Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
04/11/2026, 17:23
General
- Target REITERACION CIRCULAR No. 019 de 2026_ACCION DE TUTELA RADICADO 54-001-4003.js
- Size 11.0MB
- Sample261104-vx83caes5l
- SHA256 a20ef710a2d61251ca82f2fab4963cba51da53caea0587f36d363624605f930d
Malware Config
Extracted
-
xworm
-
5.0
-
109.120.139.126:3009
-
xXaTaJNJAUhii9jF
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\REITERACION CIRCULAR No. 019 de 2026_ACCION DE TUTELA RADICADO 54-001-4003.js"1⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\637e58f2.ps1"1⤵
- Process spawned unexpected child process
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵
- Enumerates video capture drivers
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_yev255qg.kxl.ps1
637e58f2.ps1
memory/3664-30-0x0000000006A80000-0x0000000006B12000-memory.dmp
memory/3664-29-0x0000000005000000-0x0000000005010000-memory.dmp
memory/3664-28-0x0000000005000000-0x0000000005010000-memory.dmp
memory/3664-24-0x00000000050F0000-0x000000000518C000-memory.dmp
memory/3664-21-0x00000000002F0000-0x00000000002FE000-memory.dmp
memory/5020-6-0x0000000005D80000-0x0000000005DE6000-memory.dmp
memory/5020-20-0x0000000007390000-0x00000000073AA000-memory.dmp
memory/5020-15-0x00000000063F0000-0x000000000640E000-memory.dmp
memory/5020-16-0x0000000006420000-0x000000000646C000-memory.dmp
memory/5020-7-0x0000000005DF0000-0x0000000005E56000-memory.dmp
memory/5020-18-0x0000000006810000-0x000000000681A000-memory.dmp
memory/5020-19-0x0000000007BC0000-0x000000000823A000-memory.dmp
memory/5020-14-0x0000000006010000-0x0000000006367000-memory.dmp
memory/5020-1-0x0000000005110000-0x0000000005120000-memory.dmp
memory/5020-22-0x0000000007740000-0x00000000077D6000-memory.dmp
memory/5020-23-0x0000000007410000-0x0000000007432000-memory.dmp
memory/5020-5-0x0000000005650000-0x0000000005672000-memory.dmp
memory/5020-25-0x00000000087F0000-0x0000000008D96000-memory.dmp
memory/5020-4-0x0000000005750000-0x0000000005D7A000-memory.dmp
memory/5020-3-0x0000000005110000-0x0000000005120000-memory.dmp
memory/5020-2-0x0000000004F60000-0x0000000004F96000-memory.dmp