Analysis
- max time kernel
34s - max time network
37s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
17/07/2024, 10:06
General
- Target XWormLoader 5.2 x64.exe
- Size 109KB
- Sample240717-l5aebayfpe
- SHA256 b461c985b53de4f6921d83925b3c2a62de3bbc5b8f9c02eecd27926f0197fae2
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla payload 1 IoCs
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWormLoader 5.2 x64.exe"C:\Users\Admin\AppData\Local\Temp\XWormLoader 5.2 x64.exe"1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
TMzpx.dll
memory/1768-8-0x0000013089BA0000-0x0000013089BA6000-memory.dmp
memory/1768-10-0x00000130A3EC0000-0x00000130A3EFC000-memory.dmp
memory/1768-4-0x000001308B540000-0x000001308B546000-memory.dmp
memory/1768-3-0x000001308B560000-0x000001308B588000-memory.dmp
memory/1768-5-0x00000130A3E00000-0x00000130A3E5E000-memory.dmp
memory/1768-6-0x00000130A3E60000-0x00000130A3EB6000-memory.dmp
memory/1768-7-0x00007FF9F5C90000-0x00007FF9F5DBA000-memory.dmp
memory/1768-0-0x00007FF9F5C90000-0x00007FF9F5DBA000-memory.dmp
memory/1768-2-0x000001308B4E0000-0x000001308B522000-memory.dmp
memory/1768-11-0x00000130A3DA0000-0x00000130A3DBA000-memory.dmp
memory/1768-9-0x0000013089C00000-0x0000013089C06000-memory.dmp
memory/1768-12-0x00000130A4B40000-0x00000130A5778000-memory.dmp
memory/1768-1-0x0000000000440000-0x0000000000460000-memory.dmp
memory/1768-19-0x00000130A7030000-0x00000130A7C1C000-memory.dmp
memory/1768-20-0x00000130A4880000-0x00000130A4A74000-memory.dmp
memory/1768-21-0x00007FF9F5C90000-0x00007FF9F5DBA000-memory.dmp
memory/1768-22-0x00007FF9F5C90000-0x00007FF9F5DBA000-memory.dmp