agenttesla | c107e8cf5626efe17feac14120c5e4bc23371e199ef41275b2a502e7cdb0f853

Analysis

max time kernel
28s
max time network
16s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
11/09/2024, 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xworm-V5.6/XWorm V5.6.exe
Size

13.1MB
MD5

15ed3dfb4a15efe623620bcdca313bdd
SHA1

8718031f9dc9e437712e958f0ed3a928ab30010a
SHA256

751d1a9550746309c73de3cd0f03e0fca0424ac8b07c36f0469c0a8442ee9a31
SHA512

06f43aae25232539342bc929ca68d6098dae72169fe3f69743d0ee332407c37f03c6cd1fe1b7cbeef3386c20fc4c40b954eef73a240eade7566f84a29b89af35
SSDEEP

196608:6S/BAe1d4ihvy85JhhYc3BSL1kehn4inje:6MyIhhkRka4i

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/1016-2-0x0000021A6B120000-0x0000021A6B314000-memory.dmp	family_agenttesla

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XWorm V5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XWorm V5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XWorm V5.6.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe
1016	XWorm V5.6.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1016	XWorm V5.6.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1332	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1332	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1016	XWorm V5.6.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1016	XWorm V5.6.exe

C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6\XWorm V5.6.exe
"C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6\XWorm V5.6.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1016

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3848

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004B4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-0-0x00007FF990D33000-0x00007FF990D35000-memory.dmp

Filesize
8KB

Download
memory/1016-1-0x0000021A679D0000-0x0000021A686FA000-memory.dmp

Filesize
13.2MB

Download
memory/1016-2-0x0000021A6B120000-0x0000021A6B314000-memory.dmp

Filesize
2.0MB

Download
memory/1016-3-0x00007FF990D30000-0x00007FF9917F2000-memory.dmp

Filesize
10.8MB

Download
memory/1016-4-0x00007FF990D30000-0x00007FF9917F2000-memory.dmp

Filesize
10.8MB

Download
memory/1016-5-0x00007FF990D30000-0x00007FF9917F2000-memory.dmp

Filesize
10.8MB

Download
memory/1016-6-0x00007FF990D30000-0x00007FF9917F2000-memory.dmp

Filesize
10.8MB

Download
memory/1016-7-0x00007FF990D33000-0x00007FF990D35000-memory.dmp

Filesize
8KB

Download
memory/1016-8-0x00007FF990D30000-0x00007FF9917F2000-memory.dmp

Filesize
10.8MB

Download
memory/1016-9-0x00007FF990D30000-0x00007FF9917F2000-memory.dmp

Filesize
10.8MB

Download
memory/1016-14-0x0000021A6EA20000-0x0000021A6EA2B000-memory.dmp

Filesize
44KB

Download
memory/1016-13-0x0000021A73940000-0x0000021A7395E000-memory.dmp

Filesize
120KB

Download
memory/1016-10-0x0000021A738F0000-0x0000021A73936000-memory.dmp

Filesize
280KB

Download
memory/1016-12-0x0000021A6EA10000-0x0000021A6EA1D000-memory.dmp

Filesize
52KB

Download
memory/1016-11-0x0000021A6D3A0000-0x0000021A6D3A9000-memory.dmp

Filesize
36KB

Download
memory/1016-15-0x00007FF990D30000-0x00007FF9917F2000-memory.dmp

Filesize
10.8MB

Download