Extracted

• • Target
    MT304_SWIFT_Message_Review_Request_.exe
  • Size 754KB
  • SHA256 57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2
  • MD5 6ff3cc67b35a5caed0468ea9352506e9
  • SHA1 e1de54b8f46e5c4fa38052f0cf5891e7d35549a9
  • SHA512 20142dbad5fc1bdd642ee64dee3cd9742d5c7f81a8d801f152850f64be1bf8e1bb6b2b575bc578ca4b89096cc6b9ebf19615018690e65bbe79140708cb2f66fa
  • SSDEEP 12288:Ruo+0HjJ35LZ6LxWq76MSlNl5tuinL5CiPAwq4r/QGmuQv4lRl4e:Io+qz6LoqIlNHtu0VfP1q4r/QNv4Ll
  • TLSH
    T116F412687726FE52C9AD4B750A77E33413A59E5DE111C327CBEE9DEF3C20245AC08682
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2