Behavioral task
behavioral1
Sample
8cf8b123fa4227e3281c277022899816f424ca8601b6a52a089b0584a5b9f5cd.exe
Resource
win7-20240903-en
General
-
Target
8cf8b123fa4227e3281c277022899816f424ca8601b6a52a089b0584a5b9f5cd.exe
-
Size
114KB
-
MD5
bf546b552cbc956f6ae1efa2b4e90e8d
-
SHA1
bce5f12f4f4e98379e6f0af9f356ef40cc5b9558
-
SHA256
8cf8b123fa4227e3281c277022899816f424ca8601b6a52a089b0584a5b9f5cd
-
SHA512
631b85c3d9837b715949eb850fd2b682ce7d6146f4ed420a26ce00581d4fc5c4504c2a2665584eca74fde1cf9b1d9002d8a47e06766d8e84e645f9d811b4c403
-
SSDEEP
3072:lB6z4fT+bpmxds3XOnV2kQUgZ66z+n4VJ3bd8G:Sz4fqb0HTQhZ66z+n4VZbd8
Malware Config
Extracted
xworm
10.110.0.10:7000
103.252.89.37:7000
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8cf8b123fa4227e3281c277022899816f424ca8601b6a52a089b0584a5b9f5cd.exe
Files
-
8cf8b123fa4227e3281c277022899816f424ca8601b6a52a089b0584a5b9f5cd.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ