General
-
Target
2620-290-0x0000000000ED0000-0x0000000000F08000-memory.dmp
-
Size
224KB
-
MD5
c51abf1b731eaa3524e8d37a2efd9516
-
SHA1
2530732dee7e3284cecab98a6c5b65dccbd863e3
-
SHA256
e8d215ad58b80ae527e285b0b8be4e08c8610a14d91a378faf1436fdaa65322c
-
SHA512
82595b97ea5f5502120f60798f15e1642754a5cfa13ed76220c24f6f1164edc448c486b705be6bf37581dc420f24506c2af14f958a5804f022927161aec43740
-
SSDEEP
3072:/p/WjbfQnyH5oGpIlkOpX6cdXrOjVbcL/6Z3zPK2Cu:6bYymGpIlH9KoLC9/
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:7000
beshomandotestbesnd.run.place:7000
Attributes
-
Install_directory
%ProgramData%
-
install_file
taskmgr.exe
-
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2620-290-0x0000000000ED0000-0x0000000000F08000-memory.dmp
Headers
Sections