Extracted

• • Target

    Runtime Broker.exe

  • Size

    72KB

  • MD5

    89af2aaffc3ddda07a0fc977c8bb2236

  • SHA1

    412bd5812599d5729a51d0350df48030b0d04e1a

  • SHA256

    637aff987be6ea158b7182de9de5de0054407077511019516270d82a6f2e9b69

  • SHA512

    8c2b26d0f1b0ae80149a2aaadef329ab7fb3495bdfbccb7f8ff60368094cd955829b2cb1217b16808ac41a223661d48c2dcf88d3daeddc6b699aa88272be75ae

  • SSDEEP

    1536:b0nLpERHZ5P56srqpbTXw3cYUo6IfI4WOyL6KqGi:bcY7P56tbTXb6IvOyyGi

  Score

  10^/10

  xwormrattrojanexecutionpersistence

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2