Resubmissions
08/06/2024, 18:20
240608-wyz2hafb421008/06/2024, 18:17
240608-ww7cssec5w1008/06/2024, 18:11
240608-ws439seb9v1019/05/2024, 22:52
240519-2txcpsfe7w19/05/2024, 22:48
240519-2rh3asfb6210Analysis
- max time kernel
120s - max time network
127s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
08/06/2024, 18:11
General
- Target XWorm-Rat-Remote-Administration-Tool--main/XHVNC.exe
- Size 1.9MB
- Sample240608-ws439seb9v
- SHA256 e92707537fe99713752f3d3f479fa68a0c8dd80439c13a2bb4ebb36a952b63fd
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\XHVNC.exe"C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\XHVNC.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
AgileDotNetRT.dll
memory/1368-13-0x0000000074A40000-0x000000007512E000-memory.dmp
memory/1368-16-0x0000000074A40000-0x000000007512E000-memory.dmp
memory/1368-3-0x0000000074A40000-0x000000007512E000-memory.dmp
memory/1368-1-0x0000000000BE0000-0x0000000000DCA000-memory.dmp
memory/1368-10-0x00000000753A0000-0x0000000075420000-memory.dmp
memory/1368-11-0x0000000074A40000-0x000000007512E000-memory.dmp
memory/1368-2-0x0000000005FE0000-0x0000000006204000-memory.dmp
memory/1368-14-0x0000000074A40000-0x000000007512E000-memory.dmp
memory/1368-12-0x0000000074A40000-0x000000007512E000-memory.dmp
memory/1368-15-0x0000000074A4E000-0x0000000074A4F000-memory.dmp
memory/1368-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmp
memory/1368-17-0x0000000074A40000-0x000000007512E000-memory.dmp
memory/1368-18-0x0000000074A40000-0x000000007512E000-memory.dmp
memory/1368-19-0x0000000074A40000-0x000000007512E000-memory.dmp
memory/1368-20-0x0000000074A40000-0x000000007512E000-memory.dmp