Behavioral task
behavioral1
Sample
1924-64-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1924-64-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1924-64-0x0000000000400000-0x000000000042E000-memory.dmp
-
Size
184KB
-
MD5
5d7f18a54fc6e1401acb8a01c7e6e866
-
SHA1
98a3d5b3739a329ebeef938f07243cabdd309d6c
-
SHA256
1fddf2b8499c09ec91a49a12642c85646bcbda33b931c6615fdd7782f564f921
-
SHA512
ffe2fdcfc9c7bc7cab3c752747d35fa0ceee974b5426cb17cd8505795a2367630c49325ff54077f1a08f56ce5a556db9a37aaf8a5f8d56edc6af255bd53f3feb
-
SSDEEP
3072:twDfV0GGv4NnclURjb9YM2RKyfKww2MDS4olcUIXh//EVvi3M0:tKbGgulURX9J4Py5DS4olcUm5Iv
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
@@Marriedj8OQWinbi1
Signatures
-
Agenttesla family
Files
-
1924-64-0x0000000000400000-0x000000000042E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 157KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ