Behavioral task
behavioral1
Sample
1796-75-0x0000000000080000-0x00000000000BC000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1796-75-0x0000000000080000-0x00000000000BC000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1796-75-0x0000000000080000-0x00000000000BC000-memory.dmp
-
Size
240KB
-
MD5
1d292ab07c7d80c761d07937542a76aa
-
SHA1
852f7d511c75736f6e0c39423a4bef51d908fbe6
-
SHA256
919fb86d586bf3f7efba068487bf4f3068b22b9116b071ad94793cfcd92a9fca
-
SHA512
8b9ffb7605cde9c3f6a947c37565bb5fa3490f8f28c0488d648373d8c47ad2d492befb3469a53727a03a92496f30cfd2f61c792ba818aea69ead03a72e9b4fbb
-
SSDEEP
6144:wOPrCKSwN7ouUxkhug9XYQ9WGw5NrdLW:H5fN7oXQsG0XW
Malware Config
Extracted
agenttesla
http://chestermachinetools.me/it/inc/08b71e08d77bf9.php
Signatures
-
Agenttesla family
Files
-
1796-75-0x0000000000080000-0x00000000000BC000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 215KB - Virtual size: 215KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ