Extracted

• • Target
    Contract - CB-KLS a c2 (003) - 04.08.26.js
  • Size 989KB
  • SHA256 256504f53f32ebb1c73e9b833a24991a117ea5aa307c2597abcd1e6e6cbf2d69
  • MD5 6ada6f14375931c884f9ce31349b23f7
  • SHA1 9fd0bc3240efd6bdb7479193e6148237f644efde
  • SHA512 8b9733b6a60cbe907eac1fe8e81185a0b2a61da831db84e0211876a26d7dbc9e03705ccf0f52d0f37c738f94e436e6efc85866961db49ed8a0b42bd7e53a0668
  • SSDEEP 96:ZVAEvA1hRTZ4gZdXptcAWEtEGFbMuMr2FvrqnqhIDWR6cet/KiBtxCbxj/K2ImMb:QX4g7/5t9nqnq9Zatowc0RA+
  • TLSH
    T1BC250D736AD61C4DBFF47329DC0662B49749B43E0EEE0649752CC19643A649FEE22C32
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2