Resubmissions
08/06/2024, 18:20
240608-wyz2hafb421008/06/2024, 18:17
240608-ww7cssec5w1008/06/2024, 18:11
240608-ws439seb9v1019/05/2024, 22:52
240519-2txcpsfe7w19/05/2024, 22:48
240519-2rh3asfb6210Analysis
- max time kernel
135s - max time network
104s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
19/05/2024, 22:48
General
- Target XWorm-Rat-Remote-Administration-Tool--main/XHVNC.exe
- Size 1.9MB
- Sample240519-2rh3asfb62
- SHA256 e92707537fe99713752f3d3f479fa68a0c8dd80439c13a2bb4ebb36a952b63fd
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\XHVNC.exe"C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\XHVNC.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
AgileDotNetRT.dll
memory/1516-8-0x00000000068C0000-0x0000000006AE4000-memory.dmp
memory/1516-17-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/1516-3-0x0000000005560000-0x00000000055F2000-memory.dmp
memory/1516-4-0x0000000005600000-0x000000000569C000-memory.dmp
memory/1516-5-0x00000000056A0000-0x0000000005706000-memory.dmp
memory/1516-6-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/1516-7-0x0000000006630000-0x000000000663A000-memory.dmp
memory/1516-0-0x00000000748BE000-0x00000000748BF000-memory.dmp
memory/1516-2-0x0000000005A70000-0x0000000006014000-memory.dmp
memory/1516-1-0x0000000000910000-0x0000000000AFA000-memory.dmp
memory/1516-16-0x00000000732C0000-0x0000000073349000-memory.dmp
memory/1516-18-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/1516-19-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/1516-20-0x00000000748BE000-0x00000000748BF000-memory.dmp
memory/1516-21-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/1516-22-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/1516-23-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/1516-24-0x00000000748B0000-0x0000000075060000-memory.dmp