Behavioral task
behavioral1
Sample
932-145-0x0000000000400000-0x000000000043C000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
932-145-0x0000000000400000-0x000000000043C000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
932-145-0x0000000000400000-0x000000000043C000-memory.dmp
-
Size
240KB
-
MD5
dd567ca60eb086f6ab024f8904f9f621
-
SHA1
9c65458f189ed063fbbff1fb6329a8a6a47a66e6
-
SHA256
9491a48b25f4d62717294ea603c11c5c119f2d1cf338e99886e323207c6d784e
-
SHA512
ccbbbde3da072b01bbaa064993c713ba1ca5862e90c341a351599977ff3058930e0e36ef3ff8c8dbf6fae5d5e4c962e5507a7771e6393f7194ae81432e7df514
-
SSDEEP
3072:MMKQgdnS0CGpcwjZ+vqTaakcQvuUsGdYXmdueKDtK+5I/V/IQSv5war6/17Y:phyCUQ46EUD+2duXtKjwHv51r217
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5954474519:AAEGnfW1mRvGRxq-zIAvwJfpKEbhLLiqVaM/
Signatures
-
Agenttesla family
Files
-
932-145-0x0000000000400000-0x000000000043C000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 215KB - Virtual size: 215KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ