Behavioral task
behavioral1
Sample
9c0caf3f365a7801187d02fa694cdc50N.exe
Resource
win7-20240729-en
General
-
Target
9c0caf3f365a7801187d02fa694cdc50N.exe
-
Size
59KB
-
MD5
9c0caf3f365a7801187d02fa694cdc50
-
SHA1
8e5dcc6ae4e3ce43e4adaf97f4fe451b222b303c
-
SHA256
3bb15161ae62719218f2fbb8b79bc1fd85f2f80922d466682525234bab4b75c3
-
SHA512
ab67a7065d0eac939bc6ee5a99b9e62bcb7b9fd2130d7f9d3d91bd09978fa564b0703dd7192e0098a7a6c7c2975840f3418ec3bfc552921543599b93fd1d28d8
-
SSDEEP
1536:9D4ZqlG3w26v63CRQz39/T4+bRkyZ1Ele6TfOr2eA:9UZqlG3wEGMl4+bRLOxOr1A
Malware Config
Extracted
xworm
192.168.0.24:8888
dane1c-56094.portmap.host:8888
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9c0caf3f365a7801187d02fa694cdc50N.exe
Files
-
9c0caf3f365a7801187d02fa694cdc50N.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ