Extracted

• • Target
    HF1W1Z5K
  • Size 2.5MB
  • SHA256 b6a12153debaab5e97179235e3f242aeed695db8a4a3f78f559f31bc6a0616c2
  • MD5 a95bedb18b9c2d7121b7763c4e7fcac8
  • SHA1 ffb94060dc16d00cfe958bebb4212e3cfa99d829
  • SHA512 e28b2b63a4bdb2e99fb90a1a9a7347ec89e17c0438b6adcec3868f27912154a476ea0aa88a1894d4121950fd1b6c7e6d159ec7c4533dfae00c652bf3c2f17645
  • SSDEEP 1536:ZXOGuF2TsuDyH/na7NttOMHzo6YcD15UXl2UAmeFNIMHOxEw6+S/JTVSu+0u5DX8:D
  • TLSH
    T183C528E016AF265A2057984A9032E111E0E3CFD7D5B289F1B997083B06DFCC5EE6B735
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojandefense_evasionspywarestealer

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2