Extracted

• • Target
    SonyVegasPro21.0.exe
  • Size 120KB
  • SHA256 a37ea9c80db819561b53ea7c6a687bb30800cedbb7b772ba3bfb0ef5c091252b
  • MD5 dff287999fc2aaa54f3b53311b19c7f4
  • SHA1 8a9c9dd7bcdb1ad6efec7b860a107f2a76fe7bad
  • SHA512 2350175f554f4d4da13a7e25bf8ac9e49a076e2ad8d36e53e9d293da9055c33dc6c04dc113fa37a517ef34934ebea04be6dd6a6af0bf84b7d7fd90a23e871644
  • SSDEEP 1536:8JHTHr7R0G2JEr2Kry/bZpcmjZvy6WyVcP6LOo0OM7:8FDrddZry/bDayVciLOopM7
  • TLSH
    T19FC35C1CBBEA8069E0FF9FB51DF03106CB79E3675903961F3489064AC623689CD527E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormrattrojanexecutionpersistenceprivilege_escalation

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2