Analysis
- max time kernel
149s - max time network
140s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 02:54
General
- Target _ed2001b4af76a38afef7dac1caa1c26b857d4f52737368190922593cf37d9c21.ps1
- Size 88KB
- Sample260424-dd779sdv5t
- SHA256 ed2001b4af76a38afef7dac1caa1c26b857d4f52737368190922593cf37d9c21
Malware Config
Extracted
-
xworm
-
5.0
-
198.23.177.219:4445
-
19UxITJDrgiOdo47
-
install_file
USB.exe
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Detects DonutLoader 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\_ed2001b4af76a38afef7dac1caa1c26b857d4f52737368190922593cf37d9c21.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iwkmqg14\iwkmqg14.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE54F.tmp" "c:\Users\Admin\AppData\Local\Temp\iwkmqg14\CSCFB4C1B443FF4B4DBD39532C132B68A.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3szky5yy\3szky5yy.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE85C.tmp" "c:\Users\Admin\AppData\Local\Temp\3szky5yy\CSC6AEF6DB7948E49778751EF1DB27AC0EB.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3szky5yy.dll
RESE54F.tmp
RESE85C.tmp
__PSScriptPolicyTest_kk4vphra.msl.ps1
iwkmqg14.dll
3szky5yy.0.cs
3szky5yy.cmdline
CSC6AEF6DB7948E49778751EF1DB27AC0EB.TMP
CSCFB4C1B443FF4B4DBD39532C132B68A.TMP
iwkmqg14.0.cs
iwkmqg14.cmdline
memory/3132-43-0x0000000003AF0000-0x0000000003AFE000-memory.dmp
memory/3132-41-0x0000000000740000-0x0000000000750000-memory.dmp
memory/3176-38-0x00000223B9D40000-0x00000223B9D4C000-memory.dmp
memory/3864-35-0x0000022CCD8E0000-0x0000022CCD8EC000-memory.dmp
memory/4956-9-0x0000023F2A170000-0x0000023F2A180000-memory.dmp
memory/4956-25-0x0000023F2A210000-0x0000023F2A218000-memory.dmp
memory/4956-0-0x0000023F2A170000-0x0000023F2A180000-memory.dmp
memory/4956-8-0x0000023F2A220000-0x0000023F2A242000-memory.dmp
memory/4956-40-0x0000023F2A290000-0x0000023F2A298000-memory.dmp
memory/4956-1-0x0000023F2A170000-0x0000023F2A180000-memory.dmp
memory/4956-10-0x0000023F2A170000-0x0000023F2A180000-memory.dmp
memory/4956-46-0x0000023F11A90000-0x0000023F11A9C000-memory.dmp
memory/4956-47-0x0000023F2A120000-0x0000023F2A132000-memory.dmp
memory/5100-23-0x0000022CE1D10000-0x0000022CE1D1C000-memory.dmp
memory/5112-20-0x000001C966110000-0x000001C96611C000-memory.dmp