Extracted

• • Target
    0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe
  • Size 747KB
  • SHA256 0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139
  • MD5 f03ddef69caf6b0bdd009f2ec1f41c0b
  • SHA1 9fde07b3c8e28944dacdb8bdfada5a3d8bdf5eac
  • SHA512 8b97cfff357d553fa7355a42242cba07969f63ba3f4cc9813126c9a86a0175b2337f9220a84deb3f74d033fca3996a846f782c3c04dfb6eafab43de11a1d6c4e
  • SSDEEP 12288:yS1FlJdbPoA0/ncMpxV3AmQ4ZiCLQY8QUqf4NkAHAPO4xwoHZzAeETkmmOHBsNBV:VFd0/n3pxOmQ4Zi1nqf4SAHAPOYmTXHw
  • TLSH
    T129F4121C6A1BE917C54013360BA1F275127E5EDAA812D227BFDD2EDFBE32B168D401D2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryevasionexecutionxwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2