Behavioral task
behavioral1
Sample
44a79bc2cbc8edd8d9fe5c11e6a142559c07141fa8250af46f97072b8811fe2b.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
44a79bc2cbc8edd8d9fe5c11e6a142559c07141fa8250af46f97072b8811fe2b.exe
Resource
win10v2004-20240802-en
General
-
Target
44a79bc2cbc8edd8d9fe5c11e6a142559c07141fa8250af46f97072b8811fe2b.exe
-
Size
64KB
-
MD5
92a4d5d3d5d7af4ab0da5b38e375bda4
-
SHA1
668b673544dfb57d6f0f82de9cf58c3f0ad0fa70
-
SHA256
44a79bc2cbc8edd8d9fe5c11e6a142559c07141fa8250af46f97072b8811fe2b
-
SHA512
63ec38827109492145bc17809991b41f3ee9949e76a88586376643bc2f682a7222f4b3e3c6bb7c9ba6c202d60e58416998ffafd99ef5d412420073d9f1be1674
-
SSDEEP
1536:oK5QNkuLTKQk9ZZnbpDTqtbSPDrAFC6Zc2MOOIHW:onk+oZPqtbCqd4OOcW
Malware Config
Extracted
xworm
3.1
line-ellis.gl.at.ply.gg:28479
-
Install_directory
%LocalAppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44a79bc2cbc8edd8d9fe5c11e6a142559c07141fa8250af46f97072b8811fe2b.exe
Files
-
44a79bc2cbc8edd8d9fe5c11e6a142559c07141fa8250af46f97072b8811fe2b.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ