xworm | 789db0dc883f1cc1ac9dca3fd1f43b32aeb062ce99bd92e0135e3d694585743a

Analysis

max time kernel
298s
max time network
295s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 16:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NR-089087-0870-MQ0870-PO-09870=11-26.js
Size 147KB
Sample261107-t797qads91
SHA256 789db0dc883f1cc1ac9dca3fd1f43b32aeb062ce99bd92e0135e3d694585743a
MD5 fe7bdef4e6e09fd6f852d76464674d16
SHA1 675c53089015a64a31cfee4894c77536c9aaefd6
SHA512 fe0b823d165dc27a04d78b9bd431aa610103300f3e2c5e9c6b873f1943e0a4626fb5272ec756ef324f3535582d5277ac3da8cfa6a801b103114685404d67d4cf
SSDEEP 3072:55WjqHXwTi+BhCH8W16V+u7WmYTTG49JevYaCRE0STidkxA:55ITThCH8WYV+uixTGAegaCRE0KK
TLSH
T1ECE3027A6DB1EC6B437DE72500AE4E1F77A52A016C42C85DB07ED1C6037AF70296BC88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

104.128.191.55:8823
Xp+7PZawn36nYC+9+Nh3yg==:10

Mutex

N8KT3yWNKpwyLLNK

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3204-35-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3592	4680	powershell.exe	89

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3592 set thread context of 3204	3592	powershell.exe	96

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3592	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3592	powershell.exe
3592	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	3204	CasPol.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 2712	3592	powershell.exe	92
PID 2712 wrote to memory of 4584	2712	csc.exe	93
PID 3592 wrote to memory of 3204	3592	powershell.exe	96
PID 3592 wrote to memory of 3204	3592	powershell.exe	96
PID 3592 wrote to memory of 3204	3592	powershell.exe	96
PID 3592 wrote to memory of 3204	3592	powershell.exe	96
PID 3592 wrote to memory of 3204	3592	powershell.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\NR-089087-0870-MQ0870-PO-09870=11-26.js
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:3108

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\mnqlkredjh\w15814.ps1"
1⤵
- Process spawned unexpected child process
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iafrxp3a\iafrxp3a.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3510.tmp" "c:\Users\Admin\AppData\Local\Temp\iafrxp3a\CSC66C7A1AE1C5448A18F16423913791F25.TMP"
    3⤵
    PID:4584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3204

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3510.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3510.tmp
Size 1KB
SHA256 026d98cfbee9ce27b20d9157acee9dbcdd2126e8efdee7732f9c528b5c77a8cb
MD5 17da7af28361c70352a4c4b7e700ed68
SHA1 6649a6298876a8bb330c109af25ba480360501d2
SHA512 8a0b5f0ef2548c6ea57959791dfdc42396208464f873053fd910fe6c906a1148cc802d33752edb66efeffbea9f3e7c776f07bb477370b3a4fe441575636c3bf8
TLSH
T17221AF0557F9475BF073473168F6032BA334FD64EF62535A884042281C22144DEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

iafrxp3a.dll

Path C:\Users\Admin\AppData\Local\Temp\iafrxp3a\iafrxp3a.dll
Size 3KB
SHA256 0dfe97abd68e88f2045d7a2424b97cf7312ba243cf7c0f730d92839e6553125e
MD5 0efdb7c7d3d3189c92d8507990729ed0
SHA1 b975f835d1ada6c89c538364d444e509f4386fa6
SHA512 f9372d39bdfa7086f2a24a06419aa653552f6261479a8054c9733c78ea70ed6644cc06e6fec0aa584b3f30759a0d6fc6c9868d6b2fcfec375ae471174cacbc3a
TLSH
T11E51DB0AA7E88A7BE47707346EF3032673B8F8509B73531E49904229ACA52149E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

w15814.ps1

Path C:\Users\Admin\AppData\Local\Temp\mnqlkredjh\w15814.ps1
Size 207KB
SHA256 14a516e6883513d3dada4cb188315f5a0d2e3fa38eeb224221916b237260e5dd
MD5 f7258dbc6c270457bbaa114ed94f8294
SHA1 20bd35e60dee9831654efb577110e188739e936b
SHA512 bdadcb3e002951fb5a369c6cb0febed776e0e95f33405f164df127fe4c313364207a30e1972dd094ef2f1986863f1cb39a16e5e5ab08476a3be1f00d6a232abc
SSDEEP 3072:7Qk4ndtiy5Z+mjTBA5+G3J1jIHdQPG/8YKxrHWtFS4zMfO01psJsHRNBE5u/7w8F:7o+sBlwbjIQPG/8Y4WtFS3P
TLSH
T1442402246EEA0019B173EF159AE875A6D95FBA63373E9C0D1099034A07B7940ECD1F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC66C7A1AE1C5448A18F16423913791F25.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\iafrxp3a\CSC66C7A1AE1C5448A18F16423913791F25.TMP
Size 652B
SHA256 a67c3fb93817753e111049e36053b05817e5f0fdcd94d82148f21ba0f502ea57
MD5 b98874d481e7a9a3759048723c604906
SHA1 321bb9af95af5386bc7e0cf836d1c67673f9bff1
SHA512 f4e9fa04f635198fde784408a9e95365e85d6e5ffeaa17bb2f80f48e9945b4191db598bb75cd25ca490688f6d6b2846e4b09ef5efd2a1817f1b942b809dc9517
TLSH
T185F05E0973F8520EF0F34B30BDF6436391A8BC65DE3293ED1440431968645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

iafrxp3a.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\iafrxp3a\iafrxp3a.0.cs
Size 421B
SHA256 6b2c52f180056c93aabd5999b142ba5ae8f3c713b973b9e77be6b8fa1df70a74
MD5 91a07b11b8cef64c37389ba57d3b3b53
SHA1 083bc769715520e6c553a36b69d445240ba35ed8
SHA512 0a1c2660fd402b15ca5fa49dcb92c9407cb2cacceaf07ef34b4d0411dfbf33ec5fde9cd301739c477e25b4336b918fcb535317d7e56da341fc9f6d02ce590eda
TLSH
T151E09B25769297B1083245269D42D0EDF6170022267B2A10F6B517336F6B205E73C91D
MD5 SHA1 SHA512 TLSH

Submit Download

iafrxp3a.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\iafrxp3a\iafrxp3a.cmdline
Size 369B
SHA256 5b432c8fc7709c7ae7e3849dd431428aeb64b24f5ccb3d4f5508d9948f39ba90
MD5 038173078e1723199e778b85f9b772aa
SHA1 656604a00b74d0ee305fdde3e9c88b72037b50be
SHA512 00d0c4558cc1997d1a867c892f9a8090cc4e68dc8da96bc7a7ddcd3b35a8b2f2af602be5ed7c867460381b3be18f9e6aee94ef2e9dd9c1ca396461854495d98e
TLSH
T116E0C62EC246C7FD01EF200B22EAC4ECEB720B8329C43F84A858840DE027000ABD27A1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3204-36-0x0000000005A00000-0x0000000005A9C000-memory.dmp

Download

memory/3204-35-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3592-8-0x0000000005450000-0x00000000054B6000-memory.dmp

Download

memory/3592-5-0x00000000749C0000-0x000000007517C000-memory.dmp

Download

memory/3592-13-0x0000000005BE0000-0x0000000005C2C000-memory.dmp

Download

memory/3592-11-0x0000000005670000-0x00000000059CB000-memory.dmp

Download

memory/3592-15-0x0000000007200000-0x000000000787C000-memory.dmp

Download

memory/3592-16-0x0000000006170000-0x000000000618A000-memory.dmp

Download

memory/3592-1-0x00000000749D2000-0x00000000749D3000-memory.dmp

Download

memory/3592-7-0x00000000053E0000-0x0000000005446000-memory.dmp

Download

memory/3592-6-0x0000000004CE0000-0x0000000004D02000-memory.dmp

Download

memory/3592-12-0x0000000005BB0000-0x0000000005BCE000-memory.dmp

Download

memory/3592-4-0x00000000749C0000-0x000000007517C000-memory.dmp

Download

memory/3592-29-0x00000000061B0000-0x00000000061B8000-memory.dmp

Download

memory/3592-30-0x00000000749C0000-0x000000007517C000-memory.dmp

Download

memory/3592-31-0x0000000006F80000-0x0000000006F9A000-memory.dmp

Download

memory/3592-32-0x00000000749D2000-0x00000000749D3000-memory.dmp

Download

memory/3592-33-0x00000000749C0000-0x000000007517C000-memory.dmp

Download

memory/3592-34-0x0000000007000000-0x0000000007008000-memory.dmp

Download

memory/3592-3-0x0000000004D90000-0x00000000053DA000-memory.dmp

Download

memory/3592-2-0x00000000046C0000-0x00000000046F6000-memory.dmp

Download

memory/3592-38-0x00000000749C0000-0x000000007517C000-memory.dmp

Download