Extracted

• • Target
    e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9.exe
  • Size 879KB
  • SHA256 e9a6e4db35c701b2b201b340328cbddbd7e8f5925b3a9ed2d41cb37f739b62f9
  • MD5 d8ffb090209a46f881579eae9d88fb47
  • SHA1 88ec3a1f4e7e187fd374f7a22f453e5b26227061
  • SHA512 bf47d25f51a6bbec5e925842ca816a51740f5ad06f5f3ce2814af6f63e363bca0d81c7d5c90303f23154cb9a6111e2d4bcd8eb1f6fa28a7a7310f154019b30df
  • SSDEEP 24576:3saLBU5wp8kow6eJACymHNW5GO+yJTzZ5:8alU5+ow6eJHyAWT+ypV5
  • TLSH
    T1A415DFD43A26E70ACD620A30AA35DEB556B40EACF401BAE39FDD3F5B74AD1505D0CB80
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2