Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
09/10/2026, 15:00
General
- Target Orden de compra_93938387.js
- Size 285KB
- Sample261009-sdkjjay16q
- SHA256 1169f4fe3eea997dfd820ef78c1bb0acea3398fb3bd062beac21d3882691f9b0
Malware Config
Extracted
-
xworm
-
5.0
-
203.202.232.254:1122
-
oM38H86nW2afasqD
-
Install_directory
%AppData%
-
install_file
XWormClient.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Orden de compra_93938387.js"1⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoPr -NonI -WindowStyle Hidden -C "[scriptblock]::Create([IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\48497.ps1')).Invoke()"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Adds Run key to start application
- Enumerates video capture drivers
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'MSBuild.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XWormClient.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormClient.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_592c8a93fa6949cf8308ed342570bfea.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF008.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5806A1875EB949AE8343B13D454E9C43.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" 35203⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\XWormClient.exeC:\Users\Admin\AppData\Roaming\XWormClient.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
48497.ps1
MSBuild.exe
RESF008.tmp
__PSScriptPolicyTest_m13h4pa5.war.ps1
XWormClient.exe
CSC5806A1875EB949AE8343B13D454E9C43.TMP
guardian_src_592c8a93fa6949cf8308ed342570bfea.cs
memory/1564-81-0x0000000006230000-0x0000000006584000-memory.dmp
memory/1564-90-0x00000000705E0000-0x000000007062C000-memory.dmp
memory/1756-123-0x0000000002310000-0x000000000232A000-memory.dmp
memory/1756-124-0x0000000004AC0000-0x0000000004C1A000-memory.dmp
memory/1756-122-0x00000000000B0000-0x00000000000F0000-memory.dmp
memory/2464-77-0x0000000007A40000-0x0000000007AE3000-memory.dmp
memory/2464-79-0x0000000007D40000-0x0000000007D54000-memory.dmp
memory/2464-78-0x0000000007D20000-0x0000000007D31000-memory.dmp
memory/2464-66-0x00000000062B0000-0x0000000006604000-memory.dmp
memory/2464-68-0x0000000006D20000-0x0000000006D6C000-memory.dmp
memory/2464-69-0x00000000705E0000-0x000000007062C000-memory.dmp
memory/2788-17-0x0000000006850000-0x000000000686E000-memory.dmp
memory/2788-24-0x0000000003350000-0x0000000003360000-memory.dmp
memory/2788-23-0x0000000007AA0000-0x0000000007AA8000-memory.dmp
memory/2788-22-0x0000000007A60000-0x0000000007A7A000-memory.dmp
memory/2788-2-0x0000000003350000-0x0000000003360000-memory.dmp
memory/2788-21-0x0000000006E40000-0x0000000006E5A000-memory.dmp
memory/2788-20-0x00000000080E0000-0x000000000875A000-memory.dmp
memory/2788-18-0x0000000006900000-0x000000000694C000-memory.dmp
memory/2788-16-0x0000000006350000-0x00000000066A4000-memory.dmp
memory/2788-7-0x0000000005A40000-0x0000000005AA6000-memory.dmp
memory/2788-8-0x0000000006140000-0x00000000061A6000-memory.dmp
memory/2788-6-0x00000000058A0000-0x00000000058C2000-memory.dmp
memory/2788-5-0x0000000005B10000-0x0000000006138000-memory.dmp
memory/2788-4-0x0000000003350000-0x0000000003360000-memory.dmp
memory/2788-3-0x0000000003200000-0x0000000003236000-memory.dmp
memory/2856-107-0x00000000705E0000-0x000000007062C000-memory.dmp
memory/3520-118-0x0000000005C90000-0x0000000005D22000-memory.dmp
memory/3520-25-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3520-26-0x0000000004F00000-0x0000000004F9C000-memory.dmp
memory/3520-128-0x0000000006FC0000-0x0000000006FC6000-memory.dmp
memory/3520-127-0x0000000006F80000-0x0000000006FB4000-memory.dmp
memory/3520-126-0x0000000006EF0000-0x0000000006F6C000-memory.dmp
memory/3520-119-0x0000000005C80000-0x0000000005C8A000-memory.dmp
memory/3520-117-0x0000000006140000-0x00000000066E4000-memory.dmp
memory/4784-52-0x0000000007290000-0x0000000007326000-memory.dmp
memory/4784-53-0x0000000007200000-0x0000000007211000-memory.dmp
memory/4784-50-0x0000000006EC0000-0x0000000006F63000-memory.dmp
memory/4784-49-0x0000000006290000-0x00000000062AE000-memory.dmp
memory/4784-40-0x0000000006E80000-0x0000000006EB2000-memory.dmp
memory/4784-41-0x0000000070620000-0x000000007066C000-memory.dmp
memory/4784-57-0x0000000007280000-0x0000000007288000-memory.dmp
memory/4784-51-0x0000000007080000-0x000000000708A000-memory.dmp
memory/4784-54-0x0000000007240000-0x000000000724E000-memory.dmp
memory/4784-39-0x0000000005E00000-0x0000000005E4C000-memory.dmp
memory/4784-37-0x00000000057F0000-0x0000000005B44000-memory.dmp
memory/4784-55-0x0000000007250000-0x0000000007264000-memory.dmp
memory/4784-56-0x0000000007330000-0x000000000734A000-memory.dmp
memory/5052-140-0x0000000000F10000-0x0000000000F18000-memory.dmp