Behavioral task
behavioral1
Sample
1084-145-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1084-145-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1084-145-0x0000000000400000-0x000000000042E000-memory.dmp
-
Size
184KB
-
MD5
4703c122abe78533add7ba24894662a0
-
SHA1
9b643a7ed4537c2d346ded8346a08e6446533712
-
SHA256
e75c6d8b1514db261c04f26129bf2307a5e3a1e2b43c4a8b4ebbe2b5af193d4c
-
SHA512
f3f613f1e9a9b07418c3d5055eb9362628c8c0f97597e502e1b824f180cf07fd325b7c129b1e34b9fe20d360b818e9ffe91bc28c1051c2ad1199ea2c447e6976
-
SSDEEP
3072:h0xu1fg8xXtPjMIE0LUvOTwX7X0J/x04MQPAe0U5LSYtYP9Wx3GXb1RdLFG1:hguySMnmUvOOK/xXMQPAe0U5LXZx3GLR
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot2079338442:AAEEwFSr5UAQhd9srqEVg17eOJdjaG7ACkk/
Signatures
-
Agenttesla family
Files
-
1084-145-0x0000000000400000-0x000000000042E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 158KB - Virtual size: 157KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ