agenttesla | fe6371034d55bb7583081b03f4aec7274f8340cfea4740325cb52e1c6ac77f6d

Analysis

max time kernel
127s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XWorm v5.1-5.2.7z
Size

54.5MB
MD5

76219b3556e25086fc52f8e2b93fbd0c
SHA1

066a0f875820e51a60c3552a06b7b97f8bab6bbc
SHA256

fe6371034d55bb7583081b03f4aec7274f8340cfea4740325cb52e1c6ac77f6d
SHA512

ccc974b8e446409c7940ef8314b2a912a2f8c0272721148d4dca5b739702106e69c9c7d106137a576b7a7a846d4f9ac770685a07d7a588ba34d0167acb07f104
SSDEEP

786432:8IagoCEXKlCpMqIEJkseGG+5ELbzcFdcyt5/ks3FkAPYxpL+q7RRHEm+0NyvZZGl:8JgXCzIsGrPzcFrt1F3Yxxrr+4yvZE

Score

10^/10

agenttesla agilenet keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\Guna.UI2.dll	family_agenttesla
behavioral1/memory/1532-351-0x0000013C9E370000-0x0000013C9E564000-memory.dmp	family_agenttesla

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation cmd.exe
Executes dropped EXE 1 IoCs

Processes:

XWorm V5.2.exe

pid process

1532 XWorm V5.2.exe
Loads dropped DLL 1 IoCs

Processes:

XWorm V5.2.exe

pid process

1532 XWorm V5.2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	cmd.exe

pid	process
1532	XWorm V5.2.exe

pid	process
1532	XWorm V5.2.exe

Obfuscated with Agile.Net obfuscator 3 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWorm V5.2.exe	agile_net
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWorm V5.2.exe	agile_net
behavioral1/memory/1532-339-0x0000013C813F0000-0x0000013C82028000-memory.dmp	agile_net

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

XWorm V5.2.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XWorm V5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XWorm V5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XWorm V5.2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

Processes:

cmd.exe7zFM.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

4156 msedge.exe
4156 msedge.exe
3792 msedge.exe
3792 msedge.exe
2284 identity_helper.exe
2284 identity_helper.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

3620 7zFM.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3792 msedge.exe
3792 msedge.exe
3792 msedge.exe
3792 msedge.exe
3792 msedge.exe
3792 msedge.exe
3792 msedge.exe
3792 msedge.exe
3792 msedge.exe

pid	process
4156	msedge.exe
4156	msedge.exe
3792	msedge.exe
3792	msedge.exe
2284	identity_helper.exe
2284	identity_helper.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7zFM.exeXWorm V5.2.exe

description	pid	process
Token: SeRestorePrivilege	3620	7zFM.exe
Token: 35	3620	7zFM.exe
Token: SeSecurityPrivilege	3620	7zFM.exe
Token: SeDebugPrivilege	1532	XWorm V5.2.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

7zFM.exemsedge.exeXWorm V5.2.exe

pid	process
3620	7zFM.exe
3620	7zFM.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe
1532	XWorm V5.2.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exeXWorm V5.2.exemsedge.exe

description	pid	process	target process
PID 2968 wrote to memory of 3620	2968	cmd.exe	7zFM.exe
PID 2968 wrote to memory of 3620	2968	cmd.exe	7zFM.exe
PID 1532 wrote to memory of 3792	1532	XWorm V5.2.exe	msedge.exe
PID 1532 wrote to memory of 3792	1532	XWorm V5.2.exe	msedge.exe
PID 3792 wrote to memory of 1556	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 1556	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 3704	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 4156	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 4156	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 1108	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 1108	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 1108	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 1108	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 1108	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 1108	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 1108	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 1108	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 1108	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 1108	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 1108	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 1108	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 1108	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 1108	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 1108	3792	msedge.exe	msedge.exe
PID 3792 wrote to memory of 1108	3792	msedge.exe	msedge.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\XWorm v5.1-5.2.7z"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2968

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm v5.1-5.2.7z"
2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3620

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2284

C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWorm V5.2.exe
"C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWorm V5.2.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff887c346f8,0x7ff887c34708,0x7ff887c34718
3⤵
PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,2159433217345117911,8360160193707965445,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
3⤵
PID:3704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,2159433217345117911,8360160193707965445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,2159433217345117911,8360160193707965445,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
3⤵
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2159433217345117911,8360160193707965445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
3⤵
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2159433217345117911,8360160193707965445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
3⤵
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2159433217345117911,8360160193707965445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
3⤵
PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,2159433217345117911,8360160193707965445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3548 /prefetch:8
3⤵
PID:1788

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,2159433217345117911,8360160193707965445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3548 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2159433217345117911,8360160193707965445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
3⤵
PID:5560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2159433217345117911,8360160193707965445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
3⤵
PID:5568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2159433217345117911,8360160193707965445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
3⤵
PID:5820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2159433217345117911,8360160193707965445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:1
3⤵
PID:5828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2159433217345117911,8360160193707965445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
3⤵
PID:5224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2159433217345117911,8360160193707965445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
3⤵
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
2⤵
PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff887c346f8,0x7ff887c34708,0x7ff887c34718
3⤵
PID:1288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4548

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a68ba46f0b79dc639830aee4dae4dc19

SHA1
86cacfc1e1b929f92389d68df8380d864b7bc2f3

SHA256
00881350aea709590abea59c7629896d2cda6d883af06df8f205e79737a2f17c

SHA512
08ca336a21dde868dabb25eb8f7575bbb76dfcc9bd309dff076dc1de25e68401f52e15bfc543b5929188f144d76211eeabeb7c8deeb57b6f9c61d43af1d9a4c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
1f346334e48f2c0ccbcb8ab89b79b213

SHA1
084d2c4d37d2ea6ef62e4c6ba4e59d1c1d891a2e

SHA256
d08d33d6d20f4bcf300cdb1e65921f42b42bb260518d2697cbb76f6b2c467d79

SHA512
df1af966de77dd303b0466849478c13f0b205a7e7e977227db17c670205e2ea7ee77f4e256a86457427cbe29d7e552f9a6204067e6c1ae08e42ac24a158862f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
3e97a9c4949cbf169cc5ccc9df1f2ac5

SHA1
156aa57fc41984057cd6bae57b83492e49111e69

SHA256
33ed38e3a5554b8e5615bbb8691c805aeaae7437152f57288ad19feb4fabed61

SHA512
6767255361b5f8bb5b793e74ab36dd304212cf527030937fc338cb7d78edbc2b445977584ecacc12d964640b167326431d8eeca0f0107a51b084f53164fbf2ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
538B

MD5
c3270fe1b81aab231678b41c9ffcc865

SHA1
1bc344c32c8cb02ca89fb5837cc902cdc382288e

SHA256
ad87c40f753cfcc7528b63e5814dd9dd970d11ad6ae983a5b398d6095a270e04

SHA512
1ea9f9a0179b474a4b595a4b56a7e89fb0191b05128605d815742c42d61a1d8c1036b9362cf98102ccb185ee789e295198e8df60ad1f2f9252740b6cc5680d56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5921e6.TMP
Filesize
538B

MD5
7d207e3ddaa80988567d108deddda27d

SHA1
9031c95dd82859395ecd8a8a5334c34a80fc9ab6

SHA256
6fe3594320647d1d9b4c681e821fb1a0fd963a6760a7cbe874943dabea801d6c

SHA512
6ce6ed088b96070f240bdf4413745f86e64f406bfd63c8bc0b2c64cfe56808ae81e7f6c15461dacc70d4e3a646ed3c7babcfe72e3661823871fd6edae9ad4832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
e551fe25d0825e7d960ce929d340d9be

SHA1
86be8e6007bcb98204b73c887759d8dc60da33c0

SHA256
81ef48740c525aa0368222c034ea44f82e2271b753a9ba7510ebd44c0484876d

SHA512
022d2716a811d12a05b94014cf70569933b8fee860f30ef923b677213c5367deb9b3bf52fd221ec171d924676065931bf37df7076bc2d265ffabdad90c7f7792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
61e324ac41355171480757ab47675aac

SHA1
06b6d51f20defca1e1381c0502db591989711062

SHA256
5f0b6a316877ba22556ddef658663bd4b2bf25a3ad0f550d45c4e4c51c561792

SHA512
ed93c99824c113d9440be6704493ec7e1d7de78100fedfb08bf09b516fea0dce07f7f1dfd7a35f9433f8194bc3caf259f0154d2b3aabbc45d09eb83c6459cb97

Download Submit
C:\Users\Admin\AppData\Local\Temp\TMzpx\TMzpx.dll
Filesize
112KB

MD5
2f1a50031dcf5c87d92e8b2491fdcea6

SHA1
71e2aaa2d1bb7dbe32a00e1d01d744830ecce08f

SHA256
47578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed

SHA512
1c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8

Download Submit
C:\Users\Admin\Desktop\XWorm\XWorm V5.1\Icons\icon (15).ico
Filesize
361KB

MD5
e3143e8c70427a56dac73a808cba0c79

SHA1
63556c7ad9e778d5bd9092f834b5cc751e419d16

SHA256
b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

SHA512
74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

Download Submit
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\GeoIP.dat
Filesize
1.2MB

MD5
8ef41798df108ce9bd41382c9721b1c9

SHA1
1e6227635a12039f4d380531b032bf773f0e6de0

SHA256
bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

SHA512
4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b

Download Submit
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\Guna.UI2.dll
Filesize
1.9MB

MD5
bcc0fe2b28edd2da651388f84599059b

SHA1
44d7756708aafa08730ca9dbdc01091790940a4f

SHA256
c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

SHA512
3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

Download Submit
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWorm V5.2.exe
Filesize
8.1MB

MD5
459508266d4a11d309df12a0bf4ab784

SHA1
02a04f37239ebc2eb2afb0eb9801200437854eb0

SHA256
f1a37293f3b700e499ef93f01001a2ca676b099c497238690cb27083cb7d32c6

SHA512
45c4fde1c484b54905030c02d8953ae5cc32809aa82a35df7c0fd53ba3afd75d4d574ac63a65002ecf95ed99b77d6d3c0e1506971ee1348c9ff54c90c15670d0

Download Submit
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWorm V5.2.exe
Filesize
8.2MB

MD5
80b0fe5dda710d80b91612ed5c12efbe

SHA1
b9c25520dbdf2a30e805a82c8ae383529a3b303b

SHA256
2593689bfc61de626e7c968d4896793ca722942d5d56955f8b4c808eebc1294c

SHA512
548f0df1ec1d50faf014c36621089a87ef012b22955c12aeba7d3fe7fc8b4b5db375dd6d3d92303dea4d0a57f3af4e3ece475270cce0030efd89b77115ed78d6

Download Submit
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWorm V5.2.exe.config
Filesize
183B

MD5
66f09a3993dcae94acfe39d45b553f58

SHA1
9d09f8e22d464f7021d7f713269b8169aed98682

SHA256
7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7

SHA512
c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed

Download Submit
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWormLoader 5.2 x32.exe.config
Filesize
187B

MD5
15c8c4ba1aa574c0c00fd45bb9cce1ab

SHA1
0dad65a3d4e9080fa29c42aa485c6102d2fa8bc8

SHA256
f82338e8e9c746b5d95cd2ccc7bf94dd5de2b9b8982fffddf2118e475de50e15

SHA512
52baac63399340427b94bfdeb7a42186d5359ce439c3d775497f347089edfbf72a6637b23bb008ab55b8d4dd3b79a7b2eb7c7ef922ea23d0716d5c3536b359d4

Download Submit
\??\pipe\LOCAL\crashpad_3792_KQHSMURBHRIPQLLP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1532-348-0x0000013C9D570000-0x0000013C9D580000-memory.dmp

Filesize
64KB

Download
memory/1532-394-0x0000013C9D570000-0x0000013C9D580000-memory.dmp

Filesize
64KB

Download
memory/1532-356-0x00007FF885760000-0x00007FF886221000-memory.dmp

Filesize
10.8MB

Download
memory/1532-401-0x0000013C9D570000-0x0000013C9D580000-memory.dmp

Filesize
64KB

Download
memory/1532-402-0x0000013C9D570000-0x0000013C9D580000-memory.dmp

Filesize
64KB

Download
memory/1532-354-0x0000013C9D570000-0x0000013C9D580000-memory.dmp

Filesize
64KB

Download
memory/1532-353-0x0000013C9D570000-0x0000013C9D580000-memory.dmp

Filesize
64KB

Download
memory/1532-425-0x0000013C9D570000-0x0000013C9D580000-memory.dmp

Filesize
64KB

Download
memory/1532-352-0x0000013C9D570000-0x0000013C9D580000-memory.dmp

Filesize
64KB

Download
memory/1532-351-0x0000013C9E370000-0x0000013C9E564000-memory.dmp

Filesize
2.0MB

Download
memory/1532-349-0x0000013C9D580000-0x0000013C9E16C000-memory.dmp

Filesize
11.9MB

Download
memory/1532-339-0x0000013C813F0000-0x0000013C82028000-memory.dmp

Filesize
12.2MB

Download
memory/1532-340-0x00007FF885760000-0x00007FF886221000-memory.dmp

Filesize
10.8MB

Download