Extracted

• • Target
    d7adcdad2dc0743c188db7314028ce74827a81fc3eee6b38bf9d0e9f57c7f222.exe
  • Size 859KB
  • SHA256 d7adcdad2dc0743c188db7314028ce74827a81fc3eee6b38bf9d0e9f57c7f222
  • MD5 c4351c6836b055524d68ea1bf2c5428a
  • SHA1 8623a5639f03c503a915f9e4c1f08f257ed1c360
  • SHA512 efa5bcf413f43599d2e59114900b4f9d1e844b52a75e9b9488fcc01c2b7ee627e0542576218514da952081275c0b92936a1e30473ec964e8d336d06c1dc94199
  • SSDEEP 24576:LZ7U3FmSxIdrLH8crZZyV5jUTNz9U64EbzQTd:do3FIrb8aZZe5UNdcTd
  • TLSH
    T13A1512246A49CC05D4D60B759460E37D53F2BE6DE432C31A8FECAF9B3A677016908BE1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryevasionexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2