General
-
Target
Marz Paid.exe
-
Size
912KB
-
Sample
240629-hlw77asgnh
-
MD5
0d05a6bb4a07037e844e3b252b5f8bc1
-
SHA1
b9d6fa8dd4b81ba6774cd8207c786556f632232e
-
SHA256
070a0a68e763ddee2edac3592a2743dd6c5159f3334118d62873e9302e5b2501
-
SHA512
140b9417b7f7c8a32c75f179600994b4e06437bf2a333954e1d6dd2660572ef9ba4264c247ffdadea8a037557774ffd63b98106ffc406d64fb6861b143d50e1c
-
SSDEEP
24576:H5ZWs+OZVEWry8ApButPfhQfvUF9ZTkYlE5xPQZAKyv6Y:ZZB1G8Eqfh5F9ZflChQgv6Y
Static task
static1
Behavioral task
behavioral1
Sample
Marz Paid.exe
Resource
win7-20231129-en
Malware Config
Extracted
xworm
5.0
might-hk.gl.at.ply.gg:42295
07x0yTqR2FSkwbSm
-
Install_directory
%ProgramData%
-
install_file
systemprocess.exe
Targets
-
-
Target
Marz Paid.exe
-
Size
912KB
-
MD5
0d05a6bb4a07037e844e3b252b5f8bc1
-
SHA1
b9d6fa8dd4b81ba6774cd8207c786556f632232e
-
SHA256
070a0a68e763ddee2edac3592a2743dd6c5159f3334118d62873e9302e5b2501
-
SHA512
140b9417b7f7c8a32c75f179600994b4e06437bf2a333954e1d6dd2660572ef9ba4264c247ffdadea8a037557774ffd63b98106ffc406d64fb6861b143d50e1c
-
SSDEEP
24576:H5ZWs+OZVEWry8ApButPfhQfvUF9ZTkYlE5xPQZAKyv6Y:ZZB1G8Eqfh5F9ZflChQgv6Y
-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-