Extracted

Extracted

• • Target

    [email protected]

  • Size

    496KB

  • MD5

    ca43984bc9574b8f5af508c4f48d8dd5

  • SHA1

    0737a7a9ef6926c14da0d36f3a5212b93c6873a8

  • SHA256

    6cadc3f6fb39a43ba42a2f4039582c0821bca45ab9cf8ac6e44287f9862aca3f

  • SHA512

    b0e97b13a1683af914b5e395df94ea9d06ef4f5d155cb7fbfff8d4f8f8a1f5ef3b510d5dcee07ecf0d403490b33c1e6c47f9acfcf9469b6f9c72360cf7ae3769

  • SSDEEP

    12288:QXIKvF8VExLMgUR1YvgpC/H/u022/ZN0JVtgUb48td7J:c8VkLMTBYHu022hN0f11td7J

  Score

  10^/10

  gurcuxwormdefense_evasiondiscoveryevasionexecutionpersistenceransomwareratstealertrojan

  • Detect Xworm Payload

  • Gurcu family

    gurcu

  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence

    remove IFEO.

    defense_evasion

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1