Behavioral task
behavioral1
Sample
7ec3f5b566041e0e9481175dc4dcc7858c935f4bf6ece5e53e4d115f265e9ab1.exe
Resource
win7-20240708-en
General
-
Target
7ec3f5b566041e0e9481175dc4dcc7858c935f4bf6ece5e53e4d115f265e9ab1
-
Size
104KB
-
MD5
d938f2f3e10f728364b11eda6be8f44d
-
SHA1
f38846b972d1ba6b5f70b371fdda7f666e02ffa0
-
SHA256
7ec3f5b566041e0e9481175dc4dcc7858c935f4bf6ece5e53e4d115f265e9ab1
-
SHA512
601d3c574ab6682831b0482c43aa6d4fe43f838662ceb3173027667ff559e2da7214bf6df5deb518ac61e8b237ea5b9097d05267bddbcbf3dabd2b0c4df57e45
-
SSDEEP
1536:fG5hPq2Wwi4NDLxAcPiU7bZsQiNF6cyNOshSKJ9X:uzbBDviU7bZsQ8XyNOsvJ9X
Malware Config
Extracted
xworm
budget-highlights.gl.at.ply.gg:9054
-
Install_directory
%ProgramData%
-
install_file
SecurityHealthSystray.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7ec3f5b566041e0e9481175dc4dcc7858c935f4bf6ece5e53e4d115f265e9ab1
Files
-
7ec3f5b566041e0e9481175dc4dcc7858c935f4bf6ece5e53e4d115f265e9ab1.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ