Extracted

• • Target
    fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe
  • Size 781KB
  • SHA256 fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9
  • MD5 538860d455edc8108e667b8498a41fe3
  • SHA1 6bbb36dc96230667e363d62881a6166ec67b8a89
  • SHA512 1f1dcc9932f2f0890ddce2eddad00367295a28ffbf5d8e6b1241491dc7f30afb7be7607f9254d41d89eca4af26c392825e1c8f07ee9824d2750261f1711d2be0
  • SSDEEP 24576:NJa6UwvkxSxczIGoHh4mSKDVa5dw8PJr:3a69Mbzi45dwCr
  • TLSH
    T114050229125ED807D4625FB00F72D67883746FC9A521D213CFEDBE9FB677AA02904392
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2