xworm | 96c75d801454759f8afb0e9934d06b196c1c8d555ade2f4b450abf41d4e93b7e

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96c75d801454759f8afb0e9934d06b196c1c8d555ade2f4b450abf41d4e93b7e.exe
Size 724KB
Sample261110-wngr6sct91
SHA256 96c75d801454759f8afb0e9934d06b196c1c8d555ade2f4b450abf41d4e93b7e
MD5 bb735c6716fd2ddb1c03dbff1c215cdb
SHA1 7be121ea4c237687964cf231eb4be1264713fef4
SHA512 c982b00baf6acf747606e7ac0cf8e31850b8be1f9ac0b98520775314db031581e083ea7c140467190f69cb65931d1b329749f180e48c59cff4aaca9c01881521
SSDEEP 6144:gae7jdQz2diwcIXMRxHHbh43He6iU8msBcywGRYQ9RARc/1wKHjlmPZFmgcf+OOV:kmiMZvN43+u85Bpw+YMRkc9dx7tc/R
TLSH
T157F47C19E7A408BED4B3A5B88982CA32E7727C490761D78B07F0DDB37E276905D39742
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V6.5

babyraat-44936.portmap.host:44936

Mutex

0h5Iqlt6vtfEl5tg

Attributes

Install_directory
%AppData%
install_file
XWormClient.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00030000000228e9-5.dat	family_xworm
behavioral1/memory/116-14-0x0000000000860000-0x0000000000870000-memory.dmp	family_xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	96c75d801454759f8afb0e9934d06b196c1c8d555ade2f4b450abf41d4e93b7e.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	5590.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	5590.exe

Executes dropped EXE 1 IoCs

pid	Process
116	5590.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	5590.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	5590.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
116	5590.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	116	5590.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
116	5590.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 116	4864	96c75d801454759f8afb0e9934d06b196c1c8d555ade2f4b450abf41d4e93b7e.exe	93

C:\Users\Admin\AppData\Local\Temp\96c75d801454759f8afb0e9934d06b196c1c8d555ade2f4b450abf41d4e93b7e.exe
"C:\Users\Admin\AppData\Local\Temp\96c75d801454759f8afb0e9934d06b196c1c8d555ade2f4b450abf41d4e93b7e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\5590.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\5590.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5590.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\5590.exe
Size 37KB
SHA256 f9db6a8cf2c17e384cf04c7bd25554911d7e64f485cbf2ff7a9b6797a56b2762
MD5 6e39f136074a4393a36e5468cb5e2d8e
SHA1 d0e87c874491436a3ff7c1d6013298b293d932f1
SHA512 fdecad958d2feb9df3cdadeaa93b4fd47c309ed32f8e59c3be9d1afc98788fa2479ade2d6ef8ba437bb3ce4bd2fcb4b8082cc3d20cf7dcb7c1e661e613a24450
SSDEEP 384:fKKCOt4CwqgHKh2Rxe5pLIwaTrRJDT9jTrA6tQPd+Ngk0RpkFMAfNLTcZwY3DcvH:ZCVef3aTrT1TM6tQPARFQ9YtOMhqby
TLSH
T172036D087BE84225D9FD6FF529B366060370D7079A13DB4D48E586AA5F77EC0CA007E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-14-0x0000000000860000-0x0000000000870000-memory.dmp

Download

memory/116-19-0x000000001B5D0000-0x000000001B5E0000-memory.dmp

Download

memory/116-20-0x000000001B5D0000-0x000000001B5E0000-memory.dmp

Download