Behavioral task
behavioral1
Sample
Google20Chrome.exe
Resource
win7-20240903-en
General
-
Target
Google20Chrome.exe
-
Size
153KB
-
MD5
db3dada3b02dc0b7a0695709b654dbf1
-
SHA1
1c79937460b57e47f6d04d7905319ae3cead9487
-
SHA256
d74fd991dba840e0349e4fa489dab2fae37746a1f8d66943bab0efe80bc58c6f
-
SHA512
6a8ef2da15277fa41ea5387e8c381e2c715ba170346343f5c88f9977120927de6723ef09a343a5ab1dfab35046bb2bcdc58c2a5e763fa47d1337d58935800a7e
-
SSDEEP
3072:2f05a/CTJ9UFc9UUOMc4NpVq8BxFRzaqF+o2GQJ7/JzqVfGvM:5J9Oc9qgVqwlL
Malware Config
Extracted
xworm
5.0
147.50.240.203:7000
9RG2mgjURv2WGwo7
-
Install_directory
%ProgramData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Google20Chrome.exe
Files
-
Google20Chrome.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 114KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ