Analysis
- max time kernel
18s - max time network
22s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
- submitted
01/07/2024, 05:42
General
- Target Xworm-V5.6/XWorm V5.6.exe
- Size 13.1MB
- Sample240701-gd99ea1clq
- SHA256 7efddbf0825853ea834ce3c763fa9828aa72cb4844e8a98c4b79eb832a138a0b
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla payload 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6\XWorm V5.6.exe"C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6\XWorm V5.6.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3400-0-0x00007FFF4A593000-0x00007FFF4A595000-memory.dmp
memory/3400-1-0x000001DB5ED80000-0x000001DB5FAAA000-memory.dmp
memory/3400-2-0x000001DB7A4C0000-0x000001DB7A6B4000-memory.dmp
memory/3400-3-0x00007FFF4A590000-0x00007FFF4B052000-memory.dmp
memory/3400-4-0x00007FFF4A590000-0x00007FFF4B052000-memory.dmp
memory/3400-5-0x00007FFF4A590000-0x00007FFF4B052000-memory.dmp
memory/3400-6-0x00007FFF4A590000-0x00007FFF4B052000-memory.dmp
memory/3400-7-0x00007FFF4A593000-0x00007FFF4A595000-memory.dmp
memory/3400-8-0x00007FFF4A590000-0x00007FFF4B052000-memory.dmp
memory/3400-12-0x000001DB03920000-0x000001DB0393E000-memory.dmp
memory/3400-13-0x000001DB03940000-0x000001DB0394B000-memory.dmp
memory/3400-9-0x000001DB03890000-0x000001DB038D6000-memory.dmp
memory/3400-11-0x000001DB03910000-0x000001DB0391D000-memory.dmp
memory/3400-10-0x000001DB038E0000-0x000001DB038E9000-memory.dmp