Analysis
- user interaction
yes - max time kernel
58s - max time network
57s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
26/08/2026, 00:49
General
- Target SOA23455UAE.js
- Size 418KB
- Sample260826-a6lces1cmd
- SHA256 2c466f7bc985e031913991fad6a0e3a7deb12dbacf71a052a6a9e28804d74e0c
Malware Config
Extracted
-
xworm
-
5.0
-
windowsupgrade.3utilities.com:443
-
103.67.163.6:443
-
1h9pSdBcaxYxfsGM
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\SOA23455UAE.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\pvukbsnw\tmp_22984_81b8.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\muutjhjn\muutjhjn.cmdline"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC0BB.tmp" "c:\Users\Admin\AppData\Local\Temp\muutjhjn\CSC4EBE1810B852470593E8CA38A94634CE.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zh5nrv1z\zh5nrv1z.cmdline"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC157.tmp" "c:\Users\Admin\AppData\Local\Temp\zh5nrv1z\CSC89A62ED231DD40D593F29B109DBEE648.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESC0BB.tmp
RESC157.tmp
__PSScriptPolicyTest_0hip4kl3.vnm.ps1
muutjhjn.dll
tmp_22984_81b8.ps1
zh5nrv1z.dll
CSC4EBE1810B852470593E8CA38A94634CE.TMP
muutjhjn.0.cs
muutjhjn.cmdline
CSC89A62ED231DD40D593F29B109DBEE648.TMP
zh5nrv1z.0.cs
zh5nrv1z.cmdline
memory/3908-58-0x0000000006180000-0x0000000006212000-memory.dmp
memory/3908-52-0x0000000004DF0000-0x0000000004E8C000-memory.dmp
memory/3908-51-0x0000000000800000-0x000000000080E000-memory.dmp
memory/4476-35-0x00000000075A0000-0x00000000075A8000-memory.dmp
memory/4476-5-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/4476-9-0x0000000005690000-0x00000000056F6000-memory.dmp
memory/4476-7-0x0000000005410000-0x0000000005432000-memory.dmp
memory/4476-6-0x0000000005730000-0x0000000005D5A000-memory.dmp
memory/4476-16-0x0000000005EE0000-0x0000000006237000-memory.dmp
memory/4476-22-0x00000000069A0000-0x00000000069BA000-memory.dmp
memory/4476-21-0x0000000007DA0000-0x000000000841A000-memory.dmp
memory/4476-20-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/4476-3-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/4476-48-0x00000000075C0000-0x00000000075C8000-memory.dmp
memory/4476-4-0x0000000002F00000-0x0000000002F36000-memory.dmp
memory/4476-49-0x00000000075D0000-0x00000000075E6000-memory.dmp
memory/4476-50-0x00000000075E0000-0x00000000075E8000-memory.dmp
memory/4476-8-0x00000000055B0000-0x0000000005616000-memory.dmp
memory/4476-18-0x0000000006410000-0x000000000645C000-memory.dmp
memory/4476-53-0x00000000077C0000-0x0000000007856000-memory.dmp
memory/4476-54-0x0000000007720000-0x0000000007742000-memory.dmp
memory/4476-55-0x00000000089D0000-0x0000000008F76000-memory.dmp
memory/4476-17-0x00000000063E0000-0x00000000063FE000-memory.dmp