Extracted

• • Target
    45555Signed.exe
  • Size 31.9MB
  • SHA256 6692528a6c729a2aa97595e617b43caa810f99cffad3f4f645a18645319e76a8
  • MD5 8c74ee849f9171a8c35523feb74cca93
  • SHA1 dbe4a0f1e8e5331bfd1499c4b4895c057c24593d
  • SHA512 585678b09b12c3a50aa95e047d03665a9b10c419b735dc0a0ddbb71ddf594957cd6822a7f68e21553f3350cabb0e444132e073d70bfe4584f37493fa9f17921a
  • SSDEEP 786432:d20iVJ9IWINhhpQBJH3RDq/k+e58KPYRphqBo+Avqz3tevF7:d2NVLIWY3kJXRDq/dKdQPhBiz3I
  • TLSH
    T1127733A49BB1A995F9E7053505B44B02E67274952F51EBAF07F0214E2F3B8D00F3A3B9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionxwormrattrojanadwarepersistencespyware

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Stops running service(s)

    defense_evasionexecution

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2