xworm | 7bcdc594eb3d76d271007ac5fcc2603f03e65553b533a7c0a5d1ab89c8a6d247

Analysis

max time kernel
299s
max time network
301s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/11/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Orden de Compra - Grupo Dafrana - 02 de noviembre de 2026.vbs
Size 188KB
Sample261103-d3anasgh99
SHA256 7bcdc594eb3d76d271007ac5fcc2603f03e65553b533a7c0a5d1ab89c8a6d247
MD5 b9db8ddd496f785ef1cdeebc35b5bbd4
SHA1 d288644d204f5f806fbfa1c6429ef6bf7ff4cf54
SHA512 5eaba491a29105258407bf447d8a66ee4cb0f307edd11dcfb700084d1c2316a9e89999a1ebc7e155ff062166262387429e52a9b4dd880a929737cf592c2771cf
SSDEEP 3072:sJu8xhU80/pFWcWjQqRKAElgXNpvKxg0l39Q4j7vJ4lfUZcitdVMNvGKAuGBSov+:sJXu8apOlKAE2XNJKxg0l39QCvilfUtW
TLSH
T11014F1CA5DCC3C17E9AD191F3CFDC22147531CB2BB5874926C7862A41B280D6E7B1AE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

31.57.38.202:7007

Mutex

VPBKQGtxl8TY6xBl

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2944-27-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3472	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5924	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3472 set thread context of 2944	3472	powershell.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5064	cmd.exe
4116	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3472	powershell.exe
3472	powershell.exe
3472	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3472	powershell.exe
Token: SeDebugPrivilege	2944	RegSvcs.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5924 wrote to memory of 3472	5924	WScript.exe	89
PID 5924 wrote to memory of 5064	5924	WScript.exe	91
PID 5924 wrote to memory of 4116	5924	WScript.exe	93
PID 5924 wrote to memory of 2828	5924	WScript.exe	95
PID 5924 wrote to memory of 5516	5924	WScript.exe	97
PID 3472 wrote to memory of 2944	3472	powershell.exe	101
PID 3472 wrote to memory of 2944	3472	powershell.exe	101
PID 3472 wrote to memory of 2944	3472	powershell.exe	101
PID 3472 wrote to memory of 2944	3472	powershell.exe	101
PID 3472 wrote to memory of 2944	3472	powershell.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Orden de Compra - Grupo Dafrana - 02 de noviembre de 2026.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5924
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\qjkoiutvdw\w18685.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if not exist "C:\Users\Admin\AppData\Local\Photo Studio" mkdir "C:\Users\Admin\AppData\Local\Photo Studio"
  2⤵
  - Executes a command shell one-liner
  PID:5064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if not exist "C:\Users\Admin\AppData\Local\Photo Studio\PhotoStudio.vbs" copy /y "C:\Users\Admin\AppData\Local\Temp\Orden de Compra - Grupo Dafrana - 02 de noviembre de 2026.vbs" "C:\Users\Admin\AppData\Local\Photo Studio\PhotoStudio.vbs"
  2⤵
  - Executes a command shell one-liner
  PID:4116
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "PhotoStudioVBS" /xml "C:\Users\Admin\AppData\Local\Temp\mfp_x5898.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\mfp_x5898.xml"
  2⤵
  PID:5516

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_suoi31k1.uyc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_suoi31k1.uyc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mfp_x5898.xml

Path C:\Users\Admin\AppData\Local\Temp\mfp_x5898.xml
Size 1KB
SHA256 005d8fbbca12195937993ad50e2b06fd7898b94662a9ef2a6d1c000dac9ee443
MD5 db05b6b13205df8f3e07e2c79a3a5302
SHA1 1d37939368ae508e1444da7def9cdc50a698c589
SHA512 363256af18e47af450fc9de9042e7752f5f4f2f1251f69ab257e397d7ee1e3df797ed00193a1a6abb54da0143c519999e82070d51d72704caaef71c69527c1e4
TLSH
T1AE318C43A7FD220DF1F39F9CAAB6A41199B6FD695D28D4AD00B40A0D0971A71C9B0B37
MD5 SHA1 SHA512 TLSH

Submit Download

w18685.ps1

Path C:\Users\Admin\AppData\Local\Temp\qjkoiutvdw\w18685.ps1
Size 174KB
SHA256 3574516abc66e4cf58915d4dfc31c31de145a35fbc806918c1db98c7c9566c55
MD5 cbf62c306d06dd7c4883abd8c58c0370
SHA1 34895a3c694a1dbf372e2b52124bbeb68aa5b1e9
SHA512 d80e0c2d93aef70343bc89378576577ec90c76d61c50fafd750ef445164ed516f474387a7f3494489aa66c2f8b4f285460b5a1265cdcbc9bf0682dde51f394b1
SSDEEP 3072:DZav1GVMYVbfmJKMMSBY/sACpl87VlgXsUqWYym71QhLrobgNEEV0jNRKcFAUCt+:j+1zYzCpN8UqPQh3LvdkAUrXlR
TLSH
T1ED04D9103AFB600CB5B3BF925FE9B9E98E6FF772262AA56E1044034B4762D40CD52735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2944-28-0x0000000005270000-0x000000000530C000-memory.dmp

Download

memory/2944-27-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3472-17-0x0000000006380000-0x000000000639E000-memory.dmp

Download

memory/3472-22-0x0000000007D40000-0x00000000083BC000-memory.dmp

Download

memory/3472-8-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Download

memory/3472-7-0x0000000005C00000-0x0000000005C22000-memory.dmp

Download

memory/3472-15-0x0000000005E80000-0x00000000061DB000-memory.dmp

Download

memory/3472-2-0x0000000074752000-0x0000000074753000-memory.dmp

Download

memory/3472-18-0x00000000063A0000-0x00000000063EC000-memory.dmp

Download

memory/3472-6-0x0000000074740000-0x0000000074EFC000-memory.dmp

Download

memory/3472-20-0x0000000074740000-0x0000000074EFC000-memory.dmp

Download

memory/3472-9-0x0000000005E10000-0x0000000005E76000-memory.dmp

Download

memory/3472-23-0x0000000007490000-0x00000000074AA000-memory.dmp

Download

memory/3472-5-0x0000000005580000-0x0000000005BCA000-memory.dmp

Download

memory/3472-25-0x0000000007760000-0x000000000777A000-memory.dmp

Download

memory/3472-26-0x0000000007780000-0x0000000007788000-memory.dmp

Download

memory/3472-4-0x0000000074740000-0x0000000074EFC000-memory.dmp

Download

memory/3472-3-0x0000000002B80000-0x0000000002BB6000-memory.dmp

Download

memory/3472-30-0x0000000074740000-0x0000000074EFC000-memory.dmp

Download