Resubmissions
18/05/2024, 16:28
240518-tyx6ssce93 1018/05/2024, 16:26
240518-txjxsacd96 1018/05/2024, 16:25
240518-twx31scb7x 1018/05/2024, 15:54
240518-tca45sbb3x 1018/05/2024, 15:51
240518-tazpqabb82 10Analysis
-
max time kernel
140s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18/05/2024, 16:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VRThook Spoofer.exe
Resource
win7-20240221-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
VRThook Spoofer.exe
Resource
win10v2004-20240508-en
4 signatures
150 seconds
General
-
Target
VRThook Spoofer.exe
-
Size
7.1MB
-
MD5
dbe8d5a8ee46d6c8730745d7078d2bf7
-
SHA1
6fb29e4c785bc721382096c1265311880a68d6df
-
SHA256
9ddd4b094446a4932e71a3307c2a5210c8cb53be65d006840503c285d571e123
-
SHA512
7209980c73bc1b2fbb499bab889dc0981baa719ec031bc98bbe093113b1fbf6aefe580f55978e5ab57ac13cf8538acaab0fe82a5318ac6074c1cb8bb5288e853
-
SSDEEP
196608:A+6eX8TgXoZsXFo5C1o+eE59b5zBXVnTRW:A+PY2aI/v7bV
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
resource yara_rule behavioral2/memory/2072-9-0x0000000005F60000-0x0000000006174000-memory.dmp family_agenttesla -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS VRThook Spoofer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer VRThook Spoofer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion VRThook Spoofer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2072 VRThook Spoofer.exe