Extracted

• • Target
    MasonClientt protected.exe
  • Size 293KB
  • SHA256 bcbf95ec324a6721f7349ad267a29f00445994fe73c9e6f21638ddb49433cc2b
  • MD5 8ffdea07e3a2297cc6bdeb98603a666c
  • SHA1 c5db66a2c5a7aba20c8eb20a850b888e90eacd9e
  • SHA512 37faa5a1180de10ba1c8116c50c789ce53f58fe809bc98300ebad368f06b4e07337a27a4b9809731ce2a70b38a57074d6b659b65b23402a78c92cb7635aba6f1
  • SSDEEP 6144:eBbPGvUMT0+iFKSLFE7tUr/5bTgVziHzZnSKrCbYMxLbQ89q:WPgUMT0+aLF8tq/5/gVziHlBrCbYp8k
  • TLSH
    T145548C67F6A000FBD4BA41358D636B02B7B2F03617219BFB1B94495D3F637A05D29BA0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoverydonutloaderxwormloaderpersistencerattrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2