Extracted

• • Target
    rotected.exe
  • Size 1.1MB
  • SHA256 3a4cb7f2ebad8c59e1b75f42a22cfb871c6ba33dc311359c10d98edef04c152c
  • MD5 7001322917a904ee69a9c7e01b9b843f
  • SHA1 beed314652007503d8e9b902834deef4d29658b9
  • SHA512 2b89ef5acaa842cc8a63d71f1ebaa63d5d731ca0edfda964e7beb185c97bc592e1ff21504847bdf66bdeb4fd9ca6831f2bafe0972964d94e314142fb38e825d7
  • SSDEEP 24576:7j9+sRJnlmw1IJbJorOf+2nMuroy+0xc41G:7cHPf+2nMuroy+0V1G
  • TLSH
    T15D35BE699DEE4702E60C927C51E7940C2BFBE5B9E331454A9BD9DCBFE8033CD181A44A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasionexecutionxwormpersistenceprivilege_escalationrattrojandiscovery

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Suspicious use of NtCreateProcessExOtherParentProcess

    defense_evasionprivilege_escalation

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2