Analysis
- max time kernel
298s - max time network
298s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
30/03/2026, 16:28
General
- Target ORDER_RFQ Signed.vbs
- Size 2.6MB
- Sample260330-tyttdab19t
- SHA256 a46d328e7bcee448006caf44fc6bf4603e6c9948f717074a3350316121d1a9db
Malware Config
Extracted
-
xworm
-
5.0
-
103.83.87.178:2001
-
EvVLsHxNS1r38kMG
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ORDER_RFQ Signed.vbs"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Caspol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_vq0foyng.2jd.ps1
memory/2484-20-0x0000000005550000-0x00000000055EC000-memory.dmp
memory/2484-82-0x0000000005FB0000-0x0000000005FBA000-memory.dmp
memory/2484-80-0x0000000006240000-0x00000000067E4000-memory.dmp
memory/2484-81-0x0000000005FF0000-0x0000000006082000-memory.dmp
memory/2484-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3088-18-0x000001EB41AE0000-0x000001EB41AEC000-memory.dmp
memory/3088-1-0x000001EB41D60000-0x000001EB41D70000-memory.dmp
memory/3088-19-0x000001EB41D50000-0x000001EB41D58000-memory.dmp
memory/3088-17-0x000001EB3FE80000-0x000001EB40021000-memory.dmp
memory/3088-13-0x000001EB41D60000-0x000001EB41D70000-memory.dmp
memory/3088-12-0x000001EB5A480000-0x000001EB5A48A000-memory.dmp
memory/3088-11-0x000001EB5A650000-0x000001EB5A772000-memory.dmp
memory/3088-8-0x000001EB5A250000-0x000001EB5A272000-memory.dmp
memory/3088-0-0x000001EB41D60000-0x000001EB41D70000-memory.dmp
memory/4088-79-0x0000000004790000-0x0000000004819000-memory.dmp
memory/4088-70-0x0000000070440000-0x000000007048C000-memory.dmp
memory/4088-68-0x0000000005560000-0x00000000058B4000-memory.dmp
memory/4992-37-0x0000000007A90000-0x0000000007AC2000-memory.dmp
memory/4992-54-0x0000000007E40000-0x0000000007E54000-memory.dmp
memory/4992-38-0x0000000070440000-0x000000007048C000-memory.dmp
memory/4992-46-0x0000000007A70000-0x0000000007A8E000-memory.dmp
memory/4992-47-0x0000000007AD0000-0x0000000007B73000-memory.dmp
memory/4992-48-0x0000000008240000-0x00000000088BA000-memory.dmp
memory/4992-49-0x0000000007C00000-0x0000000007C1A000-memory.dmp
memory/4992-50-0x0000000007C70000-0x0000000007C7A000-memory.dmp
memory/4992-51-0x0000000007E80000-0x0000000007F16000-memory.dmp
memory/4992-52-0x0000000007E00000-0x0000000007E11000-memory.dmp
memory/4992-53-0x0000000007E30000-0x0000000007E3E000-memory.dmp
memory/4992-36-0x0000000006950000-0x000000000699C000-memory.dmp
memory/4992-55-0x0000000007F40000-0x0000000007F5A000-memory.dmp
memory/4992-56-0x0000000007F20000-0x0000000007F28000-memory.dmp
memory/4992-59-0x0000000005460000-0x00000000054E9000-memory.dmp
memory/4992-35-0x00000000068B0000-0x00000000068CE000-memory.dmp
memory/4992-33-0x0000000006390000-0x00000000066E4000-memory.dmp
memory/4992-25-0x0000000006320000-0x0000000006386000-memory.dmp
memory/4992-24-0x00000000062B0000-0x0000000006316000-memory.dmp
memory/4992-23-0x0000000005AB0000-0x0000000005AD2000-memory.dmp
memory/4992-22-0x0000000005B50000-0x0000000006178000-memory.dmp
memory/4992-21-0x0000000005420000-0x0000000005456000-memory.dmp
memory/5044-10-0x00000256294A0000-0x00000256294AC000-memory.dmp