Overview
overview
10Static
static
10Xworm 5.6/NAudio.dll
windows10-1703-x64
1Xworm 5.6/...on.dll
windows10-1703-x64
1Xworm 5.6/...ws.dll
windows10-1703-x64
1Xworm 5.6/...at.dll
windows10-1703-x64
1Xworm 5.6/...um.dll
windows10-1703-x64
1Xworm 5.6/...rd.dll
windows10-1703-x64
1Xworm 5.6/...ss.dll
windows10-1703-x64
1Xworm 5.6/...er.dll
windows10-1703-x64
1Xworm 5.6/...er.dll
windows10-1703-x64
1Xworm 5.6/...er.dll
windows10-1703-x64
1Xworm 5.6/...DP.dll
windows10-1703-x64
1Xworm 5.6/...NC.dll
windows10-1703-x64
1Xworm 5.6/...ry.dll
windows10-1703-x64
1Xworm 5.6/...ps.dll
windows10-1703-x64
1Xworm 5.6/...ns.dll
windows10-1703-x64
1Xworm 5.6/...er.dll
windows10-1703-x64
1Xworm 5.6/...ps.dll
windows10-1703-x64
1Xworm 5.6/...ox.dll
windows10-1703-x64
1Xworm 5.6/...ne.dll
windows10-1703-x64
1Xworm 5.6/...er.dll
windows10-1703-x64
1Xworm 5.6/...ns.dll
windows10-1703-x64
1Xworm 5.6/...me.dll
windows10-1703-x64
1Xworm 5.6/...ce.dll
windows10-1703-x64
1Xworm 5.6/...er.dll
windows10-1703-x64
1Xworm 5.6/...ms.dll
windows10-1703-x64
1Xworm 5.6/...re.dll
windows10-1703-x64
1Xworm 5.6/...ry.dll
windows10-1703-x64
1Xworm 5.6/...it.dll
windows10-1703-x64
1Xworm 5.6/...op.dll
windows10-1703-x64
1Xworm 5.6/...xy.dll
windows10-1703-x64
1Xworm 5.6/...PE.dll
windows10-1703-x64
1Xworm 5.6/....6.exe
windows10-1703-x64
10Analysis
-
max time kernel
131s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
09-07-2024 09:52
Behavioral task
behavioral1
Sample
Xworm 5.6/NAudio.dll
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Xworm 5.6/Newtonsoft.Json.dll
Resource
win10-20240611-en
Behavioral task
behavioral3
Sample
Xworm 5.6/Plugins/ActiveWindows.dll
Resource
win10-20240611-en
Behavioral task
behavioral4
Sample
Xworm 5.6/Plugins/Chat.dll
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
Xworm 5.6/Plugins/Chromium.dll
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
Xworm 5.6/Plugins/Clipboard.dll
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
Xworm 5.6/Plugins/Cmstp-Bypass.dll
Resource
win10-20240611-en
Behavioral task
behavioral8
Sample
Xworm 5.6/Plugins/FileManager.dll
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
Xworm 5.6/Plugins/FilesSearcher.dll
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
Xworm 5.6/Plugins/HBrowser.dll
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
Xworm 5.6/Plugins/HRDP.dll
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
Xworm 5.6/Plugins/HVNC.dll
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
Xworm 5.6/Plugins/HVNCMemory.dll
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
Xworm 5.6/Plugins/HiddenApps.dll
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
Xworm 5.6/Plugins/Informations.dll
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
Xworm 5.6/Plugins/Keylogger.dll
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
Xworm 5.6/Plugins/Maps.dll
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
Xworm 5.6/Plugins/MessageBox.dll
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
Xworm 5.6/Plugins/Microphone.dll
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
Xworm 5.6/Plugins/Ngrok-Installer.dll
Resource
win10-20240404-en
Behavioral task
behavioral21
Sample
Xworm 5.6/Plugins/Options.dll
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
Xworm 5.6/Plugins/Pastime.dll
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
Xworm 5.6/Plugins/Performance.dll
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
Xworm 5.6/Plugins/ProcessManager.dll
Resource
win10-20240404-en
Behavioral task
behavioral25
Sample
Xworm 5.6/Plugins/Programs.dll
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
Xworm 5.6/Plugins/Ransomware.dll
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
Xworm 5.6/Plugins/Recovery.dll
Resource
win10-20240404-en
Behavioral task
behavioral28
Sample
Xworm 5.6/Plugins/Regedit.dll
Resource
win10-20240404-en
Behavioral task
behavioral29
Sample
Xworm 5.6/Plugins/RemoteDesktop.dll
Resource
win10-20240404-en
Behavioral task
behavioral30
Sample
Xworm 5.6/Plugins/ReverseProxy.dll
Resource
win10-20240404-en
Behavioral task
behavioral31
Sample
Xworm 5.6/Plugins/RunPE.dll
Resource
win10-20240404-en
Behavioral task
behavioral32
Sample
Xworm 5.6/Xworm V5.6.exe
Resource
win10-20240404-en
General
-
Target
Xworm 5.6/Xworm V5.6.exe
-
Size
14.9MB
-
MD5
56ccb739926a725e78a7acf9af52c4bb
-
SHA1
5b01b90137871c3c8f0d04f510c4d56b23932cbc
-
SHA256
90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405
-
SHA512
2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1
-
SSDEEP
196608:P4/BAe1d4ihvy85JhhYc3BSL1kehn4inje:PuyIhhkRka4i
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral32/memory/5028-3-0x000001EDAC7C0000-0x000001EDAC9B4000-memory.dmp family_agenttesla -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
Xworm V5.6.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Xworm V5.6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Xworm V5.6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion Xworm V5.6.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5028-0-0x00007FFA77893000-0x00007FFA77894000-memory.dmpFilesize
4KB
-
memory/5028-1-0x000001ED90E30000-0x000001ED91D18000-memory.dmpFilesize
14.9MB
-
memory/5028-2-0x00007FFA77890000-0x00007FFA7827C000-memory.dmpFilesize
9.9MB
-
memory/5028-3-0x000001EDAC7C0000-0x000001EDAC9B4000-memory.dmpFilesize
2.0MB
-
memory/5028-4-0x00007FFA77890000-0x00007FFA7827C000-memory.dmpFilesize
9.9MB
-
memory/5028-5-0x00007FFA77893000-0x00007FFA77894000-memory.dmpFilesize
4KB
-
memory/5028-6-0x00007FFA77890000-0x00007FFA7827C000-memory.dmpFilesize
9.9MB
-
memory/5028-7-0x00007FFA77890000-0x00007FFA7827C000-memory.dmpFilesize
9.9MB