Behavioral task
behavioral1
Sample
9dd450bc1bfc21c1015f39c16c623726.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
9dd450bc1bfc21c1015f39c16c623726.exe
Resource
win10v2004-20240704-en
General
-
Target
9dd450bc1bfc21c1015f39c16c623726.bin
-
Size
49KB
-
MD5
9dd450bc1bfc21c1015f39c16c623726
-
SHA1
73c3e6378238a6d5ff5fba78a19ccb61a276bb8b
-
SHA256
b34a6bc82276a333e07486a2f4f57715704743f39e11eec7866d5a054e865ddf
-
SHA512
9c01168d01e6785b778caf8fdf43b274ca00aaf8d56f9b4cacd953b7ebd5375f08151f2b1990f7ee87a14fa7dee30f767630c47cb734827bc63e0b7d316243fb
-
SSDEEP
768:WAYbIDqaV6blSR6nhP7Irm5Fyl98i56YOjhulZzbwonH8wSpO1bNT:D6IDKSR6nhP0sFQ98i56YOjqwoH865B
Malware Config
Extracted
xworm
5.0
20.ip.gl.ply.gg:58343
ub7RI93O5DrBTB6X
-
Install_directory
%AppData%
-
install_file
injector.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9dd450bc1bfc21c1015f39c16c623726.bin
Files
-
9dd450bc1bfc21c1015f39c16c623726.bin.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ