Behavioral task
behavioral1
Sample
1404-67-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1404-67-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1404-67-0x0000000000400000-0x000000000042E000-memory.dmp
-
Size
184KB
-
MD5
a10f1d5e947496f206a257901ee80541
-
SHA1
0f303b47522a951379620b60f577f47abfb32438
-
SHA256
895d17228571c68736b87aeccb127dcbfbee4f702a29f782a11e46dcf71c3ffc
-
SHA512
a7c9cecf6e4fabff37be507e04a48ec298c490004933347979006b0cb08863679b0e7cd60da74b3a9a9da5dfb983e5c726a263bfd8558d7a6a47922937a95173
-
SSDEEP
3072:0wDfVFGGv4NnclURjbrDeDbN2fkfhMtxfIF7aAfhBVvM3M:0KeGgulURXriDwcfhMtxfIZlpPv
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
Da8@b!Gj!#zY4K
Signatures
-
Agenttesla family
Files
-
1404-67-0x0000000000400000-0x000000000042E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 157KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ