Extracted

• • Target
    enjoy.bat
  • Size 74B
  • SHA256 d06e32f76a1ed42e68d795d825067b4bb7da2bb5daf0dffa340b506b81e4e250
  • MD5 ad0f0724fd1fe0ff93cade439ff3c314
  • SHA1 33a4ee835d6b4ccbbc1b9a141ba8afc7532599ea
  • SHA512 832670fe9acc76d4e4a7d4da9f9edbdaedfe1460f3177b00d2f83b0d157c314bc3c18197b6aba96c0ed19906718bb92d09493cce68a038c87d78ac6554fea3ef
  • TLSH
    T186A0247F40411C1C17C11F35C74FC404340400C757701001F031413504140F47004013
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • UAC bypass

    defense_evasiontrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2