Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
17/04/2026, 02:32
General
- Target TransferCopy.vbs
- Size 2.6MB
- Sample260417-c1hepady2n
- SHA256 b497901579155f4f4644e26fea1d859eb0669ca2f273a55818bda19cf8592c91
Malware Config
Extracted
-
xworm
-
5.0
-
209.127.35.204:2662
-
HaaIXbv8vBFKi0HX
-
install_file
USB.exe
Signatures
- Family: StormKitty
StormKitty is an open source info stealer written in C#.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- StormKitty payload 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Suspicious use of SetThreadContext 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\TransferCopy.vbs"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\pzbnen.vbs"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_3m3hbvfr.q5u.ps1
pzbnen.vbs
memory/444-38-0x0000000008F00000-0x0000000009257000-memory.dmp
memory/444-37-0x0000000007680000-0x00000000077A0000-memory.dmp
memory/444-65-0x0000000007560000-0x0000000007582000-memory.dmp
memory/444-40-0x00000000072C0000-0x00000000072CE000-memory.dmp
memory/444-14-0x0000000000400000-0x0000000000428000-memory.dmp
memory/444-39-0x0000000009260000-0x00000000092AC000-memory.dmp
memory/444-36-0x0000000007A00000-0x0000000007D50000-memory.dmp
memory/444-19-0x0000000005440000-0x00000000054DC000-memory.dmp
memory/444-20-0x0000000005EE0000-0x0000000006486000-memory.dmp
memory/444-21-0x0000000005DA0000-0x0000000005E32000-memory.dmp
memory/444-22-0x0000000005D70000-0x0000000005D7A000-memory.dmp
memory/444-23-0x00000000067D0000-0x0000000006836000-memory.dmp
memory/4244-66-0x0000023740F00000-0x0000023740F12000-memory.dmp
memory/4244-67-0x0000023759600000-0x000002375966F000-memory.dmp
memory/4244-73-0x0000023759600000-0x000002375966F000-memory.dmp
memory/4696-10-0x000002A427730000-0x000002A427740000-memory.dmp
memory/4696-3-0x000002A427790000-0x000002A4277B2000-memory.dmp
memory/4696-1-0x000002A427730000-0x000002A427740000-memory.dmp
memory/4696-18-0x000002A4277C0000-0x000002A42782F000-memory.dmp
memory/4696-11-0x000002A427C00000-0x000002A427D9C000-memory.dmp
memory/4696-2-0x000002A427730000-0x000002A427740000-memory.dmp
memory/4696-17-0x000002A427740000-0x000002A427752000-memory.dmp
memory/4696-13-0x000002A427730000-0x000002A427740000-memory.dmp
memory/4696-12-0x000002A427A70000-0x000002A427A7A000-memory.dmp