Analysis
- max time kernel
94s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
17/03/2024, 18:51
General
- Target XWorm/XWorm V5.1/XWorm V5.1.exe
- Size 9.3MB
- Sample240317-xhqcssdf4w
- SHA256 567ac8995973807a1288847d357dd8014118f07194a4db64cccaeab5871d54e1
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla payload 1 IoCs
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Enumerates system info in registry 2 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm\XWorm V5.1\XWorm V5.1.exe"C:\Users\Admin\AppData\Local\Temp\XWorm\XWorm V5.1\XWorm V5.1.exe"1⤵
- Loads dropped DLL
- Enumerates system info in registry
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
eakSv.dll
memory/3572-0-0x00007FFEC48E0000-0x00007FFEC53A1000-memory.dmp
memory/3572-1-0x000002741C850000-0x000002741D1A2000-memory.dmp
memory/3572-8-0x000002741D5F0000-0x000002741D600000-memory.dmp
memory/3572-9-0x0000027437C80000-0x0000027438830000-memory.dmp
memory/3572-10-0x0000027438BD0000-0x0000027438DC4000-memory.dmp
memory/3572-12-0x000002741D5F0000-0x000002741D600000-memory.dmp
memory/3572-11-0x000002741D5F0000-0x000002741D600000-memory.dmp
memory/3572-13-0x00007FFEC48E0000-0x00007FFEC53A1000-memory.dmp
memory/3572-14-0x000002741D5F0000-0x000002741D600000-memory.dmp
memory/3572-15-0x000002741D5F0000-0x000002741D600000-memory.dmp
memory/3572-16-0x000002741D5F0000-0x000002741D600000-memory.dmp