Analysis
- max time kernel
147s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
28/05/2024, 23:46
General
- Target XWorm V5.2/XWormLoader 5.2 x32.exe
- Size 109KB
- Sample240528-3sd1eaae48
- SHA256 2d74eb709aea89a181cf8dfcc7e551978889f0d875401a2f1140487407bf18ae
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla payload 1 IoCs
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm V5.2\XWormLoader 5.2 x32.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V5.2\XWormLoader 5.2 x32.exe"1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
aPjMR.dll
memory/3504-18-0x0000000005CD0000-0x0000000006908000-memory.dmp
memory/3504-19-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/3504-3-0x0000000004DD0000-0x0000000004E6C000-memory.dmp
memory/3504-4-0x0000000004D70000-0x0000000004D98000-memory.dmp
memory/3504-5-0x0000000002590000-0x0000000002596000-memory.dmp
memory/3504-6-0x0000000004ED0000-0x0000000004F2E000-memory.dmp
memory/3504-7-0x0000000004F30000-0x0000000004F86000-memory.dmp
memory/3504-8-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/3504-9-0x0000000004DB0000-0x0000000004DB6000-memory.dmp
memory/3504-10-0x0000000004E90000-0x0000000004E96000-memory.dmp
memory/3504-11-0x0000000004FD0000-0x000000000500C000-memory.dmp
memory/3504-12-0x0000000005040000-0x000000000505A000-memory.dmp
memory/3504-13-0x0000000004FC0000-0x0000000004FD0000-memory.dmp
memory/3504-16-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/3504-2-0x0000000000A80000-0x0000000000AC2000-memory.dmp
memory/3504-17-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/3504-21-0x00000000052F0000-0x0000000005382000-memory.dmp
memory/3504-20-0x0000000006910000-0x0000000006EB4000-memory.dmp
memory/3504-0-0x00000000744BE000-0x00000000744BF000-memory.dmp
memory/3504-1-0x0000000000B20000-0x0000000000B40000-memory.dmp
memory/3504-28-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/3504-29-0x000000000A1E0000-0x000000000ADCC000-memory.dmp
memory/3504-30-0x00000000009F0000-0x00000000009FA000-memory.dmp
memory/3504-31-0x0000000005C20000-0x0000000005C76000-memory.dmp
memory/3504-32-0x000000000AFD0000-0x000000000B1C4000-memory.dmp
memory/3504-33-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/3504-34-0x000000000CAC0000-0x000000000CB26000-memory.dmp
memory/3504-35-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/3504-36-0x00000000744BE000-0x00000000744BF000-memory.dmp
memory/3504-37-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/3504-38-0x00000000744B0000-0x0000000074C60000-memory.dmp