agenttesla | cfba5dd939d2d7bfc08f500cdec99afcba91c463d70086c53dffd65dc1e965d8

General

Target
viva stub (2).exe
Size 1.1MB
Sample220329-rdtlrsafam
SHA256 cfba5dd939d2d7bfc08f500cdec99afcba91c463d70086c53dffd65dc1e965d8
MD5 e36a2ec87a4f03c86797c483e8a2b4b2
SHA1 5542a7a221f430dd1c5e3d6270e7f463229a7926
SHA512 21e7b0ba328abc1672e9e6871e6385e678886385dcdafb35ca14657bc7b92484bf5f9b34053edda6f78925f72857aed3e8d9bfcfad9ebe518e74dff682a5ec0e
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.balertsecurity.co.nz
Port
587
Username
[email protected]
Password
CoL5Lts9Glh2
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{3DF16CE2-A60D-4AD2-88E5-0C0F55FCB53C}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{A9081F1B-D06D-41B5-872C-6FD50731934F}.catalogItem	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 820 set thread context of 1268	820	viva stub (2).exe	103

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2088	1268	WerFault.exe	103

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1268	viva stub (2).exe
1268	viva stub (2).exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1268	viva stub (2).exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 1268	820	viva stub (2).exe	103
PID 820 wrote to memory of 1268	820	viva stub (2).exe	103
PID 820 wrote to memory of 1268	820	viva stub (2).exe	103
PID 820 wrote to memory of 1268	820	viva stub (2).exe	103
PID 820 wrote to memory of 1268	820	viva stub (2).exe	103
PID 820 wrote to memory of 1268	820	viva stub (2).exe	103
PID 820 wrote to memory of 1268	820	viva stub (2).exe	103
PID 820 wrote to memory of 1268	820	viva stub (2).exe	103

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4388

C:\Users\Admin\AppData\Local\Temp\viva stub (2).exe
"C:\Users\Admin\AppData\Local\Temp\viva stub (2).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:820
- C:\Users\Admin\AppData\Local\Temp\viva stub (2).exe
  "C:\Users\Admin\AppData\Local\Temp\viva stub (2).exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 1448
    3⤵
    - Program crash
    PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1268 -ip 1268
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

viva stub (2).exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\viva stub (2).exe.log
Size 1KB
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
MD5 SHA1 SHA512

Submit Download

memory/820-134-0x0000000000540000-0x0000000000662000-memory.dmp

Download

memory/820-135-0x00000000054D0000-0x0000000005A74000-memory.dmp

Download

memory/820-136-0x0000000005000000-0x0000000005092000-memory.dmp

Download

memory/820-137-0x00000000051B0000-0x00000000051BA000-memory.dmp

Download

memory/820-138-0x0000000008840000-0x00000000088DC000-memory.dmp

Download

memory/1268-140-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1268-142-0x0000000005110000-0x0000000005176000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads