Extracted

• • Target
    Order samples and Drawings.vbs
  • Size 2.4MB
  • SHA256 679ce9eb3e1bdba8ed58fa53690ae879ce50679be97fbc41e85cbb6a88bbeb0a
  • MD5 2d12c77e5dd4ede8bcadb82e04124df5
  • SHA1 951c56cdc505e779d3bc341019310a31987a7a1e
  • SHA512 62cf356a61fcd34dfc5efd6fbd29e550660bd8390396093f9daf2c668b83afa14f0ffd7bba8eac6573ab8653d335575f2524ba5ac19a8a9261208eb0a0ca2d55
  • SSDEEP 192:28Wi5YS9jZSibKNzCu5AfP5O/61S+qFP/EMyu3E4EFPQIOXfnkAFF24b8R7IllrF:28BfK/z+u
  • TLSH
    T1B2C52A8D2D5B2148462002B0BC992DC5C65BEFD54EA5B3A37B1CEC9A65438C2FF84F97
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2