Extracted

• • Target

    SystemSettings.exe

  • Size

    332KB

  • MD5

    701a94f53d54d38a11f4e60bc4f95b18

  • SHA1

    7413f5e4fc73eaf07d9d6cd67fc88fd40b70d9d0

  • SHA256

    9233d5872258aa674b015b57a4f37ca43a22524a682382cd88969cef135dacdb

  • SHA512

    4d63f155adbc5271fc82a263c4df29566ffbabb512ad2a7c73736969b29760bc0ae86e58f396907b8afa8791e8a8b042c895f94126a00da8c0b050e7ef343440

  • SSDEEP

    6144:6qXq7egSKNNO3BLZsgd8+f0Pn95maRWFjt:6qapSKNNOpZsgdQbmamjt

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2