agenttesla | f26803b764a54a90852b7fd274d5ced7a8a58f1715d3ab4b96900ad4f9dd0410

Analysis

max time kernel
116s
max time network
118s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
29-03-2024 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XWorm.V5.3.Optimized.Bin.7z
Size

29.5MB
MD5

187b25b9e02c2b5d01a70d9d1855dd7c
SHA1

d0c7d39012ad0507239a3b060ea42cc13b22eb65
SHA256

f26803b764a54a90852b7fd274d5ced7a8a58f1715d3ab4b96900ad4f9dd0410
SHA512

bea5cec59d0ebee26a71c78dc38da47a25ea7932d119868caf82b5e4bbbcecd8969abea80ad41b65352f264ced33c457a041c0d9f321c272a8f913802ee254ed
SSDEEP

786432:ILW4dBG6KKNtxT6xewFcJbnYrFWNbqjnZ5M5od:3wT6xhqRsubq15bd

Score

10^/10

agenttesla agilenet keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\Guna.UI2.dll	family_agenttesla
behavioral1/memory/3556-205-0x0000016EC6E10000-0x0000016EC7004000-memory.dmp	family_agenttesla

Executes dropped EXE 4 IoCs

Processes:

XWormLoader 5.2 x64.exeXWorm V5.2.exeXWormLoader 5.2 x64.exeXWormLoader 5.2 x64.exe

pid process

1404 XWormLoader 5.2 x64.exe
3556 XWorm V5.2.exe
700 XWormLoader 5.2 x64.exe
904 XWormLoader 5.2 x64.exe
Loads dropped DLL 3 IoCs

Processes:

XWorm V5.2.exeXWormLoader 5.2 x64.exeXWormLoader 5.2 x64.exe

pid process

3556 XWorm V5.2.exe
700 XWormLoader 5.2 x64.exe
904 XWormLoader 5.2 x64.exe

pid	process
1404	XWormLoader 5.2 x64.exe
3556	XWorm V5.2.exe
700	XWormLoader 5.2 x64.exe
904	XWormLoader 5.2 x64.exe

pid	process
3556	XWorm V5.2.exe
700	XWormLoader 5.2 x64.exe
904	XWormLoader 5.2 x64.exe

Obfuscated with Agile.Net obfuscator 3 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\XWorm V5.2.exe	agile_net
behavioral1/memory/1404-188-0x0000011E6EDA0000-0x0000011E6FB7E000-memory.dmp	agile_net
behavioral1/memory/3556-194-0x0000016EA9C30000-0x0000016EAAA0E000-memory.dmp	agile_net

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

XWorm V5.2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XWorm V5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XWorm V5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XWorm V5.2.exe

Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

7zFM.exeXWorm V5.2.exe

description	pid	process
Token: SeRestorePrivilege	652	7zFM.exe
Token: 35	652	7zFM.exe
Token: SeSecurityPrivilege	652	7zFM.exe
Token: SeSecurityPrivilege	652	7zFM.exe
Token: SeDebugPrivilege	3556	XWorm V5.2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

7zFM.exe

pid process

652 7zFM.exe
652 7zFM.exe
652 7zFM.exe

pid	process
652	7zFM.exe
652	7zFM.exe
652	7zFM.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.execmd.exe

description	pid	process	target process
PID 488 wrote to memory of 652	488	cmd.exe	7zFM.exe
PID 488 wrote to memory of 652	488	cmd.exe	7zFM.exe
PID 1680 wrote to memory of 904	1680	cmd.exe	XWormLoader 5.2 x64.exe
PID 1680 wrote to memory of 904	1680	cmd.exe	XWormLoader 5.2 x64.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\XWorm.V5.3.Optimized.Bin.7z
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:488

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm.V5.3.Optimized.Bin.7z"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:652

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1736

C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\XWormLoader 5.2 x64.exe
"C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\XWormLoader 5.2 x64.exe"
1⤵
- Executes dropped EXE
PID:1404

C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\XWorm V5.2.exe
"C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\XWorm V5.2.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\XWormLoader 5.2 x64.exe
"C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\XWormLoader 5.2 x64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\XWormLoader 5.2 x64.exe
"XWormLoader 5.2 x64.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XWormLoader 5.2 x64.exe.log
Filesize
740B

MD5
b83cd01b36bdda37ca025d7c9c2109db

SHA1
de7844d5b8e3a169014072bfadb9dff11f81c506

SHA256
0ed614e1980d5299f9b116949d20bb9e8be93695a3615116096ce679f4f87b6c

SHA512
a91bc1a1f66567cd791a0a9398930bd32b60c575df85134175cfb3ff24f3a375214742473d89c7d854cbbc9c6c490eba0df7fdb8bd0138294fcb2ed02995f545

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zEC829F5D8\XWorm V5.3 Optimized Bin\Icons\icon (15).ico
Filesize
361KB

MD5
e3143e8c70427a56dac73a808cba0c79

SHA1
63556c7ad9e778d5bd9092f834b5cc751e419d16

SHA256
b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

SHA512
74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RFZzY\RFZzY.dll
Filesize
112KB

MD5
2f1a50031dcf5c87d92e8b2491fdcea6

SHA1
71e2aaa2d1bb7dbe32a00e1d01d744830ecce08f

SHA256
47578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed

SHA512
1c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8

Download Submit
C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\Guna.UI2.dll
Filesize
1.9MB

MD5
bcc0fe2b28edd2da651388f84599059b

SHA1
44d7756708aafa08730ca9dbdc01091790940a4f

SHA256
c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

SHA512
3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

Download Submit
C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\Mono.Cecil.dll
Filesize
350KB

MD5
de69bb29d6a9dfb615a90df3580d63b1

SHA1
74446b4dcc146ce61e5216bf7efac186adf7849b

SHA256
f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc

SHA512
6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015

Download Submit
C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\MonoMod.Backports.dll
Filesize
138KB

MD5
dd43356f07fc0ce082db4e2f102747a2

SHA1
aa0782732e2d60fa668b0aadbf3447ef70b6a619

SHA256
e375b83a3e242212a2ed9478e1f0b8383c1bf1fdfab5a1cf766df740b631afd6

SHA512
284d64b99931ed1f2e839a7b19ee8389eefaf6c72bac556468a01f3eb17000252613c01dbae88923e9a02f3c84bcab02296659648fad727123f63d0ac38d258e

Download Submit
C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\MonoMod.Core.dll
Filesize
216KB

MD5
b808181453b17f3fc1ab153bf11be197

SHA1
bce86080b7eb76783940d1ff277e2b46f231efe9

SHA256
da00cdfab411f8f535f17258981ec51d1af9b0bfcee3a360cbd0cb6f692dbcdd

SHA512
a2d941c6e69972f99707ade5c5325eb50b0ec4c5abf6a189eb11a46606fed8076be44c839d83cf310b67e66471e0ea3f6597857a8e2c7e2a7ad6de60c314f7d3

Download Submit
C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\MonoMod.ILHelpers.dll
Filesize
6KB

MD5
6512e89e0cb92514ef24be43f0bf4500

SHA1
a039c51f89656d9d5c584f063b2b675a9ff44b8e

SHA256
1411e4858412ded195f0e65544a4ec8e8249118b76375050a35c076940826cd0

SHA512
9ffb2ff050cce82dbfbbb0e85ab5f976fcd81086b3d8695502c5221c23d14080f0e494a33e0092b4feb2eda12e2130a2f02df3125733c2f5ec31356e92dea00b

Download Submit
C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\MonoMod.Utils.dll
Filesize
319KB

MD5
79f1c4c312fdbb9258c2cdde3772271f

SHA1
a143434883e4ef2c0190407602b030f5c4fdf96f

SHA256
f22a4fa1e8b1b70286ecf07effb15d2184454fa88325ce4c0f31ffadb4bef50a

SHA512
b28ed3c063ae3a15cd52e625a860bbb65f6cd38ccad458657a163cd927c74ebf498fb12f1e578e869bcea00c6cd3f47ede10866e34a48c133c5ac26b902ae5d9

Download Submit
C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\RVGLib.dll
Filesize
241KB

MD5
d34c13128c6c7c93af2000a45196df81

SHA1
664c821c9d2ed234aea31d8b4f17d987e4b386f1

SHA256
aaf9fb0158bd40ab562a4212c2a795cb40ef6864042dc12f3a2415f2446ba1c7

SHA512
91f4e0e795f359b03595b01cbf29188a2a0b52ab9d64eadd8fb8b3508e417b8c7a70be439940975bf5bdf26493ea161aa45025beb83bc95076ed269e82d39689

Download Submit
C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\XWorm V5.2.exe
Filesize
13.8MB

MD5
897201dc6254281404ab74aa27790a71

SHA1
9409ddf7e72b7869f4d689c88f9bbc1bc241a56e

SHA256
f41828bd13a3a85fdf7a1d688b21ce33d2015c3c5f46b4d92ab6ea8ea019e03a

SHA512
2673cd7b927ffc22f3a4b4fbfcb1b4f576c416d67168e486e6d79fdd132129c9e244e36d7b7883a4a1ed51e993cc4384bf24f2fa3129584f2bd43fd16042de20

Download Submit
C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\XWorm V5.2.exe.config
Filesize
183B

MD5
66f09a3993dcae94acfe39d45b553f58

SHA1
9d09f8e22d464f7021d7f713269b8169aed98682

SHA256
7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7

SHA512
c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed

Download Submit
C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\XWormLoader 5.2 x64.exe
Filesize
109KB

MD5
e6a20535b636d6402164a8e2d871ef6d

SHA1
981cb1fd9361ca58f8985104e00132d1836a8736

SHA256
b461c985b53de4f6921d83925b3c2a62de3bbc5b8f9c02eecd27926f0197fae2

SHA512
35856a0268ed9d17b1570d5392833ed168c8515d73fac9f150cf63cc1aea61c096aa2e6b3c8e091a1058ba062f9333f6767e323a37dfb6f4fa7e508a2a138a30

Download Submit
C:\Users\Admin\Desktop\XWorm V5.3 Optimized Bin\XWormLoader 5.2 x64.exe.config
Filesize
187B

MD5
15c8c4ba1aa574c0c00fd45bb9cce1ab

SHA1
0dad65a3d4e9080fa29c42aa485c6102d2fa8bc8

SHA256
f82338e8e9c746b5d95cd2ccc7bf94dd5de2b9b8982fffddf2118e475de50e15

SHA512
52baac63399340427b94bfdeb7a42186d5359ce439c3d775497f347089edfbf72a6637b23bb008ab55b8d4dd3b79a7b2eb7c7ef922ea23d0716d5c3536b359d4

Download Submit
memory/700-215-0x0000027A39920000-0x0000027A39926000-memory.dmp

Filesize
24KB

Download
memory/700-220-0x00007FFC29C60000-0x00007FFC2A722000-memory.dmp

Filesize
10.8MB

Download
memory/700-217-0x00007FFC28C07000-0x00007FFC28C08000-memory.dmp

Filesize
4KB

Download
memory/700-216-0x0000027A3B100000-0x0000027A3B106000-memory.dmp

Filesize
24KB

Download
memory/700-214-0x0000027A3B310000-0x0000027A3B320000-memory.dmp

Filesize
64KB

Download
memory/700-213-0x00007FFC29C60000-0x00007FFC2A722000-memory.dmp

Filesize
10.8MB

Download
memory/700-212-0x0000000000EA0000-0x0000000000EC0000-memory.dmp

Filesize
128KB

Download
memory/904-226-0x00007FFC28C07000-0x00007FFC28C08000-memory.dmp

Filesize
4KB

Download
memory/904-228-0x00007FFC29C60000-0x00007FFC2A722000-memory.dmp

Filesize
10.8MB

Download
memory/904-225-0x00000194D5550000-0x00000194D5556000-memory.dmp

Filesize
24KB

Download
memory/904-224-0x00000194D54F0000-0x00000194D54F6000-memory.dmp

Filesize
24KB

Download
memory/904-223-0x00000194D5500000-0x00000194D5510000-memory.dmp

Filesize
64KB

Download
memory/904-222-0x00007FFC29C60000-0x00007FFC2A722000-memory.dmp

Filesize
10.8MB

Download
memory/1404-183-0x0000011E53C40000-0x0000011E53C46000-memory.dmp

Filesize
24KB

Download
memory/1404-186-0x0000011E6DD20000-0x0000011E6DD3A000-memory.dmp

Filesize
104KB

Download
memory/1404-182-0x0000011E53C30000-0x0000011E53C36000-memory.dmp

Filesize
24KB

Download
memory/1404-169-0x0000000000EA0000-0x0000000000EC0000-memory.dmp

Filesize
128KB

Download
memory/1404-181-0x0000011E6DD90000-0x0000011E6DDA0000-memory.dmp

Filesize
64KB

Download
memory/1404-175-0x0000011E53CB0000-0x0000011E53CB6000-memory.dmp

Filesize
24KB

Download
memory/1404-176-0x00007FFC29C60000-0x00007FFC2A722000-memory.dmp

Filesize
10.8MB

Download
memory/1404-185-0x0000011E6DF80000-0x0000011E6DFBC000-memory.dmp

Filesize
240KB

Download
memory/1404-180-0x0000011E6DF20000-0x0000011E6DF76000-memory.dmp

Filesize
344KB

Download
memory/1404-173-0x0000011E53D00000-0x0000011E53D28000-memory.dmp

Filesize
160KB

Download
memory/1404-188-0x0000011E6EDA0000-0x0000011E6FB7E000-memory.dmp

Filesize
13.9MB

Download
memory/1404-171-0x0000011E53C60000-0x0000011E53CA2000-memory.dmp

Filesize
264KB

Download
memory/1404-178-0x0000011E6DDA0000-0x0000011E6DDFE000-memory.dmp

Filesize
376KB

Download
memory/1404-190-0x00007FFC29C60000-0x00007FFC2A722000-memory.dmp

Filesize
10.8MB

Download
memory/3556-194-0x0000016EA9C30000-0x0000016EAAA0E000-memory.dmp

Filesize
13.9MB

Download
memory/3556-193-0x00007FFC29C60000-0x00007FFC2A722000-memory.dmp

Filesize
10.8MB

Download
memory/3556-202-0x0000016EAC6F0000-0x0000016EAC700000-memory.dmp

Filesize
64KB

Download
memory/3556-206-0x0000016EAC6F0000-0x0000016EAC700000-memory.dmp

Filesize
64KB

Download
memory/3556-209-0x00007FFC29C60000-0x00007FFC2A722000-memory.dmp

Filesize
10.8MB

Download
memory/3556-205-0x0000016EC6E10000-0x0000016EC7004000-memory.dmp

Filesize
2.0MB

Download
memory/3556-207-0x0000016EAC6F0000-0x0000016EAC700000-memory.dmp

Filesize
64KB

Download
memory/3556-203-0x0000016EC5E30000-0x0000016EC6A1C000-memory.dmp

Filesize
11.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads