Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 02:00
General
- Target ORDER 29TH.vbs
- Size 2.5MB
- Sample260730-cff15az1dt
- SHA256 2a01a22a5d823b5705dad1f7de5d15ebf9068347099726b95878aeaf9de9b625
Malware Config
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 3 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ORDER 29TH.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Invoke-Expression $env:bulkiness"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\\Users\\Administrator\\Downloads\\kqXjx5c1KZ.vbs"2⤵
- Executes a command shell one-liner
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Assign" /tr "C:\Users\Admin\AppData\Roaming\Assign"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_7fe2b94a44ab40829fd79669567df4cc.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES18AA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC588CD5A7FCF44F62AECCE01B7D48E96.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CasPol.exe"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" 40923⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_f6242fbe462a4c60a7da55edaf309a15.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1DCA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD1BE1744FC5E427BB67E9711E6182724.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_94b4be465d3f4111a349d8da9b1c63a7.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES34FC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5791D3582464288AE84BD2F1A561.TMP"4⤵
-
-
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Assign"C:\Users\Admin\AppData\Roaming\Assign"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Assign"C:\Users\Admin\AppData\Roaming\Assign"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CasPol.exe
RES18AA.tmp
RES1DCA.tmp
RES34FC.tmp
Assign
CSC588CD5A7FCF44F62AECCE01B7D48E96.TMP
guardian_src_7fe2b94a44ab40829fd79669567df4cc.cs
memory/3220-11-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
memory/3220-1-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
memory/3220-0-0x00007FFBA7BCF000-0x00007FFBA7BD0000-memory.dmp
memory/3220-12-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
memory/3220-13-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
memory/3220-14-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
memory/3220-15-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
memory/3220-16-0x00000171B3370000-0x00000171B3402000-memory.dmp
memory/3220-17-0x00000171B3230000-0x00000171B323A000-memory.dmp
memory/3220-9-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
memory/3220-20-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
memory/3220-4-0x00000171B31B0000-0x00000171B31D2000-memory.dmp
memory/3220-5-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
memory/3220-6-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
memory/3220-7-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
memory/3220-10-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
memory/3220-8-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
memory/4092-26-0x00000000104B0000-0x00000000112EC000-memory.dmp
memory/4092-50-0x0000000005880000-0x0000000005886000-memory.dmp
memory/4092-25-0x0000000007730000-0x00000000077C2000-memory.dmp
memory/4092-23-0x0000000005950000-0x0000000005F0A000-memory.dmp
memory/4092-18-0x0000000000400000-0x000000000041C000-memory.dmp
memory/4092-39-0x00000000097F0000-0x000000000986C000-memory.dmp
memory/4092-40-0x0000000009870000-0x0000000009878000-memory.dmp
memory/4092-22-0x0000000005320000-0x0000000005386000-memory.dmp
memory/4092-48-0x0000000011D00000-0x0000000011EC2000-memory.dmp
memory/4092-49-0x0000000005F10000-0x0000000005F44000-memory.dmp
memory/4092-27-0x00000000087D0000-0x0000000009228000-memory.dmp
memory/4092-21-0x0000000005250000-0x00000000052EC000-memory.dmp
memory/5244-38-0x0000000000A20000-0x0000000000A28000-memory.dmp
memory/5616-60-0x00000000003B0000-0x00000000003CC000-memory.dmp