Analysis
- max time kernel
300s - max time network
290s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 07:03
General
- Target Siparişi - 75158991-803.vbs
- Size 1.3MB
- Sample260708-hvnbmsct5x
- SHA256 1c3f44b252b785f6fd6792c424bb2844e9349421c480939c9181383931666535
Malware Config
Extracted
-
xworm
-
5.0
-
203.202.232.132:2828
-
ulQxhAv1bSCnb98W
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Siparişi - 75158991-803.vbs"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Siparişi - 75158991-803.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Siparişi - 75158991-803.vbs' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Invoke-Expression $env:tenderee"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_d75d7cb56df24e7f80d6187622009116.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFD04.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6090BFBD735047C49BEFDED3F0532150.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" 43123⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_d44319ac31eb436087ca370a820272e5.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF65.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4A0F2A6D121496EBA64225F3825A89C.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_7d73944f77df4d218e1bad24cb6669f2.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFFC3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8A5C2FF9AB354BB68C5C4D99DEE77FE0.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
MSBuild.exe
RESFD04.tmp
RESFF65.tmp
RESFFC3.tmp
CSC6090BFBD735047C49BEFDED3F0532150.TMP
guardian_src_d75d7cb56df24e7f80d6187622009116.cs
memory/3004-47-0x00000000002F0000-0x00000000002F8000-memory.dmp
memory/3892-25-0x00000212EB9D0000-0x00000212EBA84000-memory.dmp
memory/3892-24-0x00007FFA07360000-0x00007FFA07D04000-memory.dmp
memory/3892-30-0x00007FFA07360000-0x00007FFA07D04000-memory.dmp
memory/3892-16-0x00007FFA07360000-0x00007FFA07D04000-memory.dmp
memory/3892-17-0x00007FFA07360000-0x00007FFA07D04000-memory.dmp
memory/3892-18-0x00007FFA07360000-0x00007FFA07D04000-memory.dmp
memory/3892-19-0x00007FFA07360000-0x00007FFA07D04000-memory.dmp
memory/3892-20-0x00007FFA07360000-0x00007FFA07D04000-memory.dmp
memory/3892-21-0x00007FFA07360000-0x00007FFA07D04000-memory.dmp
memory/3892-22-0x00007FFA07360000-0x00007FFA07D04000-memory.dmp
memory/3892-26-0x00000212EB400000-0x00000212EB40A000-memory.dmp
memory/4312-31-0x00000000057E0000-0x0000000005846000-memory.dmp
memory/4312-38-0x000000000F8C0000-0x00000000106FC000-memory.dmp
memory/4312-65-0x000000000A290000-0x000000000A452000-memory.dmp
memory/4312-27-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4312-29-0x00000000050B0000-0x000000000514C000-memory.dmp
memory/4312-34-0x0000000007D20000-0x0000000007D54000-memory.dmp
memory/4312-51-0x0000000007010000-0x000000000708C000-memory.dmp
memory/4312-32-0x0000000006AA0000-0x0000000006B32000-memory.dmp
memory/4312-33-0x0000000007100000-0x00000000076BA000-memory.dmp
memory/4312-52-0x0000000006BA0000-0x0000000006BA8000-memory.dmp
memory/4312-35-0x0000000007D50000-0x0000000007D56000-memory.dmp
memory/4312-48-0x000000000A8C0000-0x000000000B318000-memory.dmp
memory/5016-11-0x00007FFA07360000-0x00007FFA07D04000-memory.dmp
memory/5016-6-0x00007FFA07360000-0x00007FFA07D04000-memory.dmp
memory/5016-7-0x00007FFA07360000-0x00007FFA07D04000-memory.dmp
memory/5016-5-0x00007FFA07360000-0x00007FFA07D04000-memory.dmp
memory/5016-9-0x00007FFA07360000-0x00007FFA07D04000-memory.dmp
memory/5016-8-0x00007FFA07360000-0x00007FFA07D04000-memory.dmp
memory/5016-0-0x00007FFA074EF000-0x00007FFA074F0000-memory.dmp
memory/5016-15-0x00007FFA07360000-0x00007FFA07D04000-memory.dmp
memory/5016-4-0x0000016A7E2E0000-0x0000016A7E302000-memory.dmp
memory/5016-1-0x00007FFA07360000-0x00007FFA07D04000-memory.dmp
memory/5016-10-0x00007FFA07360000-0x00007FFA07D04000-memory.dmp