donutloader | ab171ff8324507f4f9fcb23b99969e0dfc037ffb09204535a9c328a199dcfaed

General

Target
XWormClient.exe
Size 98KB
Sample261009-2falsac12l
SHA256 ab171ff8324507f4f9fcb23b99969e0dfc037ffb09204535a9c328a199dcfaed
MD5 6f5910df5cb05fbd288f8161071a75f0
SHA1 0a2395569b3bfd4bbc6c1f44b57aeb506f922be2
SHA512 b282b546ca2983fc05582f27860e5b3dc6899a648872deb51991b263ba780b20e78efbd12ee471b784c6d8f25e94bb36c63f76412d7a970b7deda922d8b6ccb7
SSDEEP 1536:PkucAdOf+1LBH18HPMiQI8lMwJxvOt/DVki4KEiv9FFAcbp5fA9:MtA8UiQxH4taizTbp5fI
TLSH
T1C8A36C4EF740DDA8D12D0E37CA67A08882EAD4776627FB7F25D81DF14D2188C498F5A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  XWormClient.exe
- Size 98KB
- SHA256 ab171ff8324507f4f9fcb23b99969e0dfc037ffb09204535a9c328a199dcfaed
- MD5 6f5910df5cb05fbd288f8161071a75f0
- SHA1 0a2395569b3bfd4bbc6c1f44b57aeb506f922be2
- SHA512 b282b546ca2983fc05582f27860e5b3dc6899a648872deb51991b263ba780b20e78efbd12ee471b784c6d8f25e94bb36c63f76412d7a970b7deda922d8b6ccb7
- SSDEEP 1536:PkucAdOf+1LBH18HPMiQI8lMwJxvOt/DVki4KEiv9FFAcbp5fA9:MtA8UiQxH4taizTbp5fI
- TLSH
  T1C8A36C4EF740DDA8D12D0E37CA67A08882EAD4776627FB7F25D81DF14D2188C498F5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery execution exploit donutloader xworm loader persistence privilege_escalation ransomware rat spyware trojan
- Detect Xworm Payload
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of SetThreadContext
behavioral1