xworm | ec05a6ae4778633c74937352b08bfeb10a29afc43efe43d64d4686a37c4b73f1

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
trigger.ps1
Size 41KB
Sample261104-ytr67svsat
SHA256 ec05a6ae4778633c74937352b08bfeb10a29afc43efe43d64d4686a37c4b73f1
MD5 b150202a93af3a0f8f14f3b66c0c41a0
SHA1 57cf0d47dff312c97f75aa702a42d6f3a37239ae
SHA512 b040fd6cc126a34186d310bb835372ec982b1c6239e4b10fd26a78fb2b9d72c70bb59db517d8182450c65193745f249e75a2aeb855e46b78059fd26b295b22f6
SSDEEP 768:/gJcyekUihHTURUDthg6yBmTWJ/jHN0pgUN4gosoEZtU7+o1KvDDFGFb4d59RQi:/m/eXiFTwJoTijHigUN4gbo+VDFGFb4p
TLSH
T17E13BE41D39BFA6CCF98D49153928E17FA30A51C7421CADA6A69B1C6D0CFEB05BBC41C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

109.120.139.126:3009

Mutex

xXaTaJNJAUhii9jF

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2560-23-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5760	PowerShell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5760 set thread context of 2560	5760	PowerShell.exe	90

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5760	PowerShell.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	2560	WerFault.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5760	PowerShell.exe
5760	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5760	PowerShell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5760 wrote to memory of 2560	5760	PowerShell.exe	90
PID 5760 wrote to memory of 2560	5760	PowerShell.exe	90
PID 5760 wrote to memory of 2560	5760	PowerShell.exe	90
PID 5760 wrote to memory of 2560	5760	PowerShell.exe	90
PID 5760 wrote to memory of 2560	5760	PowerShell.exe	90

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\trigger.ps1
1⤵
- Deletes itself
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5760
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:2560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 144
    3⤵
    - Program crash
    PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2560 -ip 2560
1⤵
PID:5196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2560-23-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/5760-12-0x00007FFDF8D90000-0x00007FFDF9734000-memory.dmp

Download

memory/5760-14-0x00007FFDF8D90000-0x00007FFDF9734000-memory.dmp

Download

memory/5760-6-0x0000016BE64B0000-0x0000016BE64C0000-memory.dmp

Download

memory/5760-5-0x0000016BFE940000-0x0000016BFE962000-memory.dmp

Download

memory/5760-8-0x00007FFDF8D90000-0x00007FFDF9734000-memory.dmp

Download

memory/5760-7-0x0000016BFECC0000-0x0000016BFEDC2000-memory.dmp

Download

memory/5760-9-0x00007FFDF8D90000-0x00007FFDF9734000-memory.dmp

Download

memory/5760-10-0x00007FFDF8D90000-0x00007FFDF9734000-memory.dmp

Download

memory/5760-11-0x00007FFDF8D90000-0x00007FFDF9734000-memory.dmp

Download

memory/5760-15-0x00007FFDF8D90000-0x00007FFDF9734000-memory.dmp

Download

memory/5760-4-0x00007FFDF8D90000-0x00007FFDF9734000-memory.dmp

Download

memory/5760-13-0x00007FFDF8D90000-0x00007FFDF9734000-memory.dmp

Download

memory/5760-0-0x00007FFDF8F1F000-0x00007FFDF8F20000-memory.dmp

Download

memory/5760-16-0x00007FFDF8D90000-0x00007FFDF9734000-memory.dmp

Download

memory/5760-17-0x00007FFDF8D90000-0x00007FFDF9734000-memory.dmp

Download

memory/5760-18-0x00007FFDF8D90000-0x00007FFDF9734000-memory.dmp

Download

memory/5760-19-0x00007FFDF8D90000-0x00007FFDF9734000-memory.dmp

Download

memory/5760-20-0x00007FFDF8D90000-0x00007FFDF9734000-memory.dmp

Download

memory/5760-21-0x00007FFDF8D90000-0x00007FFDF9734000-memory.dmp

Download

memory/5760-22-0x0000016BE64C0000-0x0000016BE64CA000-memory.dmp

Download

memory/5760-1-0x0000016BFEB20000-0x0000016BFEBA2000-memory.dmp

Download

memory/5760-25-0x00007FFDF8D90000-0x00007FFDF9734000-memory.dmp

Download