Extracted

Extracted

• • Target

    MasonClient.exe

  • Size

    50KB

  • MD5

    7eecbfee976f4b6944cce2362d532266

  • SHA1

    5996357ec345f0feeb14bd79f54392cc3075cb59

  • SHA256

    33390c4e76ef805c8f426b64803265cffacb3e5b49c2fe44eecb6e125e8dcd23

  • SHA512

    cb7c952963d14efd16f6752d49481072218d67fcd6decfb43fa000fe139bcb7a22e62087613fad021c83ad0867937db24d70b54eaed9b8321f087494ea39a97f

  • SSDEEP

    768:BIXLzBU97JP7LzxqMIEmOVjWjlbQ0eiVQGit/X6DlvuhJOWCAzuV:BIbzq91P73E3ESBbQ0ex/hbOW5uV

  Score

  10^/10

  xwormexecutionrattrojanpersistence

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2