Behavioral task
behavioral1
Sample
2788150x00000000004000000x0000000000410000memory_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2788150x00000000004000000x0000000000410000memory_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2788150x00000000004000000x0000000000410000memory_JC.dmp
-
Size
64KB
-
MD5
84e12267c3eaf6133847e478de68632d
-
SHA1
71c89d3bd045c56b805d9e55ec8cb7672aa8df88
-
SHA256
5f63c8eaf469a8bae934ec7be642505f711553f6fdfa5f501612f000b7718656
-
SHA512
96002f4289fe6d0cfd38dce582ea70c1e9aa46c6e69e39f99c03d1f95740319db338abd006f34019611ac680179be26640fb694a341da3dd80ce6918eb62ccd6
-
SSDEEP
768:pUw9W9heo4QMRpE17O59DGObNLFf9dP4OuhKyr3W:f89heTK1infRFf9dP4Ou8
Malware Config
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2788150x00000000004000000x0000000000410000memory_JC.dmp
Files
-
2788150x00000000004000000x0000000000410000memory_JC.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ