Behavioral task
behavioral1
Sample
b7321efe940b086b1ebb7a89ac64a2c9b8a1ec997c176ca59f0751fb0299a92f.exe
Resource
win7-20240903-en
General
-
Target
b7321efe940b086b1ebb7a89ac64a2c9b8a1ec997c176ca59f0751fb0299a92f
-
Size
79KB
-
MD5
de6f393b227ea641682ab9b876c43c62
-
SHA1
69bf654eb245f15fe42d8391ae4c441ef8284838
-
SHA256
b7321efe940b086b1ebb7a89ac64a2c9b8a1ec997c176ca59f0751fb0299a92f
-
SHA512
7705a11413eb8bc10ae4297d38dd091f23beca1fb824cc2bafa59bf75fd140b622ec174f1ce439a31ecd7d6a3a993a8692f43296a613b6de7347986f022d7c87
-
SSDEEP
1536:TSXQTAX6W8LdZ0tQZ4/dPxD1wbWudoDVF6oxmVJOxXNfZdWy:O8IaZYQ+PxubWubJO1Nfey
Malware Config
Extracted
xworm
memory-julia.gl.at.ply.gg:3595
-
Install_directory
%Temp%
-
install_file
SDASD.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b7321efe940b086b1ebb7a89ac64a2c9b8a1ec997c176ca59f0751fb0299a92f
Files
-
b7321efe940b086b1ebb7a89ac64a2c9b8a1ec997c176ca59f0751fb0299a92f.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ