Behavioral task
behavioral1
Sample
4360-140-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4360-140-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
4360-140-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
21ca891c81f89c00f449ec263db1923d
-
SHA1
030ea93528c912cf54fe39b4a46cc2ec4217adc4
-
SHA256
793cdf2d152195bd7cbb71dd00a30df94253da630e4a9ca804667cb4b780f30e
-
SHA512
a9ac3c78273f2a8d636f8f06c8a5bcc01414540d0c6a72834344ec39c9af482b782d74e462deaa7dddbcaf59a3c9d947184620f41869faf6a87bc9b6f8b8fe1a
-
SSDEEP
3072:mlY2d4V9Zqs0XYkmYzKb0HL1CqJ8dU9Ly6wmNQ+YSTfu7WEAgfmDbTd7tyP:mlYF0nzg0JuU9W6wm5RTu7vJfmDndE
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1644755040:AAGRTnph6BdO8-t1bJaOyVu9aeuJErmisqs/sendDocument
Signatures
-
Agenttesla family
Files
-
4360-140-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 208KB - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ