Extracted

• • Target
    audiodg.exe
  • Size 79KB
  • SHA256 342464c90406cb937498894e93c57b80c42a86365223f30681bfbe795e263867
  • MD5 3076b84735371091afdd12015d5a5d24
  • SHA1 8d77b1ec047693096fe27f72592993d2eef6ae72
  • SHA512 d2a0c0722f648dff5c23cd7cc5365e5671771aad00b9adcca3bff84adf6f7eb0b81ff865c11b3eeab7f90ab9cbc87d53e22fe9dde38bb3a26001554b405849ca
  • SSDEEP 1536:MbfjSGN00tgP4qUlIWC8ROQFN0ibWeDA1P6aID/COFMcmYzBy5Z:BGN0z4rIWC8R1FNfbWpdOFMcmYzByf
  • TLSH
    T142837C583BEA4926E1FFAFB05DE27162C676F2135D03D65F24C8029B1523AC9CE806F5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1