Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01-05-2024 01:31

General

  • Target

    XWorm v5.1-5.2/XWorm/XWorm V5.2/XWormLoader 5.2 x32.exe

  • Size

    109KB

  • MD5

    f3b2ec58b71ba6793adcc2729e2140b1

  • SHA1

    d9e93a33ac617afe326421df4f05882a61e0a4f2

  • SHA256

    2d74eb709aea89a181cf8dfcc7e551978889f0d875401a2f1140487407bf18ae

  • SHA512

    473edcaba9cb8044e28e30fc502a08a648359b3ed0deba85e559fe76b484fc8db0fc2375f746851623e30be33da035cec1d6038e1fcf4842a2afb6f9cd397495

  • SSDEEP

    1536:5vjAnXqn2nY7WfRMgPQQrMoqmyVttdGFQeOPigx:5LCan2nY7sdQQAoqmyBeu

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XWorm v5.1-5.2\XWorm\XWorm V5.2\XWormLoader 5.2 x32.exe
    "C:\Users\Admin\AppData\Local\Temp\XWorm v5.1-5.2\XWorm\XWorm V5.2\XWormLoader 5.2 x32.exe"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3288
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:388
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E0
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3180

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\aPjMR\aPjMR.dll
      Filesize

      84KB

      MD5

      0b0e63957367e620b8697c5341af35b9

      SHA1

      69361c2762b2d1cada80667cd55bc5082e60af86

      SHA256

      bd9cdcfaa0edecdb89a204965d20f4a896c6650d4840e28736d9bd832390e1c5

      SHA512

      07d0e52c863f52ecb3d12fab9e71c7a18d54cbedb47250bee7e4297ff72ed793c23a2735c48090c261fe4633d53d03e305c1338dfc881bb86874d1633ff6ecee

    • memory/3288-18-0x0000000073F1E000-0x0000000073F1F000-memory.dmp
      Filesize

      4KB

    • memory/3288-8-0x0000000005910000-0x0000000005920000-memory.dmp
      Filesize

      64KB

    • memory/3288-5-0x0000000005680000-0x0000000005686000-memory.dmp
      Filesize

      24KB

    • memory/3288-19-0x00000000072B0000-0x0000000007856000-memory.dmp
      Filesize

      5.6MB

    • memory/3288-3-0x00000000056E0000-0x0000000005708000-memory.dmp
      Filesize

      160KB

    • memory/3288-6-0x0000000005840000-0x000000000589E000-memory.dmp
      Filesize

      376KB

    • memory/3288-7-0x00000000058A0000-0x00000000058F6000-memory.dmp
      Filesize

      344KB

    • memory/3288-20-0x0000000005D90000-0x0000000005E22000-memory.dmp
      Filesize

      584KB

    • memory/3288-9-0x00000000057E0000-0x00000000057E6000-memory.dmp
      Filesize

      24KB

    • memory/3288-10-0x0000000005810000-0x0000000005816000-memory.dmp
      Filesize

      24KB

    • memory/3288-11-0x0000000005970000-0x00000000059AC000-memory.dmp
      Filesize

      240KB

    • memory/3288-12-0x00000000059E0000-0x00000000059FA000-memory.dmp
      Filesize

      104KB

    • memory/3288-13-0x0000000005960000-0x0000000005970000-memory.dmp
      Filesize

      64KB

    • memory/3288-1-0x0000000005280000-0x00000000052C2000-memory.dmp
      Filesize

      264KB

    • memory/3288-17-0x0000000006670000-0x00000000072A8000-memory.dmp
      Filesize

      12.2MB

    • memory/3288-0-0x0000000000B60000-0x0000000000B80000-memory.dmp
      Filesize

      128KB

    • memory/3288-4-0x0000000074FC0000-0x0000000075771000-memory.dmp
      Filesize

      7.7MB

    • memory/3288-2-0x0000000005740000-0x00000000057DC000-memory.dmp
      Filesize

      624KB

    • memory/3288-14-0x0000000005960000-0x0000000005970000-memory.dmp
      Filesize

      64KB

    • memory/3288-28-0x0000000074720000-0x0000000074721000-memory.dmp
      Filesize

      4KB

    • memory/3288-27-0x000000007471F000-0x0000000074720000-memory.dmp
      Filesize

      4KB

    • memory/3288-29-0x000000000B3E0000-0x000000000BFCC000-memory.dmp
      Filesize

      11.9MB

    • memory/3288-30-0x0000000001390000-0x000000000139A000-memory.dmp
      Filesize

      40KB

    • memory/3288-31-0x0000000006580000-0x00000000065D6000-memory.dmp
      Filesize

      344KB

    • memory/3288-32-0x000000000C1D0000-0x000000000C3C4000-memory.dmp
      Filesize

      2.0MB

    • memory/3288-33-0x0000000005910000-0x0000000005920000-memory.dmp
      Filesize

      64KB

    • memory/3288-34-0x000000000E920000-0x000000000E986000-memory.dmp
      Filesize

      408KB

    • memory/3288-35-0x0000000074FC0000-0x0000000075771000-memory.dmp
      Filesize

      7.7MB

    • memory/3288-36-0x0000000005910000-0x0000000005920000-memory.dmp
      Filesize

      64KB

    • memory/3288-37-0x0000000005960000-0x0000000005970000-memory.dmp
      Filesize

      64KB

    • memory/3288-38-0x0000000005A00000-0x0000000005A10000-memory.dmp
      Filesize

      64KB

    • memory/3288-39-0x0000000005910000-0x0000000005920000-memory.dmp
      Filesize

      64KB

    • memory/3288-40-0x0000000005910000-0x0000000005920000-memory.dmp
      Filesize

      64KB