"Send me a quick text"

Episode Description

XWorm 6.0 adds a hostile twist to persistence. Delivered via obfuscated VBScript, it bypasses AMSI, runs entirely in memory, and marks itself as a “critical process” that crashes your PC if you try to kill it. In this episode, we walk through the attack from delivery to defense — and why it works so well.

Technical Write-Up

Initial Access: Delivered via obfuscated VBScript, likely through social engineering. Payload concealed as reversed numeric character codes, reconstructed at runtime.

Execution: Removes Zone.Identifier ADS, launches PowerShell to download a secondary script into the TEMP folder.

Persistence: Copies itself as update.vbs into TEMP and APPDATA, adds both to Windows Run registry key. Builder also supports scheduled tasks or startup folder persistence.

AMSI Bypass: Patches clr.dll in memory, replacing “AmsiScanBuffer” with null bytes to disable AMSI memory inspection.

Payload Delivery: Downloads XWorm binary from public GitHub repository via .NET HTTP client. Loads into memory with Assembly.Load for fileless execution.

Privilege Escalation & Process Protection: With admin rights, enables SeDebugPrivilege and marks itself as a “critical process,” causing a system crash if terminated.

Anti-Analysis: Terminates on Windows XP and if IP-API lookup detects hosting or data center IP ranges.

Defensive Recommendations:

• Monitor for unusual VBScript execution, especially from email or downloads.
• Detect PowerShell downloading scripts from public repositories.
• Alert on in-memory modifications to clr.dll.
• Investigate registry Run keys pointing to TEMP or APPDATA.
• Watch for processes setting themselves as “critical.”
• Track outbound requests to IP-API or similar services.

Indicators of Compromise (IOCs) & Scripts:
All the IOCs and scripts related to this malware are available in the Netskope Threat Labs GitHub repository:
https://github.com/netskopeoss/NetskopeThreatLabsIOCs/tree/main/Malware/XWorm/IOCs/2025-07-25

Support the show

Thanks for spending a few minutes on the CyberBrief Project.

If you want to dive deeper or catch up on past episodes, head over to cyberbriefproject.buzzsprout.com.

You can also find the podcast on YouTube at youtube.com/@CyberBriefProject — I’d love to see you there.

And if you find these episodes valuable and want to support the project, you can do that here: buzzsprout.com/support

Your support means a lot.

See you in the next one, and thank you for listening.