Static task
static1
Behavioral task
behavioral1
Sample
948-62-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
948-62-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20220414-en
General
-
Target
948-62-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
3cb1ae50f24c3682c48ab851248c5006
-
SHA1
d8b2a12da92913d3108ddc395a1f360050bd419b
-
SHA256
7dafb39b44df928dddb7fb7b4767cfdbdb14652e7c7f305dbf6e64d8ded32ebf
-
SHA512
bad23c0406d727327bec11032dd6ce5a8103aa0cb179867804615169dcd588bba6bae59632a4e4c2a8c691f90856bc381b8042902091c3a179a90bc6a8e4b253
-
SSDEEP
3072:RKg2snwBR5oGuBSvikll5lD3RUVT8idH+ITKvnS7nhiS4iMrwaMp6SpZa6M:4gtAicjhUVT8ideJS7nNSwaMNXa
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5227573794:AAECZBnQSxLs0aOVsV2wnclC6-WKnxPpi_k/sendDocument
Signatures
-
Agenttesla family
Files
-
948-62-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 784B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ