Behavioral task
behavioral1
Sample
1176-70-0x0000000000400000-0x0000000000615000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1176-70-0x0000000000400000-0x0000000000615000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1176-70-0x0000000000400000-0x0000000000615000-memory.dmp
-
Size
2.1MB
-
MD5
5c02d6cb407ec9a3339fa878227f8c6f
-
SHA1
1147b654b4ed369cf2cbf5843dbcf850747ee716
-
SHA256
3102ee9ff5925119d459f4c6d6cd105e25c78ef175c8f5f06622ffc82bc888ea
-
SHA512
e7c5e09da6dd037ec10d1671f1ca5d8b1970317f173fdba80fea92c370ce76b715d774ad3bb7569c6b2d7bfed1c8a4726ffe38499c5660d4808869889121fff2
-
SSDEEP
6144:BCiaUQFEaHraVm+eQNUhrA+EJAp4lkhap67cZIUpjgIJue:BCKQFEaHUpTIgPJ
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5789565839:AAGv9XhsZdqTdFUOTNKJtcYQ1hes323bYNo/
Signatures
-
Agenttesla family
Files
-
1176-70-0x0000000000400000-0x0000000000615000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 206KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ