Extracted

• • Target
    c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe
  • Size 713KB
  • SHA256 c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9
  • MD5 95ca5b8c1bfcd91a4b4a48d22baf16e2
  • SHA1 d22ca7b8b27710b5fc86a9b0e8966cd350e73972
  • SHA512 cf63c030ecf9e70e56697a893adb0914d6d0ad0fcf318da67083728a14be24ee95405f2672aa9dd5b17e66a390d0e4440568145542a86200c3d12ee3a8dd093b
  • SSDEEP 12288:2TIFzrn09ESPhv0OIcsCKuKMtyJdl27KFQYFghrl58TYTqqRqtEEfFrlhvAWJdby:yIFzrn0HJJRKsyBqOgf58TAqc0fFZyyY
  • TLSH
    T18AF4220C710DC99BE4624BBD9A60F73913BA6C9CA623E6498FF5BCCF35677240890761
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2