Analysis
- max time kernel
300s - max time network
299s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
30/03/2026, 16:28
General
- Target ORDER_RFQ Signed.vbs
- Size 2.6MB
- Sample260330-tyttdab19t
- SHA256 a46d328e7bcee448006caf44fc6bf4603e6c9948f717074a3350316121d1a9db
Malware Config
Extracted
-
xworm
-
5.0
-
103.83.87.178:2001
-
EvVLsHxNS1r38kMG
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ORDER_RFQ Signed.vbs"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Caspol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_pkjehamn.y4l.ps1
memory/800-52-0x00000000072F0000-0x000000000730A000-memory.dmp
memory/800-44-0x0000000006E70000-0x0000000006F14000-memory.dmp
memory/800-45-0x00000000075F0000-0x0000000007C6A000-memory.dmp
memory/800-57-0x0000000004880000-0x000000000490A000-memory.dmp
memory/800-56-0x00000000047C0000-0x00000000047D9000-memory.dmp
memory/800-53-0x0000000007240000-0x0000000007248000-memory.dmp
memory/800-51-0x00000000071F0000-0x0000000007205000-memory.dmp
memory/800-50-0x00000000071E0000-0x00000000071EE000-memory.dmp
memory/800-49-0x00000000071B0000-0x00000000071C1000-memory.dmp
memory/800-20-0x0000000004840000-0x0000000004876000-memory.dmp
memory/800-21-0x0000000004F40000-0x000000000556A000-memory.dmp
memory/800-22-0x0000000004EC0000-0x0000000004EE2000-memory.dmp
memory/800-23-0x00000000056A0000-0x0000000005706000-memory.dmp
memory/800-24-0x0000000005710000-0x0000000005776000-memory.dmp
memory/800-31-0x0000000005880000-0x0000000005BD7000-memory.dmp
memory/800-48-0x0000000007250000-0x00000000072E6000-memory.dmp
memory/800-33-0x0000000005C50000-0x0000000005C6E000-memory.dmp
memory/800-34-0x0000000005CA0000-0x0000000005CEC000-memory.dmp
memory/800-35-0x0000000006E20000-0x0000000006E54000-memory.dmp
memory/800-36-0x0000000070480000-0x00000000704CC000-memory.dmp
memory/800-47-0x0000000007010000-0x000000000701A000-memory.dmp
memory/800-43-0x0000000006240000-0x000000000625E000-memory.dmp
memory/800-46-0x0000000006FA0000-0x0000000006FBA000-memory.dmp
memory/1992-10-0x000001F47F6E0000-0x000001F47F7FE000-memory.dmp
memory/1992-11-0x000001F47DE80000-0x000001F47DE8C000-memory.dmp
memory/2080-17-0x0000024315D30000-0x0000024315D3C000-memory.dmp
memory/2080-12-0x000002432E990000-0x000002432EAB2000-memory.dmp
memory/2080-0-0x000002432E430000-0x000002432E440000-memory.dmp
memory/2080-18-0x0000024315E50000-0x0000024315E62000-memory.dmp
memory/2080-1-0x000002432E430000-0x000002432E440000-memory.dmp
memory/2080-13-0x000002432E420000-0x000002432E42A000-memory.dmp
memory/2080-9-0x000002432E430000-0x000002432E440000-memory.dmp
memory/2080-7-0x000002432E3A0000-0x000002432E3C2000-memory.dmp
memory/3932-19-0x0000000005120000-0x00000000051BC000-memory.dmp
memory/3932-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3932-78-0x0000000005D60000-0x0000000005DF2000-memory.dmp
memory/3932-77-0x0000000006120000-0x00000000066C6000-memory.dmp
memory/3932-79-0x0000000005D30000-0x0000000005D3A000-memory.dmp
memory/4980-59-0x00000000061C0000-0x0000000006517000-memory.dmp
memory/4980-67-0x0000000070480000-0x00000000704CC000-memory.dmp
memory/4980-75-0x00000000051E0000-0x00000000051F9000-memory.dmp
memory/4980-76-0x0000000005290000-0x000000000531A000-memory.dmp