Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 16:17
General
- Target Project Inquiry for Well Head Control Panel Project DMA0036.hta
- Size 2.2MB
- Sample260727-trd5caxtdy
- SHA256 ea92bb8faa05e607e95a5fca94809b9b8f050b83d812f337c1cc50e2fd1fde3c
Malware Config
Extracted
-
xworm
-
5.0
-
wokymbo.ptsco.cam:6500
-
X4LnlEBHWFXgSrre
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\Project Inquiry for Well Head Control Panel Project DMA0036.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Invoke-Expression $env:kalakand"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_091d00122cfd4b4a9a38e004848268c9.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES27F7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC257E016414A4E79A66C6E16F8F3F56.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" 31923⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MSBuild.exe
RES27F7.tmp
__PSScriptPolicyTest_cdeubf4b.aul.ps1
CSCC257E016414A4E79A66C6E16F8F3F56.TMP
guardian_src_091d00122cfd4b4a9a38e004848268c9.cs
memory/3192-49-0x0000000009920000-0x0000000009942000-memory.dmp
memory/3192-21-0x00000000058A0000-0x000000000593C000-memory.dmp
memory/3192-61-0x00000000082A0000-0x00000000082D6000-memory.dmp
memory/3192-60-0x00000000084C0000-0x00000000084CA000-memory.dmp
memory/3192-59-0x0000000008250000-0x00000000082F3000-memory.dmp
memory/3192-58-0x0000000008230000-0x0000000008250000-memory.dmp
memory/3192-55-0x000000000BF10000-0x000000000BF5C000-memory.dmp
memory/3192-54-0x000000000A000000-0x000000000A022000-memory.dmp
memory/3192-53-0x000000000A030000-0x000000000A096000-memory.dmp
memory/3192-52-0x0000000009BE0000-0x0000000009F3B000-memory.dmp
memory/3192-51-0x0000000009A80000-0x0000000009ACA000-memory.dmp
memory/3192-18-0x0000000000400000-0x000000000040E000-memory.dmp
memory/3192-50-0x0000000009950000-0x000000000996E000-memory.dmp
memory/3192-42-0x000000000B160000-0x000000000B7AA000-memory.dmp
memory/3192-22-0x0000000005EF0000-0x0000000005F56000-memory.dmp
memory/3192-23-0x0000000007200000-0x0000000007292000-memory.dmp
memory/3192-24-0x0000000007860000-0x0000000007E1A000-memory.dmp
memory/3192-48-0x0000000009990000-0x0000000009A26000-memory.dmp
memory/3192-28-0x0000000007020000-0x000000000709C000-memory.dmp
memory/3192-29-0x00000000070E0000-0x0000000007110000-memory.dmp
memory/3192-47-0x000000000B7B0000-0x000000000BE2C000-memory.dmp
memory/3192-30-0x0000000007120000-0x0000000007128000-memory.dmp
memory/3192-27-0x0000000010160000-0x0000000010F9C000-memory.dmp
memory/3192-46-0x00000000098B0000-0x00000000098E6000-memory.dmp
memory/3192-45-0x0000000009630000-0x000000000964A000-memory.dmp
memory/4600-41-0x0000000000D80000-0x0000000000D88000-memory.dmp
memory/5984-4-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5984-2-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5984-3-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5984-8-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5984-7-0x0000020929C90000-0x0000020929CB2000-memory.dmp
memory/5984-0-0x00007FFC72F2F000-0x00007FFC72F30000-memory.dmp
memory/5984-20-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5984-17-0x0000020929EE0000-0x0000020929EEA000-memory.dmp
memory/5984-16-0x0000020929E50000-0x0000020929EE2000-memory.dmp
memory/5984-15-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5984-14-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5984-13-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5984-1-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5984-12-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5984-11-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5984-10-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5984-9-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp