Behavioral task
behavioral1
Sample
Sercher.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Sercher.exe
Resource
win10v2004-20240709-en
General
-
Target
Sercher.exe
-
Size
69KB
-
MD5
a67e7d9cf57f128c6cd5915e2ffb135d
-
SHA1
acbcaa10a0349ba69f6a57db1302a6ae588f67d6
-
SHA256
64398384e4d50c9419134ae4ad66d01f20a4172198af10222130b6bf1a6b3747
-
SHA512
6349f21426ac05f50cbb3ab0dea5b6e2a7c97faa31d295f8d666a9733605918d8c4430993d0a056c8972c516ed78ec0002022af2ed5c9ed927c30be822e040d2
-
SSDEEP
1536:yaP+F1aMEWqEYFOHOqsHbDyGi3md+66hbArKOl37gohqm:3GOiXsTbDoJhArKO97gowm
Malware Config
Extracted
xworm
127.0.0.1:16512
no-loss.gl.at.ply.gg:16512
-
Install_directory
%AppData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Sercher.exe
Files
-
Sercher.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ