Behavioral task
behavioral1
Sample
NlCrack.exe
Resource
win11-20240508-en
General
-
Target
NlCrack.exe
-
Size
77KB
-
MD5
fb4692539278ceb9554a2da842690af4
-
SHA1
08cc7ee1c9628b5d9eae2c26f07d22f75ccb6a18
-
SHA256
5ef39c4a2f07edb9ed918adfd8d321c133d050b6f0e26adbe3638eda4937c43e
-
SHA512
4ea58061e42f2a1b3c26eba62cfbec652a88ffec1c5c9129ce8d7344e264fe5234fc34c4142205ee792c7aceeea54013bfa833e9376b2a881a26b5d316ed9f23
-
SSDEEP
1536:3+wlvgdUsD72Vgdd9/4DfvkbhfmAE8lX6JbnYOUnABDJr64fUX85:3+ysP2VowrkbhTzpOwAlJrhcX85
Malware Config
Extracted
xworm
regarding-peak.gl.at.ply.gg:40809
-
Install_directory
%AppData%
-
install_file
VerX.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NlCrack.exe
Files
-
NlCrack.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 65KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ