Behavioral task
behavioral1
Sample
Stand.Launchpad.exe
Resource
win11-20240508-en
General
-
Target
Stand.Launchpad.exe
-
Size
101KB
-
MD5
1876cff7742d4df6149e00b4abf78425
-
SHA1
5e81c297afedde245a5e4f3835021659cf541f65
-
SHA256
a83142b28be6ce5e81cd2fa3bdf2e8679d2d1b79de2eaa0df59fde1a0e2ee032
-
SHA512
a6dfabf8ba1a7ffbe20fabb12cf964ea3eca04f2115a1f312c7e02daef0c3824947c15e53cab2cf91a01b6945d689d8ce8bb47eee4f39a4e0d8b62292c47722c
-
SSDEEP
1536:DYQxEiKnGBYp11Kf4eGPCbr4/Audh5F6NNCJOJxxV:DHmpb8f4eGabrqhANWOJrV
Malware Config
Extracted
xworm
127.0.0.1:43107
Name1442-43107.portmap.host:43107
-
Install_directory
%Temp%
-
install_file
Stand.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Stand.Launchpad.exe
Files
-
Stand.Launchpad.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 79KB - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ