Behavioral task
behavioral1
Sample
24be511e53befcc66b6932acc9c0b948.exe
Resource
win7-20231215-en
General
-
Target
24be511e53befcc66b6932acc9c0b948.bin
-
Size
54KB
-
MD5
24be511e53befcc66b6932acc9c0b948
-
SHA1
cc7ba5150d8cbb3be286231aa355fc9e5b96c0c3
-
SHA256
f7dac16a0cd531e27ef61b2b11b282d376857f6e2655c93d01f318fa17f9b882
-
SHA512
afc7b726535c56623ede3411253945ba96f1e5700b3a5eb04736b6fc4260f63fcf6dc8a2b11d4231c6b8b62a3146471d2da3d2da87ae7c1be8d51a93b18a140a
-
SSDEEP
1536:0xBai1gop1Tdkbefje9FXxnDNmfOJWRwE:0xEi9ppdkbajQXxDaOJWRx
Malware Config
Extracted
xworm
0.tcp.ngrok.io:19128
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 24be511e53befcc66b6932acc9c0b948.bin
Files
-
24be511e53befcc66b6932acc9c0b948.bin.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ