Analysis
- max time kernel
147s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
17/03/2024, 18:51
General
- Target XWorm/XWorm V5.1/XWormLoader 5.1 x32.exe
- Size 109KB
- Sample240317-xhqcssdf4w
- SHA256 3ef2fc92e45af81d0de1515de17c1b58fa8904bdfaa6fa729547110e4b181ddc
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla payload 1 IoCs
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Enumerates system info in registry 2 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm\XWorm V5.1\XWormLoader 5.1 x32.exe"C:\Users\Admin\AppData\Local\Temp\XWorm\XWorm V5.1\XWormLoader 5.1 x32.exe"1⤵
- Loads dropped DLL
- Enumerates system info in registry
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
OSjLh.dll
memory/240-18-0x00000000063C0000-0x0000000006D12000-memory.dmp
memory/240-20-0x0000000006D20000-0x00000000072C4000-memory.dmp
memory/240-3-0x0000000005790000-0x000000000582C000-memory.dmp
memory/240-4-0x0000000005720000-0x0000000005748000-memory.dmp
memory/240-5-0x00000000054A0000-0x00000000054A6000-memory.dmp
memory/240-6-0x0000000005890000-0x00000000058EE000-memory.dmp
memory/240-7-0x0000000005910000-0x0000000005966000-memory.dmp
memory/240-8-0x0000000005900000-0x0000000005910000-memory.dmp
memory/240-9-0x0000000005770000-0x0000000005776000-memory.dmp
memory/240-11-0x00000000059B0000-0x00000000059EC000-memory.dmp
memory/240-10-0x0000000005850000-0x0000000005856000-memory.dmp
memory/240-12-0x0000000005A10000-0x0000000005A2A000-memory.dmp
memory/240-13-0x0000000005990000-0x00000000059A0000-memory.dmp
memory/240-14-0x0000000005990000-0x00000000059A0000-memory.dmp
memory/240-17-0x0000000005A30000-0x0000000005A40000-memory.dmp
memory/240-0-0x0000000000B70000-0x0000000000B90000-memory.dmp
memory/240-2-0x0000000002EA0000-0x0000000002EE2000-memory.dmp
memory/240-21-0x0000000005DC0000-0x0000000005E52000-memory.dmp
memory/240-19-0x000000007369E000-0x000000007369F000-memory.dmp
memory/240-1-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/240-28-0x0000000073E9F000-0x0000000073EA0000-memory.dmp
memory/240-29-0x0000000073EA0000-0x0000000073EA1000-memory.dmp
memory/240-30-0x000000000A9F0000-0x000000000B5A0000-memory.dmp
memory/240-31-0x0000000002E30000-0x0000000002E3A000-memory.dmp
memory/240-32-0x00000000062B0000-0x0000000006306000-memory.dmp
memory/240-33-0x000000000B7A0000-0x000000000B994000-memory.dmp
memory/240-34-0x0000000005900000-0x0000000005910000-memory.dmp
memory/240-35-0x000000000E410000-0x000000000E476000-memory.dmp
memory/240-36-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/240-37-0x0000000005900000-0x0000000005910000-memory.dmp
memory/240-38-0x0000000005990000-0x00000000059A0000-memory.dmp
memory/240-39-0x0000000005A30000-0x0000000005A40000-memory.dmp
memory/240-40-0x0000000005900000-0x0000000005910000-memory.dmp