File name:

tool.exe

Full analysis: https://app.any.run/tasks/4407487a-aa46-4cc5-bd3a-c8a811e0a1ac
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: June 16, 2025, 20:06:16
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
auto
generic
auto-reg
auto-startup
xworm
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

DB7D499DE4E5A942C6EEA2754D6AAEA2

SHA1:

02845AF3EE75A5114F992136912EDE768802CC88

SHA256:

9AD37C76799485AA9D53EB72EA9786A7AE90A982BCC9482F107E2FBAC9879BD8

SSDEEP:

49152:6UCuppjX/qxCFBm/ws3KQHQcVjXD2ksnfub9N84k1toArshYNzBMOo2Gd2c12lnH:dj7/qxCy/ws6QbjT2ksnfubT84qNrCY7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • tool.exe (PID: 6428)

    • Uses Task Scheduler to run other applications

      • wok.exe (PID: 1560)

    • Changes the autorun value in the registry

      • wok.exe (PID: 1560)

    • Create files in the Startup directory

      • wok.exe (PID: 1560)

    • XWORM has been detected (YARA)

      • wok.exe (PID: 1560)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • tool.exe (PID: 6428)
      • wok.exe (PID: 1560)

    • Executable content was dropped or overwritten

      • tool.exe (PID: 6428)
      • wok.exe (PID: 1560)

    • Reads security settings of Internet Explorer

      • tool.exe (PID: 6428)
      • wok.exe (PID: 1560)

    • Checks for external IP

      • wok.exe (PID: 1560)
      • svchost.exe (PID: 2200)

    • Connects to unusual port

      • wok.exe (PID: 1560)

    • There is functionality for taking screenshot (YARA)

      • Wokk.exe (PID: 5348)

  • INFO

    • Checks supported languages

      • tool.exe (PID: 6428)
      • wok.exe (PID: 1560)
      • Wokk.exe (PID: 5348)
      • Windows Register (PID: 5628)

    • Reads the computer name

      • tool.exe (PID: 6428)
      • wok.exe (PID: 1560)
      • Wokk.exe (PID: 5348)
      • Windows Register (PID: 5628)

    • The sample compiled with english language support

      • tool.exe (PID: 6428)

    • Reads the machine GUID from the registry

      • tool.exe (PID: 6428)
      • wok.exe (PID: 1560)
      • Windows Register (PID: 5628)

    • Process checks computer location settings

      • tool.exe (PID: 6428)
      • wok.exe (PID: 1560)

    • Create files in a temporary directory

      • tool.exe (PID: 6428)
      • wok.exe (PID: 1560)

    • Disables trace logs

      • wok.exe (PID: 1560)

    • Reads Environment values

      • wok.exe (PID: 1560)

    • Checks proxy server information

      • wok.exe (PID: 1560)
      • slui.exe (PID: 5496)

    • Manual execution by a user

      • Windows Register (PID: 5628)

    • Launching a file from a Registry key

      • wok.exe (PID: 1560)

    • Launching a file from the Startup directory

      • wok.exe (PID: 1560)

    • Creates files or folders in the user directory

      • wok.exe (PID: 1560)

    • Reads the software policy settings

      • slui.exe (PID: 5496)

    • Compiled with Borland Delphi (YARA)

      • Wokk.exe (PID: 5348)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:06:11 19:05:09+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 1370624
InitializedDataSize: 103936
UninitializedDataSize: -
EntryPoint: 0x15081e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: tool.exe
LegalCopyright:
OriginalFileName: tool.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
9
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #GENERIC tool.exe #XWORM wok.exe wokk.exe no specs wokk.exe svchost.exe schtasks.exe no specs conhost.exe no specs windows register no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1560"C:\Users\admin\AppData\Local\Temp\wok.exe" C:\Users\admin\AppData\Local\Temp\wok.exe
tool.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\wok.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1896\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2780"C:\Users\admin\AppData\Local\Temp\Wokk.exe" C:\Users\admin\AppData\Local\Temp\Wokk.exe—tool.exe
User:
admin
Company:
Universal Recoil | 8code
Integrity Level:
MEDIUM
Description:
Universal Recoil | 8code
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\wokk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3724"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Windows Register" /tr "C:\Users\admin\AppData\Local\Temp\Windows Register"C:\Windows\System32\schtasks.exe—wok.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
5348"C:\Users\admin\AppData\Local\Temp\Wokk.exe" C:\Users\admin\AppData\Local\Temp\Wokk.exe
tool.exe
User:
admin
Company:
Universal Recoil | 8code
Integrity Level:
HIGH
Description:
Universal Recoil | 8code
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\wokk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
5496C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5628"C:\Users\admin\AppData\Local\Temp\Windows Register"C:\Users\admin\AppData\Local\Temp\Windows Register—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\windows register
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6428"C:\Users\admin\Desktop\tool.exe" C:\Users\admin\Desktop\tool.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\tool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
6 994
Read events
6 936
Write events
55
Delete events
3

Modification events

(PID) Process:(5348) Wokk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\FirstFolder
Operation:writeName:MRUListEx
Value:
00000000FFFFFFFF
(PID) Process:(5348) Wokk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\FirstFolder
Operation:delete valueName:MRUList
Value:
(PID) Process:(5348) Wokk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\FirstFolder
Operation:writeName:0
Value:
43003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0057006F006B006B002E00650078006500000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070000000
(PID) Process:(5348) Wokk.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
02020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(5348) Wokk.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
040000000000000003000000110000000E000000100000000F0000000C0000000D0000000B000000050000000A000000090000000800000001000000070000000600000002000000FFFFFFFF
(PID) Process:(5348) Wokk.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\34\Shell
Operation:writeName:SniffedFolderType
Value:
Generic
(PID) Process:(5348) Wokk.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4
Operation:writeName:MRUListEx
Value:
010000000000000003000000050000000400000002000000FFFFFFFF
(PID) Process:(1560) wok.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wok_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1560) wok.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wok_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1560) wok.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wok_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
3
Suspicious files
0
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
6428tool.exeC:\Users\admin\AppData\Local\Temp\wok.exeexecutable
MD5:9E87C3A90535C90110832B696F8FD443
SHA256:49A6775FD63297A6C904AD74D1CCD0EE0EBC153F4D54CB242A293E8387D54FC7
1560wok.exeC:\Users\admin\AppData\Local\Temp\Windows Registerexecutable
MD5:9E87C3A90535C90110832B696F8FD443
SHA256:49A6775FD63297A6C904AD74D1CCD0EE0EBC153F4D54CB242A293E8387D54FC7
1560wok.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Register.lnklnk
MD5:C62AF35129B4520EBCA1ECD0CD339861
SHA256:C8031DFF51D3966F737F2F0CE6F232E65DCE78E7E5AD2A41F54D52EF2AE83217
6428tool.exeC:\Users\admin\AppData\Local\Temp\Wokk.exeexecutable
MD5:ACF8907CE64638007FB5514265812C67
SHA256:9FE5FB74600E204A4739A0ED262F16AB6C7EB9F970F61D6315A8E5010F9BC3D4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
25
DNS requests
8
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3788
RUXIMICS.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3788
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1560
wok.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3788
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3788
RUXIMICS.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3788
RUXIMICS.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
stars-specification.gl.at.ply.gg
  • 147.185.221.28
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
self.events.data.microsoft.com
  • 20.189.173.10
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2200
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
1560
wok.exe
A Network Trojan was detected
ET MALWARE Common Stealer Behavior - Source IP Associated with Hosting Provider Check via ip.api .com
1560
wok.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
1560
wok.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
2200
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected domain Associated with Malware Distribution (.ply .gg)
2200
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES Tunneling Service in DNS Lookup (* .ply .gg)
2200
svchost.exe
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
tool.exe