General
- Target _68af66991e125976da13a5f0ea7bb2c47c255ec742e848064a9486302bd9babe.exe
- Size 801KB
- Sample260604-gfdcfsbs9r
- SHA256 68af66991e125976da13a5f0ea7bb2c47c255ec742e848064a9486302bd9babe
Malware Config
Targets
-
- Target _68af66991e125976da13a5f0ea7bb2c47c255ec742e848064a9486302bd9babe.exe
- Size 801KB
- SHA256 68af66991e125976da13a5f0ea7bb2c47c255ec742e848064a9486302bd9babe
Score10/10Detect Xworm Payload
Family: Xworm
Xworm is a remote access trojan written in C#.
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
NirSoft MailPassView
Password recovery tool for various email clients
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses Microsoft Outlook accounts
Accesses Microsoft Outlook profiles
Adds Run key to start application
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2