Extracted

• • Target

    2020-27-0x0000000000090000-0x00000000004F4000-memory.dmp

  • Size

    4.4MB

  • MD5

    e500dc0d6ef72a15e5516119b56f3fa0

  • SHA1

    bbe899ea446be67a253ec8abf99109a31e620e96

  • SHA256

    6ff325bc3409ebbd1e08368acb0957010b45adcdfe37e2f69b359cf32f743320

  • SHA512

    d3f239e549d4ef0930cab61b5d5a7e2d6be40b099266c44594a091c2acc4acc6141b9c824ec19e706115a8f749e99a795795fd37a7d3bcc3ed710a43f8429989

  • SSDEEP

    24576:Q2zRkYu1/A2/K6eVhA0mq7301+S45EcnlqZBU6jWUS+QoaAl4IZBLQyhvAYtkEwQ:QQRkYu1/A2C6U01qE4qDZB2gXIfw8cl

  Score

  10^/10

  xwormexecutionpersistenceratthemidatrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence
  behavioral1behavioral2