Behavioral task
behavioral1
Sample
1068-63-0x0000000000400000-0x0000000000438000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1068-63-0x0000000000400000-0x0000000000438000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1068-63-0x0000000000400000-0x0000000000438000-memory.dmp
-
Size
224KB
-
MD5
a47e2e9e9e2508b5f9d052f8566d4f31
-
SHA1
22aca081ec9576b2ebba5eb8a8705373ac770286
-
SHA256
b3e7c5bc45efea16dd2789774aa80df1b5f5c87115b7103a898b779b7ac2add7
-
SHA512
9bda3fa3cd46b611087963a21d89d1b4af9ddca662543d6f6f91edc32b6cb8febee408b8317f064ca10e0c5e242e5b6cea7a6d4717a6420d2ce76062e0423517
-
SSDEEP
3072:vj7OkHAGdTdLOuLowineeP8fvAqyUQbTjBcrvqbaZFGGtslwRs1XbX+r0t:r6dqxfwTUATjEmaZFWlnbOr
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5471845965:AAGz3YmV7VKz4xbC6JZYPs8qHf8J8palMmQ/
Signatures
-
Agenttesla family
Files
-
1068-63-0x0000000000400000-0x0000000000438000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 193KB - Virtual size: 193KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ