General

  • Target

    Draft BL - Bill Of Lading - PTPS01250538.scr.exe

  • Size

    494KB

  • Sample

    240530-w92dpshc55

  • MD5

    0f2eaea796ec4d932ac2d94c61f6b60d

  • SHA1

    bd5f3e5043afebcc1c08e763ab8afc0183f5b7f7

  • SHA256

    e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51

  • SHA512

    addee2ef8b337d2241da0a4fd02e378365e5bb998b1e7603821a91723cc0a4d7c3dee99ba2f016df227d2a5c84ef1939aa4a72dbfc595b788195cdc2025bf69c

  • SSDEEP

    6144:w9BrlrV1JwKcZKGq1uNYCa8Z5gG02jjQFv5jeARhB7KW4x86H+wXCprgT5pbV+f:wbBPJwKcIfoKChzPuj7D+xUprgTn8

Malware Config

Extracted

Family

xworm

C2

104.250.180.178:7061

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Targets

    • Target

      Draft BL - Bill Of Lading - PTPS01250538.scr.exe

    • Size

      494KB

    • MD5

      0f2eaea796ec4d932ac2d94c61f6b60d

    • SHA1

      bd5f3e5043afebcc1c08e763ab8afc0183f5b7f7

    • SHA256

      e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51

    • SHA512

      addee2ef8b337d2241da0a4fd02e378365e5bb998b1e7603821a91723cc0a4d7c3dee99ba2f016df227d2a5c84ef1939aa4a72dbfc595b788195cdc2025bf69c

    • SSDEEP

      6144:w9BrlrV1JwKcZKGq1uNYCa8Z5gG02jjQFv5jeARhB7KW4x86H+wXCprgT5pbV+f:wbBPJwKcIfoKChzPuj7D+xUprgTn8

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks