Analysis
- user interaction
yes - max time kernel
599s - max time network
591s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/06/2026, 10:22
General
- Target Sipariş - 05.04.2026.vbs
- Size 2.4MB
- Sample260604-mem36acw21
- SHA256 5f45b1ee165a750cae48dea599b7ed585fe28b44f4a7e215e62486efa6480513
Malware Config
Extracted
-
xworm
-
5.0
-
203.202.232.132:2828
-
BHbzRLXXV6MmhGaf
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Sipariş - 05.04.2026.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Sipariş - 05.04.2026.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sipariş - 05.04.2026.vbs' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& ([ScriptBlock]::Create(${env:INTERNAL_DB_CACHE}))"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_1041e5ec9cf04a9bb887eddb6e2016bc.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4476.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF434183536534A088C422C4E78A5BA29.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" 18723⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_cef3227860d74541987fb47c090f4d72.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES463B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC45C70218F1FB41EB91ACC9BD3622A9A3.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
MSBuild.exe
RES4476.tmp
RES463B.tmp
__PSScriptPolicyTest_pcjmiuzb.x4k.ps1
CSCF434183536534A088C422C4E78A5BA29.TMP
guardian_src_1041e5ec9cf04a9bb887eddb6e2016bc.cs
memory/1692-10-0x000001B36F890000-0x000001B36F8A0000-memory.dmp
memory/1692-4-0x000001B36F5C0000-0x000001B36F5E2000-memory.dmp
memory/1692-0-0x000001B36F890000-0x000001B36F8A0000-memory.dmp
memory/1692-1-0x000001B36F890000-0x000001B36F8A0000-memory.dmp
memory/1872-30-0x0000000006840000-0x0000000006874000-memory.dmp
memory/1872-29-0x0000000006EF0000-0x0000000007494000-memory.dmp
memory/1872-28-0x00000000068A0000-0x0000000006932000-memory.dmp
memory/1872-31-0x0000000006950000-0x0000000006956000-memory.dmp
memory/1872-27-0x0000000005DC0000-0x0000000005E26000-memory.dmp
memory/1872-26-0x00000000056C0000-0x000000000575C000-memory.dmp
memory/1872-24-0x0000000000400000-0x000000000040E000-memory.dmp
memory/1872-45-0x0000000006C40000-0x0000000006C48000-memory.dmp
memory/1872-44-0x0000000007880000-0x00000000078FC000-memory.dmp
memory/1872-53-0x0000000007D50000-0x0000000007F12000-memory.dmp
memory/3292-43-0x0000000000580000-0x0000000000588000-memory.dmp
memory/4632-23-0x000001E844200000-0x000001E84420A000-memory.dmp
memory/4632-22-0x000001E844D80000-0x000001E844E34000-memory.dmp