General
-
Target
Draft BL - Bill Of Lading - PTPS01250538.scr.exe
-
Size
494KB
-
Sample
240530-w92dpshc55
-
MD5
0f2eaea796ec4d932ac2d94c61f6b60d
-
SHA1
bd5f3e5043afebcc1c08e763ab8afc0183f5b7f7
-
SHA256
e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51
-
SHA512
addee2ef8b337d2241da0a4fd02e378365e5bb998b1e7603821a91723cc0a4d7c3dee99ba2f016df227d2a5c84ef1939aa4a72dbfc595b788195cdc2025bf69c
-
SSDEEP
6144:w9BrlrV1JwKcZKGq1uNYCa8Z5gG02jjQFv5jeARhB7KW4x86H+wXCprgT5pbV+f:wbBPJwKcIfoKChzPuj7D+xUprgTn8
Static task
static1
Behavioral task
behavioral1
Sample
Draft BL - Bill Of Lading - PTPS01250538.scr.exe
Resource
win7-20240221-en
Malware Config
Extracted
xworm
104.250.180.178:7061
-
Install_directory
%AppData%
-
install_file
XClient.exe
Targets
-
-
Target
Draft BL - Bill Of Lading - PTPS01250538.scr.exe
-
Size
494KB
-
MD5
0f2eaea796ec4d932ac2d94c61f6b60d
-
SHA1
bd5f3e5043afebcc1c08e763ab8afc0183f5b7f7
-
SHA256
e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51
-
SHA512
addee2ef8b337d2241da0a4fd02e378365e5bb998b1e7603821a91723cc0a4d7c3dee99ba2f016df227d2a5c84ef1939aa4a72dbfc595b788195cdc2025bf69c
-
SSDEEP
6144:w9BrlrV1JwKcZKGq1uNYCa8Z5gG02jjQFv5jeARhB7KW4x86H+wXCprgT5pbV+f:wbBPJwKcIfoKChzPuj7D+xUprgTn8
-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-