Behavioral task
behavioral1
Sample
XClient.exe
Resource
win10v2004-20240709-en
General
-
Target
XClient.exe
-
Size
52KB
-
MD5
827024c5afcbcf70960c03f7e8ae40c9
-
SHA1
9b0e2f758088092bfa82dcd7b57485f5ed37a305
-
SHA256
db740845858128aecf3c8adcb05566fc99e1e56aaa8c1c2191869b9a652b012f
-
SHA512
7ac93a4939464e8c9893173e8cc566c62420557b5128491e33607ed6d9ba851b8a83722e5ac542914c1a9a26287e9f7caf5bc5b3b831a97f5c62511e1db51718
-
SSDEEP
1536:g4WWC5D3vRUdXD0VC8ObZa9aQG+77L1OiZ8:gZ5qOVC8ObZgJ7L1Oi6
Malware Config
Extracted
xworm
download-relates.gl.at.ply.gg:4489
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource XClient.exe
Files
-
XClient.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 50KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ