Extracted

• • Target
    Payment_1.TXT190526.pdf.PNG
  • Size 895KB
  • SHA256 515d1070878b9409f3195f47e4e5dd4fb03bba2a80b78d820871a1acf996793b
  • MD5 2eefac6196c3520c4b27d472d6b9e671
  • SHA1 73a95ca6c230b59ce9664a94817081c1f9aa09a7
  • SHA512 610ce23ebc614db885981ce61884114b34310e257ce18d66c4565788a45164261711e88ca124196f0ca1a93b7d91d60437a7cf820e95317574c372e345cc2fa0
  • SSDEEP 12288:Il7ekhixCjZVl3mi09rTwxfc2rhtWJLZacFpHllMmJ36Cw11lLgh4+j3LceRR+io:CjZvo9rQkQ2vVl3iniZbcQR+io
  • TLSH
    T1BF15F11833A9E906D8645BB85D31F3F50FB56ECAA961D3039EE6BEEBB4357045C04283
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2