Extracted

• • Target
    Quote Request.exe
  • Size 812KB
  • SHA256 fe1e3f38e6bd2ec3cfcacc946a22c8d8212f083c8165cb3caa9ae301c25332ff
  • MD5 fc80da6fac6d35bea5d9fe676acca41a
  • SHA1 17bde51184e484f3c3e7444f051bee780e934282
  • SHA512 6002a0d4ccdfb2fc0a265395b42a93bd36fc69acaf5c151f2d29954e8f1b1238a75d5da2ac4a36df55b5904337e6e46c5e32518486eb1e544d567b7b3a9d2d1f
  • SSDEEP 12288:U9DF2lPII1jGETNpQMxGa7z89NF7AJ5v12wvClngSxQnUvmMBjn:U9xsV1jJoLughAOLvmMBjn
  • TLSH
    T14F05B53867F8695CF9F37B709AB891529B3EBB63D937C64E0224014F05B1982CD617B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2