Extracted

• • Target
    555C2Hiding.exe
  • Size 31.9MB
  • SHA256 ecab8aceff3e5c33ffb036bcaf22d2cdff5f327238a50eb1ad2a83fd274810c3
  • MD5 f6cdb513cb815e01f74867354547aa8f
  • SHA1 86d850670635cdb6c0373892db4390af849d2593
  • SHA512 16a00952c153fadffca37bf7f6f2202b71c4808a49ff7aeb6cc3992a7e689e64a91e7f4a97c8edac32f137609e9bfcc3c2c02df290a04948372c377e641392c7
  • SSDEEP 786432:9yegbQ3WykO3kK3KCUkwtDq/k+pn31k58KPYRphqBo+Avqz3tevF7:9yeIQjkZhkqDq/dpn31IdQPhBiz3I
  • TLSH
    T11577335DBFD166A3E9E71238B2B0CA11767060C51F6986AF07F012193A375E10E7F1AE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Stops running service(s)

    defense_evasionexecution

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2