Extracted

• • Target
    1176ef1fbe604d88e8da129d5fb41cc67788d32a9e0381d6f5f505f4c4603c2a.exe
  • Size 817KB
  • SHA256 1176ef1fbe604d88e8da129d5fb41cc67788d32a9e0381d6f5f505f4c4603c2a
  • MD5 064906f3233742f88dd2f8a227361895
  • SHA1 a85c814c02125b7d7d045683b28a40b4c4f2b735
  • SHA512 83ea8fa3afe6771885302d6ab81459491382b0ad8dda205b2f2326c2409013d4f07fd2c7eec70cb4ea4c188455f37c70322e5e9e4db7b7f2555aa899012f9a54
  • SSDEEP 12288:6lOzqZ47iqRcMUnVQIWNqUhmjtwHK0a3zB2eLmKggyWf12JzEq3KJCvOlE:aqGnnUpmjpt2e/glWSzECy
  • TLSH
    T1B005E0C03B29B709DE786A309536ED7943A92D69B010F9E67ED93F8778A93015D0CF42
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2