Extracted

• • Target
    68075d0235b433a37fd896eb7b2a2e385cd5c65c34e6b2d0a1f913608d53f454.exe
  • Size 374KB
  • SHA256 68075d0235b433a37fd896eb7b2a2e385cd5c65c34e6b2d0a1f913608d53f454
  • MD5 67ecfdc72066ed3e3f7d4c83077eb920
  • SHA1 f65630bd94ed4a6f7150d038b8593e9b51a1d02b
  • SHA512 3fb016ab0ae644537f542aacc27e701fd46500ec7196e51eb86ff2132046bb9c6e43fc538986f7f32224425730243fedad4322a82107126f8863eb9aa65bf7a5
  • SSDEEP 6144:XT4DtYa/h305o9fgqMUuBQWYmETquqsP7ook3FHPGavEhIWjxKouGuzz87:XT+Vso4DUoQFmETbqsEoEhPh8luGB
  • TLSH
    T15384F13D2FACD25AEE720F355CE6F335856C9EA46D518B8B770839297E30F809C49219
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
  • MD5 6e55a6e7c3fdbd244042eb15cb1ec739
  • SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
  • SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
  • SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
  • TLSH
    T1BE428D1193B089F2F590593805A67F2A6FBEAC5C27E44A63CFE345853D702DFA47A243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4