Behavioral task
behavioral1
Sample
Modrinth.exe
Resource
win10-20240404-en
General
-
Target
Modrinth.exe
-
Size
330KB
-
MD5
c38cb6e59d47072f670ce64678169f85
-
SHA1
893b365eb0d232ba3c63a1c85e586c61a027ff6e
-
SHA256
674433b4b9d492bf8ca6f54dee3cb3741dfe787099301cad0cf5c9c1965c319e
-
SHA512
875a905851d0b6705090880b9c50a18209ba316452f8077210deef3347fe3d08e5e86af6b36c211a534d986840dd9f0b01e9a74ed66aafa3c86752fa0391fc53
-
SSDEEP
3072:vcEQtAVkhbgsK0jmK8mO72xGyOkitG/iJpXnc858j:vclteEb11xDOkiYcRnh
Malware Config
Extracted
xworm
she-vocal.gl.at.ply.gg:36704
-
Install_directory
%AppData%
-
install_file
notepad.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Modrinth.exe
Files
-
Modrinth.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 265KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ