Analysis
- max time kernel
92s - max time network
119s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
17/03/2024, 18:51
General
- Target XWorm/XWorm V5.1/XWormLoader 5.1 x64.exe
- Size 109KB
- Sample240317-xhqcssdf4w
- SHA256 53d7f79b97f9bb3883a26b4cd84127e4c0c932ba82d9dd437b52373099049bea
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla payload 1 IoCs
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Enumerates system info in registry 2 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm\XWorm V5.1\XWormLoader 5.1 x64.exe"C:\Users\Admin\AppData\Local\Temp\XWorm\XWorm V5.1\XWormLoader 5.1 x64.exe"1⤵
- Loads dropped DLL
- Enumerates system info in registry
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
eakSv.dll
memory/2380-12-0x000002AC41AA0000-0x000002AC423F2000-memory.dmp
memory/2380-28-0x00007FFA64800000-0x00007FFA652C1000-memory.dmp
memory/2380-4-0x000002AC28610000-0x000002AC28616000-memory.dmp
memory/2380-2-0x000002AC286D0000-0x000002AC286F8000-memory.dmp
memory/2380-5-0x000002AC41040000-0x000002AC4109E000-memory.dmp
memory/2380-6-0x000002AC410A0000-0x000002AC410F6000-memory.dmp
memory/2380-7-0x000002AC28600000-0x000002AC28610000-memory.dmp
memory/2380-8-0x000002AC285D0000-0x000002AC285D6000-memory.dmp
memory/2380-10-0x000002AC41100000-0x000002AC4113C000-memory.dmp
memory/2380-9-0x000002AC285E0000-0x000002AC285E6000-memory.dmp
memory/2380-11-0x000002AC41000000-0x000002AC4101A000-memory.dmp
memory/2380-0-0x00000000004D0000-0x00000000004F0000-memory.dmp
memory/2380-3-0x00007FFA64800000-0x00007FFA652C1000-memory.dmp
memory/2380-13-0x00007FFA637A7000-0x00007FFA637A8000-memory.dmp
memory/2380-24-0x00007FFA6192D000-0x00007FFA6192E000-memory.dmp
memory/2380-21-0x00007FFA640B9000-0x00007FFA640BA000-memory.dmp
memory/2380-22-0x000002AC42400000-0x000002AC42FB0000-memory.dmp
memory/2380-23-0x000002AC43A60000-0x000002AC43C54000-memory.dmp
memory/2380-20-0x00007FFA640B8000-0x00007FFA640B9000-memory.dmp
memory/2380-25-0x000002AC28600000-0x000002AC28610000-memory.dmp
memory/2380-26-0x000002AC28600000-0x000002AC28610000-memory.dmp
memory/2380-27-0x00007FFA61944000-0x00007FFA61945000-memory.dmp
memory/2380-1-0x000002AC28640000-0x000002AC28682000-memory.dmp
memory/2380-29-0x000002AC28600000-0x000002AC28610000-memory.dmp
memory/2380-30-0x000002AC28600000-0x000002AC28610000-memory.dmp
memory/2380-31-0x000002AC28600000-0x000002AC28610000-memory.dmp