Extracted

Extracted

• • Target

    MasonClient (2).exe

  • Size

    50KB

  • MD5

    8e1315e3fbb888c3406329c129c72fe1

  • SHA1

    fafc443d666b5de904bd53b44098a68cbb40cd6f

  • SHA256

    be843c7232855df03d15657ef49ba3acff09ded0016497246c26612490985adb

  • SHA512

    c3bbdc8a739b01a4ecb96e132fcf771943269111dfda92c1071a85843a72813a66e121f3e7bd7273fbd6710c096891ef83b420b111292569059b4b8b8532ed45

  • SSDEEP

    1536:GAI1lAKBCVVD489e6IvFbCCN5HGl/IbO4uI:hI1lAKBCrDJI9bCy5+/IbOJI

  Score

  10^/10

  xwormexecutionrattrojanpersistence

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2