Behavioral task
behavioral1
Sample
WaveTrial.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
WaveTrial.exe
Resource
win10v2004-20240508-en
General
-
Target
WaveTrial.exe
-
Size
86KB
-
MD5
5cb8f4aa69339acc85ef9d2ca60b0c07
-
SHA1
bb12de5f0a59eda98ba82e4a81dd24d80b8d7844
-
SHA256
d8f968a5732220f35ab7094f13537d1d68405ed10362737848a87e5a71773e9d
-
SHA512
f8908f96cfff0498b977c2d790709cc02408068999f520a9727e3eff4e260092fd1c1b8fcf13d0cc217298f0e91a0b55fb30f88bba515fa08ed8b66465c07540
-
SSDEEP
1536:VVOy37Fk3kKmog7DldgQatSL4Jj6+l7lbOL5zWx1fRkTqP6nPbuE1ONz5UrQWSK0:ctmog7DjgfmmbO14CP3ONzCrQC0
Malware Config
Extracted
xworm
127.0.0.1:2619
20.ip.gl.ply.gg:2619
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WaveTrial.exe
Files
-
WaveTrial.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ