xworm | 6c6055d7518c517f93721727ea96e5841db920f59091fe841a0be1fba5b3eff6

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XWormClient_arx (1).bat
Size 56KB
Sample261110-ejdfhsyxc1
SHA256 6c6055d7518c517f93721727ea96e5841db920f59091fe841a0be1fba5b3eff6
MD5 d53c31222ea769583a9a059d518a2f7c
SHA1 1d2e586ecfa30d3d65ae0901d43e5cf1a9307d98
SHA512 a4d6ce6ed678d175668085e54ffc14d07197fd6abfd9ce22f04a798d9f5525218fcb915fcf3df7f0fa48c47747cf5097fa0a166511c8c35b0aea94bd09b78a48
SSDEEP 1536:DzNYqRlgFUnpl/jsOCFLmXy4FqhVFlzVQE9ZCDnRhz:fNlRlfji6irlzlZEx
TLSH
T13E435BD3BE4F3C448BD9D2431ADE5BD57A8E1786E4422C8DB70B9D1C825746A39CC28B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

danini.localto.net:6379

Mutex

RDLJRBdCthedpA24

Attributes

install_file
Windows-USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1124-29-0x00000000010C0000-0x00000000010CE000-memory.dmp	family_xworm

Executes dropped EXE 1 IoCs

pid	Process
1124	g4hjmkzuh.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1388	powershell.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	g4hjmkzuh.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4660	cmd.exe
3304	cmd.exe
4864	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	g4hjmkzuh.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	g4hjmkzuh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1804	PING.EXE
3304	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1804	PING.EXE

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1388	powershell.exe
1388	powershell.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe
1124	g4hjmkzuh.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	1124	g4hjmkzuh.exe
Token: SeDebugPrivilege	1124	g4hjmkzuh.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4660	4864	cmd.exe	89
PID 4660 wrote to memory of 4340	4660	cmd.exe	91
PID 4660 wrote to memory of 3036	4660	cmd.exe	92
PID 4660 wrote to memory of 1388	4660	cmd.exe	93
PID 4660 wrote to memory of 1964	4660	cmd.exe	94
PID 1964 wrote to memory of 1740	1964	csc.exe	95
PID 4660 wrote to memory of 1124	4660	cmd.exe	96
PID 1124 wrote to memory of 3304	1124	g4hjmkzuh.exe	105
PID 3304 wrote to memory of 1804	3304	cmd.exe	107

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3036	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\XWormClient_arx (1).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\XWormClient_arx (1).bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4340
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5"
    3⤵
    - Views/modifies file attributes
    PID:3036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "[IO.File]::WriteAllText('C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\l.cs',[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String([IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\s.b64'))))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1388
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /target:winexe /platform:x64 /optimize+ /warn:0 /out:"C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\g4hjmkzuh.exe" "C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\l.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6FCC.tmp" "c:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\CSCDB17B6932D9040BEAA6844674AFA2CDB.TMP"
      4⤵
      PID:1740
- - C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\g4hjmkzuh.exe
    "C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\g4hjmkzuh.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates video capture drivers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1124
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c ping -n 2 127.0.0.1 >nul & del /f /q "C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\g4hjmkzuh.exe" & rd /s /q "C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5"
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:3304
    - - C:\Windows\system32\PING.EXE
        
        ping -n 2 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

g4hjmkzuh.exe

Path C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\g4hjmkzuh.exe
Size 17KB
SHA256 855c6a7a6e4de806c4407bbf5fff00972622d09388c62abc06ee085f054880c5
MD5 52e4116257fe5f5d9b659978b9ddb8a0
SHA1 4b222f0f9810948caee84f982d1aa457c6ded7be
SHA512 02869c23eeab34903cbbf69a441273a497f4e0e562323fc0a209ff18ed0674dbe8db7a68ca58dfcb7dead38b78fdaeb23d2153d5aa19b948e247b4209a350831
SSDEEP 192:ZB5iyjqkTJo/kFL6+sRnlLNxRdl35OvWRW1BQfainhl31COib+H9t0x+dJyi:Z/+2fFklLRL5OvnPQyinb31tiS9t0ay
TLSH
T147722A05A3CD9261E5AE8B7C24F313394774E3631A9B6F4B4CE425791FA27F805092E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

p.b64

Path C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\p.b64
Size 22KB
SHA256 00c2bbd7e75d77576d5ba3891d782951b1f203129370bef6a396e6ba37d136a1
MD5 c216ad82af2afbc0fd0fdad1d30cc776
SHA1 04784575ffe45bb00de49c0d99e2132df532199c
SHA512 ba40b7bea7c7b872e15b8fcd2d9008990b24ab2bdd98d7e1fa66ef8a0a5ae2575b9ca09d6931e0faffaeffa9f5b89dc4992f932f0241b1119a901d2cc584f73e
SSDEEP 384:r+oLMQ+3x1xZgJlfzZv5OAFZK1Es2CpBkqvrO4vQIOTQckFQdHbaWnHuBmrjLLO0:r+BN3d6P7Zx7FZkACkqv521NdHbFnHuQ
TLSH
T109A2D081DB99598B0ECC19B5EA9E7126C4FC668DE010EE0EFE994C2A9323489654077F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s.b64

Path C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\s.b64
Size 29KB
SHA256 f18161ec2daba220e725d9e2d90a772da8bf613390b3fa7ec02badfcbb8fcab3
MD5 e40054a0d1fba324dc5eb4db793f442e
SHA1 a724c4b0b9a19b99c8d5b1d27f640afcb5f5729d
SHA512 18f51f4666f11b15d4f570c04fbf7ec02b604e779668350cbbaeecd68f315276edcdeed16f406ee2603bc76cd735b4d94ad49acaf62fb53c5e48c5cafc8646ec
SSDEEP 384:NgZntC812j/6UAwy4+ra4quFyqhVGs+x7lZkOc3des9kG/hsptVruFD4dMA1:Ng3Cc2+UAwy4AcqhVGVlZsSG/hszEDEx
TLSH
T16AD295E7AD0F3C84CBEAD14706CE9BD53A4E0785E953299D430BAD0C865742E3AD858B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES6FCC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6FCC.tmp
Size 1KB
SHA256 935f398171e5ead43fc69a461805e1c27192a11b14d14c02bab3dbdb7da9f4d3
MD5 bf1be2e59977547ab52d34c2f46d06d2
SHA1 76a91f2fe32488427369cd1d8063b63d9125bc7f
SHA512 f092123950c3950da89da78f3031d727f2689a2084585b820a8cb29ab8a2648ea0b3b07a7c1ebcaf0fc77370409a890cbd531c2d36ab004cb2d02757805fd71b
TLSH
T1B441114083DC8B1FF272433169F74B15A378BE569A9A574DF588122E1E12744CD836B1
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ejiexxe5.lck.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ejiexxe5.lck.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

CSCDB17B6932D9040BEAA6844674AFA2CDB.TMP

Path \??\c:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\CSCDB17B6932D9040BEAA6844674AFA2CDB.TMP
Size 1KB
SHA256 525846d98a5cef7afa3df28b5f8d4eb25336c1a5e169757bc2906b41cae03576
MD5 b0694ec1da90941073f1bbd318826474
SHA1 5f2e5c590bf07eb1d5c811f97876317180840be4
SHA512 98555b0499b2d59b5887167a3e3dd5177a9c5e3522da6d0fd60f1a9c2e9af7e6458f5d2e2a850e76bfed1d7789f3af5e3c5245e8a506af2d350b39f97aa803fb
TLSH
T1D721AF85A3E8421EF2B347707AF2C363916CBE678D7A43DC7488175F1F259508583AB1
MD5 SHA1 SHA512 TLSH

Submit Download

l.cs

Path \??\c:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\l.cs
Size 21KB
SHA256 ea50ef18588e1d09add5ef7a2ee919388104b90f85aec9f938a656b95a376315
MD5 cf963b77e1000e8eceec872e8c837c02
SHA1 1dae6c7ce74854d5a508f4af2d58ced92256567d
SHA512 c6232e60d96d2d02127f21d739acc4ac31aac244d956d83808a897ec7b0ed357bd6877aa04a89e13e1676924e222107f1e282bd8346637f83cfc4fb4e67652f5
SSDEEP 384:NwKnJCy3+MatWoQBUkCq6X+ATn+Dc/qnz6:aYXurgXCqRDc/qnz6
TLSH
T16AA292622153E12802A323392B9A5055F372E433D2FBDD1DBD8DC6607F8A6657374BE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1124-27-0x00007FFAF94F0000-0x00007FFAF9509000-memory.dmp

Download

memory/1124-26-0x0000000000810000-0x0000000000818000-memory.dmp

Download

memory/1124-29-0x00000000010C0000-0x00000000010CE000-memory.dmp

Download

memory/1124-30-0x000000001FF40000-0x000000001FF8E000-memory.dmp

Download

memory/1124-31-0x0000000002FE0000-0x0000000002FE6000-memory.dmp

Download

memory/1388-3-0x0000019E1D760000-0x0000019E1D770000-memory.dmp

Download

memory/1388-9-0x0000019E1D830000-0x0000019E1D852000-memory.dmp

Download

memory/1388-2-0x0000019E1D760000-0x0000019E1D770000-memory.dmp

Download