Extracted

• • Target
    Output (1).exe
  • Size 836KB
  • SHA256 4329c71459188edbeab68e6dea901669591ff80cb24808a67b64399ea9e8e4e7
  • MD5 4fd41e6a063a55096b2b9c2f91ec465b
  • SHA1 d9b7233efa73f4d0d83969cc02bc07748422ef86
  • SHA512 e22eaed6a3c53773a7871f9f7a3fdc1cf6f9a40e113a834cf10f967cc551ed62981f4f9096fb6f6f9acca07af3f7d9efcf4bcc805b00e81779b032333c6e6618
  • SSDEEP 24576:9FkrklxTPjfvpdGPnVsxNZTUFEFdYuhw:9sMPjm/OxfUFEfY
  • TLSH
    T11A05DD27A55D64EECACFA5330A14716AB02BFFC69D630FE1C5835344D29E8B10CA29DD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1