Behavioral task
behavioral1
Sample
7973fcb627c7c8558c7aaf62ec80f24e29a106d9ea7fe2e2fbcf71a5f1a19e43N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7973fcb627c7c8558c7aaf62ec80f24e29a106d9ea7fe2e2fbcf71a5f1a19e43N.exe
Resource
win10v2004-20240802-en
General
-
Target
7973fcb627c7c8558c7aaf62ec80f24e29a106d9ea7fe2e2fbcf71a5f1a19e43N
-
Size
271KB
-
MD5
776f1ab7d2bb8807a424d6947f299e30
-
SHA1
508297113c75884fdf374b8aa9eb74f92e5a0cbe
-
SHA256
7973fcb627c7c8558c7aaf62ec80f24e29a106d9ea7fe2e2fbcf71a5f1a19e43
-
SHA512
2237fdd9bf1644c9b684c26c3042e423de8bfcfe4b3c171b4a8e5cba35de5934393d60e33432f45aa1385e4050227a7ba4912c6e6e3151a0d8c9527495c44679
-
SSDEEP
6144:uutkz7bbo7e7i99999Yki76sNV6/68/27ySQPLL:OL4e7i99999Yki76skPLL
Malware Config
Extracted
xworm
91.166.206.112:39575
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7973fcb627c7c8558c7aaf62ec80f24e29a106d9ea7fe2e2fbcf71a5f1a19e43N
Files
-
7973fcb627c7c8558c7aaf62ec80f24e29a106d9ea7fe2e2fbcf71a5f1a19e43N.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 206KB - Virtual size: 206KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ