Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
17/03/2024, 18:51
General
- Target XWorm/XWorm V5.2/XWormLoader 5.2 x32.exe
- Size 109KB
- Sample240317-xhqcssdf4w
- SHA256 2d74eb709aea89a181cf8dfcc7e551978889f0d875401a2f1140487407bf18ae
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla payload 1 IoCs
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm\XWorm V5.2\XWormLoader 5.2 x32.exe"C:\Users\Admin\AppData\Local\Temp\XWorm\XWorm V5.2\XWormLoader 5.2 x32.exe"1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
aPjMR.dll
memory/1996-18-0x0000000006020000-0x0000000006C58000-memory.dmp
memory/1996-20-0x0000000006C60000-0x0000000007204000-memory.dmp
memory/1996-3-0x00000000050F0000-0x000000000518C000-memory.dmp
memory/1996-4-0x0000000005060000-0x0000000005088000-memory.dmp
memory/1996-5-0x0000000005030000-0x0000000005036000-memory.dmp
memory/1996-6-0x00000000051F0000-0x000000000524E000-memory.dmp
memory/1996-7-0x0000000005250000-0x00000000052A6000-memory.dmp
memory/1996-8-0x00000000050C0000-0x00000000050D0000-memory.dmp
memory/1996-9-0x00000000051A0000-0x00000000051A6000-memory.dmp
memory/1996-10-0x00000000051D0000-0x00000000051D6000-memory.dmp
memory/1996-11-0x0000000005320000-0x000000000535C000-memory.dmp
memory/1996-12-0x0000000005390000-0x00000000053AA000-memory.dmp
memory/1996-13-0x0000000005310000-0x0000000005320000-memory.dmp
memory/1996-14-0x0000000005310000-0x0000000005320000-memory.dmp
memory/1996-17-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/1996-1-0x0000000074410000-0x0000000074BC0000-memory.dmp
memory/1996-2-0x0000000004BF0000-0x0000000004C32000-memory.dmp
memory/1996-21-0x0000000005740000-0x00000000057D2000-memory.dmp
memory/1996-19-0x000000007336E000-0x000000007336F000-memory.dmp
memory/1996-0-0x00000000001A0000-0x00000000001C0000-memory.dmp
memory/1996-28-0x0000000073B6F000-0x0000000073B70000-memory.dmp
memory/1996-29-0x0000000073B70000-0x0000000073B71000-memory.dmp
memory/1996-30-0x000000000ADA0000-0x000000000B98C000-memory.dmp
memory/1996-31-0x0000000004700000-0x000000000470A000-memory.dmp
memory/1996-32-0x0000000005F80000-0x0000000005FD6000-memory.dmp
memory/1996-33-0x000000000BB90000-0x000000000BD84000-memory.dmp
memory/1996-34-0x00000000050C0000-0x00000000050D0000-memory.dmp
memory/1996-35-0x000000000EBA0000-0x000000000EC06000-memory.dmp
memory/1996-36-0x0000000074410000-0x0000000074BC0000-memory.dmp
memory/1996-37-0x00000000050C0000-0x00000000050D0000-memory.dmp
memory/1996-38-0x0000000005310000-0x0000000005320000-memory.dmp
memory/1996-39-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/1996-40-0x00000000050C0000-0x00000000050D0000-memory.dmp