Extracted

• • Target
    baRK8ODy1yShnYX.exe
  • Size 2.1MB
  • SHA256 1055fe6ead94b474926c5e7818154a29898ab842b0c84923aad21b0205806dfb
  • MD5 c3c334774014b1ea14aada325f50fd53
  • SHA1 8817c577e0b8af7bb6f15051682ea00f2172ae22
  • SHA512 ff78380cad33d31add6f13a5c4847022f382cd1e4437868b3fdca6078408319bdec29175964f8b48daa3efd5f0cc288c36dbec0525dbbc326caebb5a19eac5a8
  • SSDEEP 24576:BbuYyKI3COau2qo5wSYBDbZI2cAtWH/fS3DxWOkK9M/Q5NLaxCxntIg:3JwSgH6Vn2WXWFcCx
  • TLSH
    T1C3A530D380E29DE4CEA53D3A436AC65405E603778E52E3A1CB7F06B71E26B3D69B01D4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionexploitdonutloaderxwormloaderpersistencerattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Donutloader family

    donutloader

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Possible privilege escalation attempt

    exploit

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1