Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 11:19
General
- Target 520aedf724a2b6f2d9d5b713ef6c31d3140760071232f6a2ece60787668db959.ps1
- Size 1KB
- Sample260812-netrdaszav
- SHA256 520aedf724a2b6f2d9d5b713ef6c31d3140760071232f6a2ece60787668db959
Malware Config
Extracted
-
xworm
-
5.0
-
203.202.232.149:2222
-
4VeuKrW7wE9uXCl8
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\520aedf724a2b6f2d9d5b713ef6c31d3140760071232f6a2ece60787668db959.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Caspol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_x1gyr0ss.x1u.ps1
memory/1196-13-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/1196-15-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/1196-4-0x000001F2C0500000-0x000001F2C0522000-memory.dmp
memory/1196-5-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/1196-6-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/1196-7-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/1196-8-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/1196-9-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/1196-10-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/1196-11-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/1196-12-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/1196-0-0x00007FFB132DF000-0x00007FFB132E0000-memory.dmp
memory/1196-14-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/1196-3-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/1196-16-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/1196-18-0x000001F2C06C0000-0x000001F2C06CA000-memory.dmp
memory/1196-17-0x000001F2D8BB0000-0x000001F2D8C64000-memory.dmp
memory/1196-21-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/1940-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1940-22-0x0000000074E42000-0x0000000074E43000-memory.dmp
memory/1940-23-0x0000000005490000-0x000000000552C000-memory.dmp
memory/1940-57-0x0000000074E30000-0x00000000755EC000-memory.dmp
memory/1940-61-0x0000000074E30000-0x00000000755EC000-memory.dmp
memory/1940-60-0x0000000006030000-0x000000000603A000-memory.dmp
memory/1940-59-0x0000000006050000-0x00000000060E2000-memory.dmp
memory/1940-58-0x00000000061B0000-0x000000000676A000-memory.dmp
memory/2600-53-0x0000000070890000-0x00000000708DC000-memory.dmp
memory/4672-30-0x0000000005E80000-0x0000000005EE6000-memory.dmp
memory/4672-29-0x0000000005E10000-0x0000000005E76000-memory.dmp
memory/4672-34-0x0000000005EF0000-0x000000000624B000-memory.dmp
memory/4672-33-0x0000000074E30000-0x00000000755EC000-memory.dmp
memory/4672-36-0x00000000063C0000-0x00000000063DE000-memory.dmp
memory/4672-37-0x0000000006400000-0x000000000644C000-memory.dmp
memory/4672-38-0x0000000007390000-0x00000000073C6000-memory.dmp
memory/4672-39-0x0000000070890000-0x00000000708DC000-memory.dmp
memory/4672-42-0x0000000006990000-0x00000000069B0000-memory.dmp
memory/4672-43-0x00000000073D0000-0x0000000007473000-memory.dmp
memory/4672-44-0x0000000007D70000-0x00000000083EC000-memory.dmp
memory/4672-45-0x0000000007730000-0x000000000774A000-memory.dmp
memory/4672-46-0x00000000077A0000-0x00000000077AA000-memory.dmp
memory/4672-28-0x00000000053D0000-0x00000000053F2000-memory.dmp
memory/4672-26-0x0000000005750000-0x0000000005D9A000-memory.dmp
memory/4672-27-0x0000000074E30000-0x00000000755EC000-memory.dmp
memory/4672-25-0x0000000074E30000-0x00000000755EC000-memory.dmp
memory/4672-24-0x0000000002B70000-0x0000000002BA6000-memory.dmp
memory/4672-47-0x00000000079A0000-0x0000000007A36000-memory.dmp
memory/4672-49-0x0000000074E30000-0x00000000755EC000-memory.dmp