPrivilege	3400	powershell.exe
Token: SeSystemEnvironmentPrivilege	3400	powershell.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4388	4884	Specification_Order_details-Oct-19th_Pdf.exe	90
PID 4884 wrote to memory of 4964	4884	Specification_Order_details-Oct-19th_Pdf.exe	92
PID 4884 wrote to memory of 2576	4884	Specification_Order_details-Oct-19th_Pdf.exe	93
PID 4884 wrote to memory of 2576	4884	Specification_Order_details-Oct-19th_Pdf.exe	93
PID 4884 wrote to memory of 2576	4884	Specification_Order_details-Oct-19th_Pdf.exe	93
PID 4884 wrote to memory of 2576	4884	Specification_Order_details-Oct-19th_Pdf.exe	93
PID 4884 wrote to memory of 2576	4884	Specification_Order_details-Oct-19th_Pdf.exe	93
PID 2576 wrote to memory of 5880	2576	Specification_Order_details-Oct-19th_Pdf.exe	95
PID 2576 wrote to memory of 1600	2576	Specification_Order_details-Oct-19th_Pdf.exe	101
PID 2576 wrote to memory of 4752	2576	Specification_Order_details-Oct-19th_Pdf.exe	103
PID 1600 wrote to memory of 4772	1600	csc.exe	104
PID 2576 wrote to memory of 5632	2576	Specification_Order_details-Oct-19th_Pdf.exe	106
PID 2576 wrote to memory of 4408	2576	Specification_Order_details-Oct-19th_Pdf.exe	108
PID 5632 wrote to memory of 2804	5632	csc.exe	110
PID 2576 wrote to memory of 6116	2576	Specification_Order_details-Oct-19th_Pdf.exe	111
PID 4408 wrote to memory of 3028	4408	csc.exe	113
PID 6116 wrote to memory of 4540	6116	csc.exe	114
PID 1764 wrote to memory of 2828	1764	XWormClient.exe	115
PID 1764 wrote to memory of 5908	1764	XWormClient.exe	116
PID 1764 wrote to memory of 5908	1764	XWormClient.exe	116
PID 1764 wrote to memory of 5908	1764	XWormClient.exe	116
PID 1764 wrote to memory of 5908	1764	XWormClient.exe	116
PID 1764 wrote to memory of 5908	1764	XWormClient.exe	116
PID 4752 wrote to memory of 3400	4752	bnigfu.bat	118
PID 4752 wrote to memory of 3032	4752	bnigfu.bat	120
PID 4752 wrote to memory of 3032	4752	bnigfu.bat	120
PID 4752 wrote to memory of 3032	4752	bnigfu.bat	120
PID 1500 wrote to memory of 6072	1500	XWormClient.exe	122
PID 1500 wrote to memory of 252	1500	XWormClient.exe	124
PID 1500 wrote to memory of 252	1500	XWormClient.exe	124
PID 1500 wrote to memory of 252	1500	XWormClient.exe	124
PID 1500 wrote to memory of 252	1500	XWormClient.exe	124
PID 1500 wrote to memory of 252	1500	XWormClient.exe	124
PID 696 wrote to memory of 5236	696	XWormClient.exe	126
PID 696 wrote to memory of 1432	696	XWormClient.exe	127
PID 696 wrote to memory of 3972	696	XWormClient.exe	129
PID 696 wrote to memory of 4636	696	XWormClient.exe	130
PID 696 wrote to memory of 4636	696	XWormClient.exe	130
PID 696 wrote to memory of 4636	696	XWormClient.exe	130
PID 696 wrote to memory of 4636	696	XWormClient.exe	130
PID 696 wrote to memory of 4636	696	XWormClient.exe	130
PID 3268 wrote to memory of 5768	3268	XWormClient.exe	132
PID 3268 wrote to memory of 4720	3268	XWormClient.exe	134
PID 3268 wrote to memory of 4720	3268	XWormClient.exe	134
PID 3268 wrote to memory of 4720	3268	XWormClient.exe	134
PID 3268 wrote to memory of 4720	3268	XWormClient.exe	134
PID 3268 wrote to memory of 4720	3268	XWormClient.exe	134

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Specification_Order_details-Oct-19th_Pdf.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Specification_Order_details-Oct-19th_Pdf.exe

C:\Users\Admin\AppData\Local\Temp\Specification_Order_details-Oct-19th_Pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Specification_Order_details-Oct-19th_Pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Specification_Order_details-Oct-19th_Pdf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4388
- C:\Users\Admin\AppData\Local\Temp\Specification_Order_details-Oct-19th_Pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Specification_Order_details-Oct-19th_Pdf.exe"
  2⤵
  PID:4964
- C:\Users\Admin\AppData\Local\Temp\Specification_Order_details-Oct-19th_Pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Specification_Order_details-Oct-19th_Pdf.exe"
  2⤵
  - Creates a file in the Startup directory
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2576
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XWormClient" /tr "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5880
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\Specification_Order_details-Oct-19th_Pdf.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_5fd33245f048441a9d07b58a634c67c7.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE238.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF553663271584BA4ACBD2B8C89BD4769.TMP"
      4⤵
      PID:4772
- - C:\Users\Admin\AppData\Local\Temp\bnigfu.bat
    "C:\Users\Admin\AppData\Local\Temp\bnigfu.bat"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\bnigfu.bat"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\bnigfu.bat
      C:\Users\Admin\AppData\Local\Temp\bnigfu.bat
      4⤵
      Executes dropped EXE
      PID:3032
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\Specification_Order_details-Oct-19th_Pdf.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_646b35869dca4d54b8195f34c0fc2352.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5632
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES33E2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE19FDDA633A84A728EC0F739C0E15271.TMP"
      4⤵
      PID:2804
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\Specification_Order_details-Oct-19th_Pdf.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_844614507838436ca029a185b89850ee.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES35B7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD15E82BF6D074598A161B134B9729B.TMP"
      4⤵
      PID:3028
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\Specification_Order_details-Oct-19th_Pdf.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_ccaac8b1a8eb42ef91e9828cb105e831.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6116
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES37DA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC57CBE3FECD52440FB349F34811B4713F.TMP"
      4⤵
      PID:4540

C:\Users\Admin\AppData\Roaming\XWormClient.exe
C:\Users\Admin\AppData\Roaming\XWormClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2828
- C:\Users\Admin\AppData\Roaming\XWormClient.exe
  "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2608

C:\Users\Admin\AppData\Roaming\XWormClient.exe
"C:\Users\Admin\AppData\Roaming\XWormClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:6072
- C:\Users\Admin\AppData\Roaming\XWormClient.exe
  "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:252

C:\Users\Admin\AppData\Roaming\XWormClient.exe
"C:\Users\Admin\AppData\Roaming\XWormClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5236
- C:\Users\Admin\AppData\Roaming\XWormClient.exe
  "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Users\Admin\AppData\Roaming\XWormClient.exe
  "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Users\Admin\AppData\Roaming\XWormClient.exe
  "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4636

C:\Users\Admin\AppData\Roaming\XWormClient.exe
"C:\Users\Admin\AppData\Roaming\XWormClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5768
- C:\Users\Admin\AppData\Roaming\XWormClient.exe
  "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4720

C:\Users\Admin\AppData\Roaming\XWormClient.exe
"C:\Users\Admin\AppData\Roaming\XWormClient.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Video Capture

T1125

Command and Control

Exfiltration

Impact