Overview

overview

10

Static

static

3

Outpdsaut.exe

windows10-2004-x64

Outpdsaut.exe

windows11-21h2-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    Outpdsaut.exe

  • Size

    60.5MB

  • Sample

    240504-pyzmeahb38

  • MD5

    a81db6baae418498efad231a602e95e0

  • SHA1

    9381ede78e644f16fd1126f08c129d27f627ac73

  • SHA256

    670a60509510a9632c21f2f8d1f9262f9f74a37d8eb5aa2b8437107c2bb5067f

  • SHA512

    eccc2502b53b55b125d59b2d986f365ef099269e55194d51e91020202efa3ff381c01afe13ed0cfb5490b325ad302cbb5f7ac49d74ab1b61f07d6d4c2fd914ac

  • SSDEEP

    1572864:XqQgZKg6Y6NnbqKCjZaJ1khXbzKuLyt8zVf3kYkMt2XRq:XqFgpHqLye13pkMsc

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Targets

    • Target

      Outpdsaut.exe

    • Size

      60.5MB

    • MD5

      a81db6baae418498efad231a602e95e0

    • SHA1

      9381ede78e644f16fd1126f08c129d27f627ac73

    • SHA256

      670a60509510a9632c21f2f8d1f9262f9f74a37d8eb5aa2b8437107c2bb5067f

    • SHA512

      eccc2502b53b55b125d59b2d986f365ef099269e55194d51e91020202efa3ff381c01afe13ed0cfb5490b325ad302cbb5f7ac49d74ab1b61f07d6d4c2fd914ac

    • SSDEEP

      1572864:XqQgZKg6Y6NnbqKCjZaJ1khXbzKuLyt8zVf3kYkMt2XRq:XqFgpHqLye13pkMsc

    Score
    10/10
    xwormexecutionpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks