xworm | 37ad2b40a05294d9c1a6a335758e18050feee5efa06a129c250298861fb55f42

Analysis

max time kernel
898s
max time network
490s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/10/2026, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
W.e.e.DClient.exe
Size 30KB
Sample261026-tzjpssbe27
SHA256 37ad2b40a05294d9c1a6a335758e18050feee5efa06a129c250298861fb55f42
MD5 870844f2b5d2afc6ca551c7fe8d1497e
SHA1 05acd87c4a60a1a0e3d256362d69ccb9dffde3ad
SHA512 4a4ef2f6c87dc0787da999dfbfb578d427da9cdbc6d73817c0ee34ccd909b42919edbc8c86f6c70cdddfd580cfed34c69849949b6f3992e580d2ea5c4b3f5292
SSDEEP 384:VuYN2Q1Cefba10FW+WvbG+LZzEI/0hYACSqRFYjI2uRugtFuBLTIOZw/WVnvn9Iz:m6a1lhb77/MYAoRFT2uBFE9RcOqh8bA
TLSH
T167E23C483BE8432BD6FF2FF228B6910102759507D923DF9E5CD895AB6F67B8146003E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm rat trojan

Malware Config

Extracted

Family

xworm

28.tcp.cpolar.top:11573

Mutex

T88ZqtYgi37bGCO8

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral3/memory/3208-0-0x0000000000DD0000-0x0000000000DDE000-memory.dmp	family_xworm

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	W.e.e.DClient.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4624	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	W.e.e.DClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	W.e.e.DClient.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2304	timeout.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3208	W.e.e.DClient.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 4624	3208	W.e.e.DClient.exe	84
PID 4624 wrote to memory of 2304	4624	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\W.e.e.DClient.exe
"C:\Users\Admin\AppData\Local\Temp\W.e.e.DClient.exe"
1⤵
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3527.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp3527.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp3527.tmp.bat
Size 165B
SHA256 1d28a66b6b21464ec429cdbc8f53fc1320817212f2e6db4cd9b8e2f0d8ed7b4d
MD5 1a71ca424f72c1862d0d3d512e13d241
SHA1 6e8fe55fc2872321a7844f50d4e6fb2c092cc820
SHA512 213875819e921efaa814ba4eb0cf6bb0bfd5d42d98cab05af76428d38926d38e4cba50f904b7fc7ee860e46c9c13b840250c8a6f8cec1c65aa0839b78b68f92f
TLSH
T1EFC08C40A5CAFA6A190AB42702B6C08ED0BA6C5A2E426B50A79880086982C9CE5F8385
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3208-0-0x0000000000DD0000-0x0000000000DDE000-memory.dmp

Download

memory/3208-1-0x000000001D0C0000-0x000000001D0D0000-memory.dmp

Download

memory/3208-2-0x000000001D0C0000-0x000000001D0D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads