Behavioral task
behavioral1
Sample
4706e340e0c1ad14dbe096f6d6bdc9efa65276c5a288fa1f26b833b18fd42e64N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4706e340e0c1ad14dbe096f6d6bdc9efa65276c5a288fa1f26b833b18fd42e64N.exe
Resource
win10v2004-20241007-en
General
-
Target
4706e340e0c1ad14dbe096f6d6bdc9efa65276c5a288fa1f26b833b18fd42e64N.exe
-
Size
46KB
-
MD5
6181c9d0c126fc18603015402e2e49e0
-
SHA1
1621ebc0836dccfc1c9e5322d4b5f686de82757a
-
SHA256
4706e340e0c1ad14dbe096f6d6bdc9efa65276c5a288fa1f26b833b18fd42e64
-
SHA512
1074d6c7d89b60fe42556ab3970a355b28908f1ee1bdc925650ef6f416306b1de4352caf6170a3948b5f8a87f32e719d0d6b033009320fd409f170c032cfd8c4
-
SSDEEP
768:aBoVSTAPW9jllp0XMtd70hq30gzbGYxIXDZVpNf3SOwht7a1ehV:eHL9jldFwszbGYuTpIOwL0E
Malware Config
Extracted
xworm
3.0
16.ip.gl.ply.gg:41909
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 4706e340e0c1ad14dbe096f6d6bdc9efa65276c5a288fa1f26b833b18fd42e64N.exe
Files
-
4706e340e0c1ad14dbe096f6d6bdc9efa65276c5a288fa1f26b833b18fd42e64N.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ