Extracted

Extracted

• • Target

    MasonClient.exe

  • Size

    54KB

  • MD5

    56a042f71361ec8891669195ca679854

  • SHA1

    5662384563cdf3386b045ef65d55b4f449a8a3d3

  • SHA256

    520b70d08e7749fa9e85efaf4de701ec608bcb00c0bc8442651e8224bda87bb4

  • SHA512

    648ea50d9861d9a2ba4bb954b0835ec29f5707b008a990040b59b66880369e43b35b3a05218ceeedf1a669ac77f5cb07660a0ea796b2c7b254042451ce2b57a6

  • SSDEEP

    1536:9IaWLLWFVyziNEt9opb/yUQsAD/EbOznuy:9IxLWFVyziNEt+b/K/EbO6y

  Score

  10^/10

  xwormexecutionrattrojanpersistence

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2