Behavioral task
behavioral1
Sample
WAVEgg.exe
Resource
win11-20240426-en
General
-
Target
WAVEgg.exe
-
Size
73KB
-
MD5
89840131db090bb5cffb572f690b4ede
-
SHA1
809d2adef683a6b38c845a3c642ac150bfd62973
-
SHA256
322e1ec6c9b04e46e6a277feecbc62f39dc90b1b02363599ccc97d986cb64f4f
-
SHA512
d6a77bdd7644c6e3fc51f0d8fa57de33f32e048f4f6fa1bf1f978caaf5226f5c17b2abcfc5bbf81e62f2899f0de9793f368049b4b08dd336a35c23ef2a8d6e72
-
SSDEEP
1536:CWt9/EVym/r9oLI4/PXUOVPbU6IrhRPx4+oicAOl3wEZ/:CUg9oLI4EOVPbUnrnVjO1wo/
Malware Config
Extracted
xworm
-
Install_directory
%AppData%
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/cVQrB6DR
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WAVEgg.exe
Files
-
WAVEgg.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ