General
-
Target
2020-27-0x0000000000090000-0x00000000004F4000-memory.dmp
-
Size
4.4MB
-
MD5
e500dc0d6ef72a15e5516119b56f3fa0
-
SHA1
bbe899ea446be67a253ec8abf99109a31e620e96
-
SHA256
6ff325bc3409ebbd1e08368acb0957010b45adcdfe37e2f69b359cf32f743320
-
SHA512
d3f239e549d4ef0930cab61b5d5a7e2d6be40b099266c44594a091c2acc4acc6141b9c824ec19e706115a8f749e99a795795fd37a7d3bcc3ed710a43f8429989
-
SSDEEP
24576:Q2zRkYu1/A2/K6eVhA0mq7301+S45EcnlqZBU6jWUS+QoaAl4IZBLQyhvAYtkEwQ:QQRkYu1/A2C6U01qE4qDZB2gXIfw8cl
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:7000
beshomandotestbesnd.run.place:7000
Attributes
-
Install_directory
%ProgramData%
-
install_file
cmd.exe
-
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2020-27-0x0000000000090000-0x00000000004F4000-memory.dmp
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections