Behavioral task
behavioral1
Sample
ee77fd66103b412195daff2514cd1fb550e61e618c2fa98bfd5ab998e5cd7b6b.exe
Resource
win7-20240903-en
General
-
Target
ee77fd66103b412195daff2514cd1fb550e61e618c2fa98bfd5ab998e5cd7b6b
-
Size
99KB
-
MD5
70481cef66610d13de32339230ddcfd1
-
SHA1
39d19ccc6c1d77fe62d39b7eda95559bd2969f16
-
SHA256
ee77fd66103b412195daff2514cd1fb550e61e618c2fa98bfd5ab998e5cd7b6b
-
SHA512
75e0f65e0a2957a20796c93654ccde195f9c53d821c25a260c4203a2170aa821dbfc9c1ce3b165a41a23d44ef7c033076f1da9fe2691b2087c60b89dce8a63a7
-
SSDEEP
1536:gCg7wHl8aTciGekb5jPHyZ6xnOEiXChiH0hLP+VVVVVVVVVVVVVVVVVVVVVVVVVm:Gi8ScRekb5DnOEiXbH0hLND
Malware Config
Extracted
xworm
127.0.0.1:44495
death-manor.gl.at.ply.gg:44495
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ee77fd66103b412195daff2514cd1fb550e61e618c2fa98bfd5ab998e5cd7b6b
Files
-
ee77fd66103b412195daff2514cd1fb550e61e618c2fa98bfd5ab998e5cd7b6b.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ