Extracted

Extracted

• • Target

    mmc.exe

  • Size

    310KB

  • MD5

    a06f0a8a88646808591565846d009f39

  • SHA1

    8afe7126b8575d99d0570267e41aa78ee94f3bdc

  • SHA256

    23bdba30edb09f2803c16726a4a81bdf71d441086ac962ce637ab1076439bacc

  • SHA512

    dff6e7edd754192a0d8437a94a8a5b1ee8f36df79596915e03f75a347be6397e111027a1b014307422cbc2229cfc5692e8cd69a28e7875166ba4c07a2f824152

  • SSDEEP

    6144:JyH7xOc6H5c6HcT66vlmmOguKV5BwUnZqazMhD9RLJt88sndcP8pPyDvUGOkswbo:Ja6KLBwiZlzMB9xgndcP88DvvP4fHiX6

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2