Extracted

• • Target
    5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a.exe
  • Size 712KB
  • SHA256 5b1467f15f0977feb69d11ed6e05524294237c6db0f73187eab43d640a1dc84a
  • MD5 a7c87913f2ed0c8e17525cf94d4556b1
  • SHA1 df32c8c1632504de7701cb0fda53ec9aea74642d
  • SHA512 84c57c76a9c5885f556854a5a86305313b108e58f676cf2165faee9f6114a251ca8e1cd44f841a0d82db3c5e684cd314c66a3cab315c6d0c1bafbe226931175e
  • SSDEEP 12288:Fx2iNNeRPA6/OxTB09BBR8mHOFidDtS8wgeO4Pe+hU2KrGuLPXXW2gBBkR:Fx1n+NYTi9BX8mrRZwvPHiXrnPNgBc
  • TLSH
    T16DF412A75A19CB43D9E18BF12E73D73147B86D9DE450D35B8EEA5DCF3810714A80822B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojanadwareransomwarespyware

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2