Extracted

• • Target
    133b106fa34ec8d599211f4ceb049eceb4f750f504f8e8d09df546bb65e390d8.exe
  • Size 731KB
  • SHA256 133b106fa34ec8d599211f4ceb049eceb4f750f504f8e8d09df546bb65e390d8
  • MD5 d21b04c9be144635b1beec0360ab90fe
  • SHA1 a2e3092c906f1fe94ca4cb607adb43ae7a2fbeb3
  • SHA512 79b3d0b65da25ed5936581d33e79d125bcb05330730a5a9314e6309f62124327aba53b15f80c3238aa610cebfe80b0c8e11d0346b360d739f9fe6ba5b06549c2
  • SSDEEP 12288:WlJdbwKcct8dfXaCiCWUeoCWzahUk8Mb+bwS3v8JQm+BbRjPufmB:W5WfXaCiCTtuhUkxS3vaQmJ
  • TLSH
    T176F4125C7A46ED07CD1123B51EA2F375176D2DD9BC00D327AFE9ADFBB962A084C14282
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryevasionexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2