Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
07/07/2026, 12:11
General
- Target Pedido de Compra [POF0000095].vbs
- Size 1.3MB
- Sample260707-pc3f6shs8x
- SHA256 391edbfdd1f3011d914612342f927b20b6268d4e9effbd7e7b90f5428d827c16
Malware Config
Extracted
-
xworm
-
5.0
-
45.141.148.126:1122
-
97jODOsIfTOAkz6u
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Pedido de Compra [POF0000095].vbs"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Invoke-Expression $env:apatheism"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Caspol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_81e31fb528f54ffe881bef59c7a8f567.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES96DC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC79CC4C039CE8490EBA3D738D27FB4DF.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CasPol.exe"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" 7603⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
CasPol.exe
RES96DC.tmp
__PSScriptPolicyTest_5142qurs.x5j.ps1
CSC79CC4C039CE8490EBA3D738D27FB4DF.TMP
guardian_src_81e31fb528f54ffe881bef59c7a8f567.cs
memory/760-76-0x0000000007130000-0x00000000071AC000-memory.dmp
memory/760-77-0x00000000071D0000-0x0000000007204000-memory.dmp
memory/760-16-0x0000000005320000-0x00000000053BC000-memory.dmp
memory/760-73-0x0000000006250000-0x00000000067F4000-memory.dmp
memory/760-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/760-74-0x0000000005EE0000-0x0000000005F72000-memory.dmp
memory/760-75-0x0000000005EC0000-0x0000000005ECA000-memory.dmp
memory/760-78-0x0000000007210000-0x0000000007216000-memory.dmp
memory/1668-90-0x0000000000AF0000-0x0000000000AF8000-memory.dmp
memory/2184-10-0x0000021354B60000-0x0000021354C14000-memory.dmp
memory/2184-9-0x0000021352980000-0x00000213529A2000-memory.dmp
memory/2184-11-0x0000021352970000-0x000002135297A000-memory.dmp
memory/2184-12-0x00000213529E0000-0x00000213529F0000-memory.dmp
memory/2184-1-0x00000213529E0000-0x00000213529F0000-memory.dmp
memory/2184-0-0x00000213529E0000-0x00000213529F0000-memory.dmp
memory/4488-64-0x00000000706B0000-0x00000000706FC000-memory.dmp
memory/4952-19-0x0000000005310000-0x0000000005332000-memory.dmp
memory/4952-47-0x0000000007860000-0x00000000078F6000-memory.dmp
memory/4952-48-0x00000000077E0000-0x00000000077F1000-memory.dmp
memory/4952-49-0x0000000007810000-0x000000000781E000-memory.dmp
memory/4952-50-0x0000000007820000-0x0000000007834000-memory.dmp
memory/4952-51-0x0000000007920000-0x000000000793A000-memory.dmp
memory/4952-52-0x0000000007900000-0x0000000007908000-memory.dmp
memory/4952-46-0x0000000007650000-0x000000000765A000-memory.dmp
memory/4952-45-0x00000000075E0000-0x00000000075FA000-memory.dmp
memory/4952-44-0x0000000007C30000-0x00000000082AA000-memory.dmp
memory/4952-43-0x00000000074C0000-0x0000000007563000-memory.dmp
memory/4952-42-0x0000000006870000-0x000000000688E000-memory.dmp
memory/4952-34-0x00000000706B0000-0x00000000706FC000-memory.dmp
memory/4952-33-0x0000000007480000-0x00000000074B2000-memory.dmp
memory/4952-32-0x00000000062F0000-0x000000000633C000-memory.dmp
memory/4952-31-0x00000000062C0000-0x00000000062DE000-memory.dmp
memory/4952-27-0x0000000005D00000-0x0000000006054000-memory.dmp
memory/4952-20-0x0000000005C20000-0x0000000005C86000-memory.dmp
memory/4952-21-0x0000000005C90000-0x0000000005CF6000-memory.dmp
memory/4952-18-0x0000000005580000-0x0000000005BA8000-memory.dmp
memory/4952-17-0x0000000002990000-0x00000000029C6000-memory.dmp