Extracted

• • Target
    45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5.exe
  • Size 32.2MB
  • SHA256 45a576381409b82fb40689b7ddfa0b7ab3fe774e81d4a2da9a98435a2f2207a5
  • MD5 f509347c30d44b7056dff8021bad954d
  • SHA1 93568cab8525ed302c1bd7572eaa7baa6a13e5c5
  • SHA512 4bce2695f2a25b08a169693aa1a798e10f731f278e201b5b9a9b414810c9130e400ef26046b2ad367334b2d14b3e2c0092353c622d87099419c921521ba89ffd
  • SSDEEP 786432:6xeSR/mEXEMo+W8A1gi6etzcJDq/k+Y958KPYRphqBo+Avqz3tevF7:61R/mEXEf+NBetzcJDq/dEdQPhBiz3I
  • TLSH
    T185773369EF721D5AE8B3033D15F0C571B6B2AC506B61976F06F0AECB7A235C10E390A5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionxwormrattrojanadwarepersistenceransomwarespyware

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Stops running service(s)

    defense_evasionexecution

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2