xworm | 4830cb917c5dc4bfb53c0461724174dab58b936398670ca6f611f8ae3ca6797d

Analysis

max time kernel
898s
max time network
342s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
svchost.exe
Size 41KB
Sample261030-warefsez6l
SHA256 4830cb917c5dc4bfb53c0461724174dab58b936398670ca6f611f8ae3ca6797d
MD5 1bb298870173ca6bca8fec40386667ad
SHA1 9d1977dd1c50a36a265b27f3eb4d4121c5469123
SHA512 268102107b1affb8b72eea3258013bda594c830fe700449057309d458e171732d1bce7d7c594fc8e01b7ce64b827d9992d3828120f1be0a63697843495e7d36e
SSDEEP 384:+VnrRhcufDq8veHxjip5zNOBK6lvSrM0xQQcGYot5LaVmBXbCPZsFZwvQ9VQhtxF:itrqKeZizc4ISI0Rp0ZtsQhLOwpBA2
TLSH
T14F13F88927D80106C6FDBBF22DB7960202B1DAA31D57E7DE0CC545DB2B57BA18B409E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

27.tcp.cpolar.top:12346

Mutex

zpyRMgDAbEjNN8Jf

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1844-0-0x0000000000D50000-0x0000000000D60000-memory.dmp	family_xworm
behavioral2/files/0x000500000001b85a-5.dat	family_xworm

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	svchost.exe

Executes a file named after a Windows system binary 1 TTPs 5 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2776	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3856	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3116	timeout.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	svchost.exe
Token: SeDebugPrivilege	2776	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 5704	1844	svchost.exe	94
PID 1844 wrote to memory of 3856	1844	svchost.exe	96
PID 3856 wrote to memory of 3116	3856	cmd.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
1⤵
- Creates a file in the Startup directory
- Executes a file named after a Windows system binary
- Adds Run key to start application
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "svchost"
  2⤵
  PID:5704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3A4B.tmp.bat""
  2⤵
  - Executes a file named after a Windows system binary
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:3116

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:248

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp3A4B.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp3A4B.tmp.bat
Size 159B
SHA256 86e6cf49dc405b0bc6beeda155664d4fc2c9a27a3bb10571b6c7624a2eeaea7c
MD5 7d791a1461cfac96771f4c0a9d4d35c2
SHA1 96ac36d5c5f96cc0dff641241125838b03186c7b
SHA512 daa4ec3b9da5387f59c2214b24ff0e56dccdb3df4297df0cc196e0e150de4e750131ae041c13cbb37f11bcac10b2cfa29050cc23ba7cee6379a337386122df95
TLSH
T1BCC08C0024CAFA5A1A0A643702BAC08EC1629C1A2E406FA0939D8018388285CE4F9305
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 41KB
SHA256 4830cb917c5dc4bfb53c0461724174dab58b936398670ca6f611f8ae3ca6797d
MD5 1bb298870173ca6bca8fec40386667ad
SHA1 9d1977dd1c50a36a265b27f3eb4d4121c5469123
SHA512 268102107b1affb8b72eea3258013bda594c830fe700449057309d458e171732d1bce7d7c594fc8e01b7ce64b827d9992d3828120f1be0a63697843495e7d36e
SSDEEP 384:+VnrRhcufDq8veHxjip5zNOBK6lvSrM0xQQcGYot5LaVmBXbCPZsFZwvQ9VQhtxF:itrqKeZizc4ISI0Rp0ZtsQhLOwpBA2
TLSH
T14F13F88927D80106C6FDBBF22DB7960202B1DAA31D57E7DE0CC545DB2B57BA18B409E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1844-0-0x0000000000D50000-0x0000000000D60000-memory.dmp

Download

memory/1844-1-0x00007FFB23A5F000-0x00007FFB23A60000-memory.dmp

Download

memory/1844-2-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp

Download

memory/1844-3-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp

Download

memory/1844-4-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp

Download

memory/1844-8-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp

Download

memory/1844-9-0x000000001CF30000-0x000000001CF3A000-memory.dmp

Download

memory/1844-12-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp

Download

memory/2776-6-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp

Download

memory/2776-7-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads