General
-
Target
2444-29-0x0000000000400000-0x0000000000418000-memory.dmp
-
Size
96KB
-
MD5
62d98505cef1d9aa8baf3796dd2f540a
-
SHA1
9ae9834b0192160394077b6969cff0453ec1f9bd
-
SHA256
a3ba06a6b56f77990af48e83764aa613fe56c3d615b751d82fd21b3aff44650e
-
SHA512
5dbceece39606af7f7227e6ce297f4df90519bb05a4a5279d696aa6c959fbb8ae6ba01bed61781895287967de4bb7c2f3c2f9c52226ba99504bbcaf7c9e4da05
-
SSDEEP
1536:xw72fVNsbl9edGaN1DcPpfKIRbNA0+8u0l2my6HROw467/:xw7270lsd76PDRbNARZrmLROwR
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:7000
beshomandotestbesnd.run.place:7000
Attributes
-
Install_directory
%ProgramData%
-
install_file
cmd.exe
-
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2444-29-0x0000000000400000-0x0000000000418000-memory.dmp
Headers
Sections