Behavioral task
behavioral1
Sample
triggerbot.exe
Resource
win7-20240903-en
General
-
Target
triggerbot.exe
-
Size
66KB
-
MD5
3c29f913ec259219393ed6ed34095f7f
-
SHA1
a44d686af7756b548373525b3cb921c44d0b67b2
-
SHA256
e65c82b121ec90f36fc4193e8e7f850312107c441e8a2cfa4e6b844cb6462485
-
SHA512
3a3e5a676a0541b9d5697c5f6f7b71deadae1e9633ff919cfdf68f9288f4b5dfb91c38a6af0fbbe23aaab5d08e1b6f409bf33134390a54ca023c916f3d5ecf50
-
SSDEEP
1536:vFVqX0n8XtajJvNDbsPSKoZr66tFOgUu9x6:9Yq8XQBbsT0FO7j
Malware Config
Extracted
xworm
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
pastebin_url
https://pastebin.com/raw/kU06s0Rk
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource triggerbot.exe
Files
-
triggerbot.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ