agenttesla | fe6371034d55bb7583081b03f4aec7274f8340cfea4740325cb52e1c6ac77f6d

General

Target

XWorm/XWorm V5.2/XWormLoader 5.2 x32.exe
Size

109KB
MD5

f3b2ec58b71ba6793adcc2729e2140b1
SHA1

d9e93a33ac617afe326421df4f05882a61e0a4f2
SHA256

2d74eb709aea89a181cf8dfcc7e551978889f0d875401a2f1140487407bf18ae
SHA512

473edcaba9cb8044e28e30fc502a08a648359b3ed0deba85e559fe76b484fc8db0fc2375f746851623e30be33da035cec1d6038e1fcf4842a2afb6f9cd397495
SSDEEP

1536:5vjAnXqn2nY7WfRMgPQQrMoqmyVttdGFQeOPigx:5LCan2nY7sdQQAoqmyBeu

Score

10^/10

agenttesla agilenet keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2148-32-0x000000000C4F0000-0x000000000C6E4000-memory.dmp	family_agenttesla

Loads dropped DLL 1 IoCs

Processes:

XWormLoader 5.2 x32.exe

pid process

2148 XWormLoader 5.2 x32.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/2148-18-0x00000000069D0000-0x0000000007608000-memory.dmp	agile_net

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

XWormLoader 5.2 x32.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	XWormLoader 5.2 x32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	XWormLoader 5.2 x32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

XWormLoader 5.2 x32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XWormLoader 5.2 x32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XWormLoader 5.2 x32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XWormLoader 5.2 x32.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

XWormLoader 5.2 x32.exe

pid	process
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe
2148	XWormLoader 5.2 x32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

XWormLoader 5.2 x32.exeAUDIODG.EXE

description pid process

Token: SeDebugPrivilege 2148 XWormLoader 5.2 x32.exe
Token: 33 4596 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 4596 AUDIODG.EXE
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

XWormLoader 5.2 x32.exe

pid process

2148 XWormLoader 5.2 x32.exe
2148 XWormLoader 5.2 x32.exe
2148 XWormLoader 5.2 x32.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

XWormLoader 5.2 x32.exe

pid process

2148 XWormLoader 5.2 x32.exe
2148 XWormLoader 5.2 x32.exe
2148 XWormLoader 5.2 x32.exe

description	pid	process
Token: SeDebugPrivilege	2148	XWormLoader 5.2 x32.exe
Token: 33	4596	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4596	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\XWorm\XWorm V5.2\XWormLoader 5.2 x32.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm\XWorm V5.2\XWormLoader 5.2 x32.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2148

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:764

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4596

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aPjMR\aPjMR.dll
Filesize
84KB

MD5
0b0e63957367e620b8697c5341af35b9

SHA1
69361c2762b2d1cada80667cd55bc5082e60af86

SHA256
bd9cdcfaa0edecdb89a204965d20f4a896c6650d4840e28736d9bd832390e1c5

SHA512
07d0e52c863f52ecb3d12fab9e71c7a18d54cbedb47250bee7e4297ff72ed793c23a2735c48090c261fe4633d53d03e305c1338dfc881bb86874d1633ff6ecee

Download Submit
memory/2148-18-0x00000000069D0000-0x0000000007608000-memory.dmp

Filesize
12.2MB

Download
memory/2148-37-0x0000000074910000-0x00000000750C1000-memory.dmp

Filesize
7.7MB

Download
memory/2148-3-0x0000000005AA0000-0x0000000005B3C000-memory.dmp

Filesize
624KB

Download
memory/2148-4-0x0000000005A10000-0x0000000005A38000-memory.dmp

Filesize
160KB

Download
memory/2148-5-0x00000000059E0000-0x00000000059E6000-memory.dmp

Filesize
24KB

Download
memory/2148-6-0x0000000005B40000-0x0000000005B9E000-memory.dmp

Filesize
376KB

Download
memory/2148-19-0x0000000074910000-0x00000000750C1000-memory.dmp

Filesize
7.7MB

Download
memory/2148-8-0x0000000074910000-0x00000000750C1000-memory.dmp

Filesize
7.7MB

Download
memory/2148-9-0x0000000005C00000-0x0000000005C06000-memory.dmp

Filesize
24KB

Download
memory/2148-10-0x0000000005C40000-0x0000000005C46000-memory.dmp

Filesize
24KB

Download
memory/2148-11-0x0000000005CC0000-0x0000000005CFC000-memory.dmp

Filesize
240KB

Download
memory/2148-12-0x0000000005D40000-0x0000000005D5A000-memory.dmp

Filesize
104KB

Download
memory/2148-13-0x0000000005CB0000-0x0000000005CC0000-memory.dmp

Filesize
64KB

Download
memory/2148-16-0x0000000074910000-0x00000000750C1000-memory.dmp

Filesize
7.7MB

Download
memory/2148-39-0x0000000074910000-0x00000000750C1000-memory.dmp

Filesize
7.7MB

Download
memory/2148-2-0x00000000055E0000-0x0000000005622000-memory.dmp

Filesize
264KB

Download
memory/2148-7-0x0000000005BA0000-0x0000000005BF6000-memory.dmp

Filesize
344KB

Download
memory/2148-20-0x0000000007610000-0x0000000007BB6000-memory.dmp

Filesize
5.6MB

Download
memory/2148-21-0x00000000060F0000-0x0000000006182000-memory.dmp

Filesize
584KB

Download
memory/2148-1-0x00000000004F0000-0x0000000000510000-memory.dmp

Filesize
128KB

Download
memory/2148-28-0x0000000074910000-0x00000000750C1000-memory.dmp

Filesize
7.7MB

Download
memory/2148-29-0x000000000AF00000-0x000000000BAEC000-memory.dmp

Filesize
11.9MB

Download
memory/2148-30-0x00000000030C0000-0x00000000030CA000-memory.dmp

Filesize
40KB

Download
memory/2148-31-0x00000000067F0000-0x0000000006846000-memory.dmp

Filesize
344KB

Download
memory/2148-32-0x000000000C4F0000-0x000000000C6E4000-memory.dmp

Filesize
2.0MB

Download
memory/2148-33-0x0000000074910000-0x00000000750C1000-memory.dmp

Filesize
7.7MB

Download
memory/2148-34-0x000000000ED90000-0x000000000EDF6000-memory.dmp

Filesize
408KB

Download
memory/2148-35-0x000000007491E000-0x000000007491F000-memory.dmp

Filesize
4KB

Download
memory/2148-36-0x0000000074910000-0x00000000750C1000-memory.dmp

Filesize
7.7MB

Download
memory/2148-0-0x000000007491E000-0x000000007491F000-memory.dmp

Filesize
4KB

Download
memory/2148-38-0x0000000074910000-0x00000000750C1000-memory.dmp

Filesize
7.7MB

Download
memory/2148-17-0x0000000074910000-0x00000000750C1000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads