Analysis
- max time kernel
900s - max time network
891s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/06/2026, 10:23
General
- Target Sipariş - 05.04.2026.vbs
- Size 2.4MB
- Sample260604-mexmladv5q
- SHA256 5f45b1ee165a750cae48dea599b7ed585fe28b44f4a7e215e62486efa6480513
Malware Config
Extracted
-
xworm
-
5.0
-
203.202.232.132:2828
-
BHbzRLXXV6MmhGaf
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Sipariş - 05.04.2026.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Sipariş - 05.04.2026.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sipariş - 05.04.2026.vbs' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& ([ScriptBlock]::Create(${env:INTERNAL_DB_CACHE}))"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_421b000bee204845ba7118332643cfb7.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA133.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC302EE4E692524ACAB61DABF68A89B2D.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" 28323⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_e33b4ae69b2d44d684fe78ac9039c144.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB16F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC55808992C0CB43719314C7DCCBB7B01A.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
MSBuild.exe
RESA133.tmp
RESB16F.tmp
__PSScriptPolicyTest_wcg0klvg.ow1.ps1
CSC302EE4E692524ACAB61DABF68A89B2D.TMP
guardian_src_421b000bee204845ba7118332643cfb7.cs
memory/828-1-0x000002790BCD0000-0x000002790BCE0000-memory.dmp
memory/828-8-0x000002790BE40000-0x000002790BE62000-memory.dmp
memory/828-0-0x000002790BCD0000-0x000002790BCE0000-memory.dmp
memory/2636-43-0x0000000000CD0000-0x0000000000CD8000-memory.dmp
memory/2832-22-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2832-30-0x0000000006270000-0x00000000062A4000-memory.dmp
memory/2832-31-0x00000000064C0000-0x00000000064C6000-memory.dmp
memory/2832-29-0x00000000068F0000-0x0000000006E94000-memory.dmp
memory/2832-28-0x00000000062A0000-0x0000000006332000-memory.dmp
memory/2832-27-0x0000000005690000-0x00000000056F6000-memory.dmp
memory/2832-26-0x0000000004FB0000-0x000000000504C000-memory.dmp
memory/2832-45-0x0000000006410000-0x0000000006418000-memory.dmp
memory/2832-44-0x0000000006380000-0x00000000063FC000-memory.dmp
memory/2832-53-0x0000000007780000-0x0000000007942000-memory.dmp
memory/4180-21-0x000002689C2D0000-0x000002689C2DA000-memory.dmp
memory/4180-20-0x000002689C220000-0x000002689C2D4000-memory.dmp