Extracted

• • Target
    122Evasion.exe
  • Size 31.9MB
  • SHA256 e09f1523a9711952a134d5781b2f66c75fbfada40b61e08c287c57975a8c4535
  • MD5 27e3b74d0d48e7050fe8678b20f6c941
  • SHA1 45b9a5f5260cf01ded11f2d8967beb7c7f154c95
  • SHA512 7b71fcaee69e72365bf87dc30de9ec84720b48bd01bda88ab004e0ab143a24aa2ef80967a49996d115f4ea167a5ca2db2d05fefd3661b1a3acb6e09832cfb02c
  • SSDEEP 786432:fCha5aG+964h286nG4GDq/k+u58KPYRphqBo+Avqz3tevF7:fCha5Ik4cDnfGDq/d6dQPhBiz3I
  • TLSH
    T1ED7733BDAB8265FAD897453062F1CB22717091953F89B1EF07E016266D73AD00D3A2BD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Stops running service(s)

    defense_evasionexecution

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2