Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 05:42
General
- Target payment. 001 224326.pdf.bat.exe
- Size 801KB
- Sample260604-gd99eaas6y
- SHA256 68af66991e125976da13a5f0ea7bb2c47c255ec742e848064a9486302bd9babe
Malware Config
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 2 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\payment. 001 224326.pdf.bat.exe"C:\Users\Admin\AppData\Local\Temp\payment. 001 224326.pdf.bat.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\payment. 001 224326.pdf.bat.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\payment. 001 224326.pdf.bat.exe"C:\Users\Admin\AppData\Local\Temp\payment. 001 224326.pdf.bat.exe"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\qobaiinzenj.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\rxGwUqPiWTr.exe"C:\Users\Admin\AppData\Roaming\rxGwUqPiWTr.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rxGwUqPiWTr.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\rxGwUqPiWTr.exe"C:\Users\Admin\AppData\Roaming\rxGwUqPiWTr.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
rxGwUqPiWTr.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_m35idlvn.1db.ps1
qobaiinzenj.ps1
rxGwUqPiWTr.exe
memory/2332-17-0x00000000051C0000-0x0000000005226000-memory.dmp
memory/2332-13-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2332-70-0x0000000005360000-0x0000000005370000-memory.dmp
memory/2332-62-0x0000000005360000-0x0000000005370000-memory.dmp
memory/2640-82-0x0000000005630000-0x0000000005987000-memory.dmp
memory/2640-84-0x00000000060A0000-0x00000000060EC000-memory.dmp
memory/2640-85-0x0000000071560000-0x00000000715AC000-memory.dmp
memory/2640-92-0x0000000006E20000-0x0000000006EC4000-memory.dmp
memory/2640-93-0x00000000070D0000-0x00000000070E1000-memory.dmp
memory/2640-94-0x0000000007110000-0x0000000007125000-memory.dmp
memory/4068-42-0x00000000713B0000-0x00000000713FC000-memory.dmp
memory/4068-15-0x00000000055C0000-0x00000000055D0000-memory.dmp
memory/4068-28-0x00000000063D0000-0x0000000006727000-memory.dmp
memory/4068-29-0x0000000006870000-0x000000000688E000-memory.dmp
memory/4068-30-0x00000000068B0000-0x00000000068FC000-memory.dmp
memory/4068-14-0x0000000005400000-0x0000000005436000-memory.dmp
memory/4068-20-0x00000000059D0000-0x00000000059F2000-memory.dmp
memory/4068-19-0x0000000005C00000-0x000000000622A000-memory.dmp
memory/4068-21-0x0000000005B70000-0x0000000005BD6000-memory.dmp
memory/4068-41-0x0000000006E70000-0x0000000006EA4000-memory.dmp
memory/4068-52-0x0000000007A90000-0x0000000007B34000-memory.dmp
memory/4068-51-0x0000000007A70000-0x0000000007A8E000-memory.dmp
memory/4068-53-0x0000000008210000-0x000000000888A000-memory.dmp
memory/4068-54-0x0000000007BD0000-0x0000000007BEA000-memory.dmp
memory/4068-55-0x0000000007C50000-0x0000000007C5A000-memory.dmp
memory/4068-56-0x0000000007E60000-0x0000000007EF6000-memory.dmp
memory/4068-57-0x0000000007DE0000-0x0000000007DF1000-memory.dmp
memory/4068-18-0x00000000055C0000-0x00000000055D0000-memory.dmp
memory/4068-63-0x0000000007E10000-0x0000000007E1E000-memory.dmp
memory/4068-64-0x0000000007E20000-0x0000000007E35000-memory.dmp
memory/4068-65-0x0000000007F20000-0x0000000007F3A000-memory.dmp
memory/4068-66-0x0000000007F10000-0x0000000007F18000-memory.dmp
memory/4116-37-0x0000018EDEE00000-0x0000018EDEE22000-memory.dmp
memory/5008-0-0x0000000000300000-0x00000000003CE000-memory.dmp
memory/5008-8-0x0000000008360000-0x0000000008410000-memory.dmp
memory/5008-7-0x0000000005190000-0x00000000051A0000-memory.dmp
memory/5008-6-0x00000000053F0000-0x0000000005408000-memory.dmp
memory/5008-5-0x00000000051A0000-0x000000000523C000-memory.dmp
memory/5008-4-0x0000000004E80000-0x0000000004E8A000-memory.dmp
memory/5008-3-0x0000000005190000-0x00000000051A0000-memory.dmp
memory/5008-2-0x0000000004F00000-0x0000000004F92000-memory.dmp
memory/5008-1-0x0000000005410000-0x00000000059B6000-memory.dmp