Analysis
- max time kernel
680s - max time network
675s - platform
windows11-21h2_x64 - resource
win11-20240426-en - resource tags
- submitted
08/06/2024, 23:50
General
- Target sexy.rar
- Size 34.5MB
- Sample240608-3vsxcaac9z
- SHA256 264c33358030655653d02cf653ca7f2e56a897b28689cdb35e015259afb71731
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- AgentTesla payload 2 IoCs
- Executes dropped EXE 3 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 9 IoCs
- Modifies registry class 33 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 5 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\sexy.rar1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\sexy\" -spe -an -ai#7zMap13575:88:7zEvent176011⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\sexy\Xworm V5.6.exe"C:\Users\Admin\AppData\Local\Temp\sexy\Xworm V5.6.exe"1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004EC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\sexy\Xworm V5.6.exe"C:\Users\Admin\AppData\Local\Temp\sexy\Xworm V5.6.exe"1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\sexy\Xworm V5.6.exe"C:\Users\Admin\AppData\Local\Temp\sexy\Xworm V5.6.exe"1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1qzqluca\1qzqluca.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8AAB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA005F5F473C14F3696A86A47FD3AC62.TMP"3⤵
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Xworm V5.6.exe.log
1qzqluca.0.vb
1qzqluca.cmdline
RES8AAB.tmp
cookies.json
GeoIP.dat
Guna.UI2.dll
icon (15).ico
SimpleObfuscator.dll
Intro.wav
Xworm V5.6.exe
Xworm V5.6.exe
Xworm V5.6.exe.config
vbcA005F5F473C14F3696A86A47FD3AC62.TMP
memory/2000-347-0x000001EF41F20000-0x000001EF41F66000-memory.dmp
memory/2000-351-0x000001EF41FC0000-0x000001EF41FCB000-memory.dmp
memory/2000-348-0x000001EF41F00000-0x000001EF41F09000-memory.dmp
memory/2000-349-0x000001EF41F90000-0x000001EF41F9D000-memory.dmp
memory/2000-350-0x000001EF41FA0000-0x000001EF41FBE000-memory.dmp
memory/2144-445-0x0000026BFC350000-0x0000026BFC4B8000-memory.dmp
memory/4776-325-0x000002352F980000-0x000002352F989000-memory.dmp
memory/4776-341-0x000002352F980000-0x000002352F989000-memory.dmp
memory/4776-340-0x000002352F930000-0x000002352F976000-memory.dmp
memory/4776-342-0x000002352F9B0000-0x000002352F9BD000-memory.dmp
memory/4776-326-0x000002352F9B0000-0x000002352F9BD000-memory.dmp
memory/4776-343-0x000002352F9C0000-0x000002352F9DE000-memory.dmp
memory/4776-324-0x000002352F930000-0x000002352F976000-memory.dmp
memory/4776-344-0x000002352F9E0000-0x000002352F9EB000-memory.dmp
memory/4776-327-0x000002352F9C0000-0x000002352F9DE000-memory.dmp
memory/4776-328-0x000002352F9E0000-0x000002352F9EB000-memory.dmp
memory/4776-321-0x0000023530A50000-0x0000023530C44000-memory.dmp
memory/4776-319-0x00000235140A0000-0x0000023514F88000-memory.dmp