General
-
Target
c9419a3e2b0ce74b0431d1af2afca5a416eb8f91a43b64832cfab1e8c2f815e1
-
Size
43KB
-
Sample
240419-vwxypaad93
-
MD5
195de2544c3e8f91d5002594d02141a9
-
SHA1
389c5300b583d2deb3bab2498a48838d7759a114
-
SHA256
c9419a3e2b0ce74b0431d1af2afca5a416eb8f91a43b64832cfab1e8c2f815e1
-
SHA512
92b00dce3a4639346a76dfe07c629ca3ffe8e67c5b230316da2fd3d640d4ebe06a571b086cab2cdd05894d08c84093a1912862d64ddaa93c879e0b353920b01e
-
SSDEEP
768:H3bDtOjSKmJSAqSqpFYql3r6EV6H3NChM3gL/AFz/9CrAqlBvgg:XNYSKlUqfQO6H3ohbLYFz1qBvgg
Behavioral task
behavioral1
Sample
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
xworm
involved-hurt.gl.at.ply.gg:35238
-
Install_directory
%LocalAppData%
-
install_file
WindowsHealthSystem.exe
Targets
-
-
Target
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe
-
Size
70KB
-
MD5
109adf5a32829b151d536e30a81ee96b
-
SHA1
dc23006a97e7d5bc34eedec563432e63ed6a226a
-
SHA256
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311
-
SHA512
74e7fb13e195dcf6b8ed0f40c034925c3762b2e0c43c8faede99ce79a4b07966ff5336769db3f9f5bb4c0478cefc879d59b43d5ded5bda3e75d19bd0a1e9e9e5
-
SSDEEP
1536:QeYZA06UMG73jWw9o5zeS6LQR9bAayaIMbckM6mfOWcNFOfab:QfZxfMGTFXS6LQR9bAaZbfsfOPMab
Score10/10-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-