Behavioral task
behavioral1
Sample
1076-59-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1076-59-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1076-59-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
428c882b0283b2aa847cde2ee4901017
-
SHA1
b72332a7922430bb2a330df4c6f2c0f3f053d27f
-
SHA256
751a6be4dd4ec89f085fbbac73193dc398327e21d5b463c45514c3640c83a69f
-
SHA512
305a370fc543f88fcc498d364aeba72c8fd3a60ace16b43f09c2e5040fce0661063114b74d16eb615738fc67b512c939ba5f479955d60f012c75a6cbde5fc448
-
SSDEEP
3072:c0zIonlzyY/X3sm8uf7e73LV70UWl6Hc5+AQ9SEh/j2idAUvOidPoQYG:PzRBvxf7CGUWl6Hc5/QYE1ddBOsQQ
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.rigzonellc.com - Port:
587 - Username:
[email protected] - Password:
rigz0n3llc@khan123
Signatures
-
Agenttesla family
Files
-
1076-59-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 206KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ