Behavioral task
behavioral1
Sample
904-58-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
904-58-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
904-58-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
153ced2a0e622924bc04d92d26d5b25c
-
SHA1
53911bbb55cce6992cbb36434b7b760fbde8e0aa
-
SHA256
4c698b7f17e55ee24b42f65cf78bf65d93dbdb58ab15e7ce7427a43c43c10362
-
SHA512
502ef430ccb4eb0332f8acc4cc31b8f232cb6f1ed28954a1fcd492b1c7c95c3754f3d48c9b31da1ddacf336d92713e97de9d99808b48389f1e678696c4285de8
-
SSDEEP
3072:OHNjLXk3oI1rjPcZuSe/c6LOmEIy8AWRJ5d1yc7B/D:O1kYiHARe/fpy8Hyy5D
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1063267560818233445/Ga1uL1m9HE258QH4hqiVhVH5m98lA3rsO835awvMXcR1F31nnHHfghtrbDwRtJci1Osr
Signatures
-
Agenttesla family
Files
-
904-58-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ