Behavioral task
behavioral1
Sample
09a64a3498e17ada3802c5d8da6d7eb1791634b5c1499ae8bdbe5f7c3dfe60ed.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
09a64a3498e17ada3802c5d8da6d7eb1791634b5c1499ae8bdbe5f7c3dfe60ed.exe
Resource
win10v2004-20240508-en
General
-
Target
09a64a3498e17ada3802c5d8da6d7eb1791634b5c1499ae8bdbe5f7c3dfe60ed.exe
-
Size
204KB
-
MD5
09b0cd109f4191d3a7d86f78d8b25660
-
SHA1
4ccc032c98cc86963bfc70dbc01185c2dfd553ff
-
SHA256
09a64a3498e17ada3802c5d8da6d7eb1791634b5c1499ae8bdbe5f7c3dfe60ed
-
SHA512
96fcfe84780381cf017695523e9f08cd23a8c7cc6c1cfa731cf362cc7c3c6fb4fc1f2a2fd17eb1aeae132eab2969e2c8e33d1263300bf4eb9f7946fd8d3b999b
-
SSDEEP
3072:cmDcFe92COMz8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLnK:c5e9dUhcX7elbKTuq9bfF/H9d9n
Malware Config
Extracted
xworm
5.0
127.0.0.1:50914
20.ip.gl.ply.gg:50914
ZqvweewGzctiB6pG
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09a64a3498e17ada3802c5d8da6d7eb1791634b5c1499ae8bdbe5f7c3dfe60ed.exe
Files
-
09a64a3498e17ada3802c5d8da6d7eb1791634b5c1499ae8bdbe5f7c3dfe60ed.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ