Extracted

• • Target
    Runtime.exe
  • Size 37KB
  • SHA256 c09ba27f60260aba9653eed7e1128f6c4ea0489bc1aace353f22f9b0e2c7bc59
  • MD5 0139c21259cbc0b6f7a31b04d69c9b6d
  • SHA1 40882992d26e6275f52b6cf321595f7c5e1469f0
  • SHA512 4fd4307e0009ba67cddd7d5e10d63fb372f017e148295146170f151de50660233287c11f36176692ed5a36c35287e07afdb0f6e8b95002433e6ddaae2f0d8917
  • SSDEEP 384:+jSXe516/6aDUSEoSLF63LZOTu3H2Cq9WGeKZWFE25DpkFyHBLTp9iZwdJzVvNba:C1SU493kQGeKQNcFyz96q6pOjh9y7
  • TLSH
    T193035D48B7A4471AC5FEAFB45EB2654A4634F707D913EB9E0CE584CB2727AC0CE10392
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral1behavioral2