Overview

overview

10

Static

static

7

MyMXEmYnFo.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MyMXEmYnFo.exe

  • Size

    1.7MB

  • Sample

    240525-qn96tsea6x

  • MD5

    bd6610db3448a77c382fe18a28b8c119

  • SHA1

    14698e2a813ab251599ab7cef89fb4fc712b02f2

  • SHA256

    422c9953b7601910935fa9e7fbaf8beff70f96b67eeeb5cd2b66cf80603bff2e

  • SHA512

    5bbb680726350b572f801dbd8bd92c2e44e5655bcefbdc19d9d0eaa452f6840b4a147e74d85c0b4e9001ec3236536c6dcb578fd63258ff6b9147663e1c74f25d

  • SSDEEP

    24576:LTPLnvvPrLZux4xNOUTOl54cgqQRIbaCKFqSH43wq9DmefRl:FuUeQTebabfIfye

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    wlms.exe

  • pastebin_url

    https://pastebin.com/raw/Xuc6dzua

Targets

    • Target

      MyMXEmYnFo.exe

    • Size

      1.7MB

    • MD5

      bd6610db3448a77c382fe18a28b8c119

    • SHA1

      14698e2a813ab251599ab7cef89fb4fc712b02f2

    • SHA256

      422c9953b7601910935fa9e7fbaf8beff70f96b67eeeb5cd2b66cf80603bff2e

    • SHA512

      5bbb680726350b572f801dbd8bd92c2e44e5655bcefbdc19d9d0eaa452f6840b4a147e74d85c0b4e9001ec3236536c6dcb578fd63258ff6b9147663e1c74f25d

    • SSDEEP

      24576:LTPLnvvPrLZux4xNOUTOl54cgqQRIbaCKFqSH43wq9DmefRl:FuUeQTebabfIfye

    Score
    10/10
    xwormexecutionpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks