Extracted

Extracted

• • Target

    MasonClient.exe

  • Size

    50KB

  • MD5

    b3764ad5be75af9e28fa4d68a5375481

  • SHA1

    786817e5231040cfa17d943070954d0ece9df7e7

  • SHA256

    e1ad2a54762c18ab7dad710a0518806eb2371e773768d5e68ebe104d17681707

  • SHA512

    e1552b6a85dc3020655a23c705ebce17be2ffa7a2fe1328c535a643bfc9315ad9ce31932edad6d0f1804082afa3164580771b20fd490f770cd11c8a079a52586

  • SSDEEP

    768:WDdIS0QryMZEijZ+3LaXBEp98WBu/h5bX2PfnjLMgt/X6slBs8hJOPI9zuR:2dItQrOit+3mREYbXmbLf/PbOauR

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1