Extracted

Extracted

• • Target
    Draft In.TXTes_26.PNG
  • Size 906KB
  • SHA256 cbee3f506413a343b475036fba2a14ee6051855bc0349b9750fa996ca98a2310
  • MD5 e7b5fd293670f7d1e2c4403ad4d77d31
  • SHA1 4b7cf169d84574f56de2a2c95a8e0d353b9e0215
  • SHA512 9d0503884fa1ba8d4395ee6a3a0905b744f2b018ac5f83abd4d0e3b8c2edd0c6b8da79a366958f8b94b53c3c7077ddc19b1dd1991a4280426cea16320fdd4d85
  • SSDEEP 768:fpNd+NojvFWFxqwxcE82aZYGmbNtjlU9CqwpOgWVB8jhcuzIJTgiyc661/ppymJt:TAsz
  • TLSH
    T1C615A6F278E135FF742EA9D46C11CD9B6279A8B49F72C8BF28C139C406C994797440BA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2