Extracted

• • Target
    9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe
  • Size 727KB
  • SHA256 9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264
  • MD5 12236c7e2d7acd537eec932ffc042da2
  • SHA1 9dce57fca6edadb4f1bdcfe9c96bbfd9d89e432d
  • SHA512 bf84cfc9cd11f9d67f28e41921a5d76747020b37f9120296d0b9e1f2b1a16d9d447b0ff104d48d125d7e13892c70be538effdd0c1b9f74bebb5bf153c95340da
  • SSDEEP 12288:DlJdbv0EcfJGtMQ8YMtkJf89E6OuoQ4P2dHGzPY7+V0MP81fTY48kCRKwicUL:D7cfJGtMQ8Y984CGzBk9TYVvRKwgL
  • TLSH
    T1A2F4125C2A49D903CA6543B58FB5F37862A95DFCB811C3139FEDAEDFFA25A008C44186
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryevasionexecutionxwormpersistenceprivilege_escalationrattrojancollectionspywarestealer

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2