Static task
static1
Behavioral task
behavioral1
Sample
3992-143-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3992-143-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20220414-en
General
-
Target
3992-143-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
62ad019ddab934c9f040c75239ae261d
-
SHA1
13d0daaead9b201f8a48a8aa56efa480323db9aa
-
SHA256
986f82d305b0e7e2c4d48ff783468e9a0a8f924078dd58cc2c04713aa167dc8a
-
SHA512
ca0cb066156a11440fb202502f9238e72bcc217298b4adc467f68733c47b1cb87859c942ed8294501f0fc0e1b936efb10f9ab15e5e19d0887570b1965bfc1fc1
-
SSDEEP
3072:wcu2fDaTm7eIo/OzsvhCWwFWQit3UQqN3+GDOqZ43gSaKzskPaTp86wndsJ6PgDX:7u09EhCWwPgUQqN3+GDiZ/sDl8hd89a
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.agro-egypt.com - Port:
587 - Username:
mustafa@agro-egypt.com - Password:
Alex@306 - Email To:
wokwok507@yandex.com
Signatures
-
Agenttesla family
Files
-
3992-143-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 752B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ