Behavioral task
behavioral1
Sample
300-67-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
300-67-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
300-67-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
cfe9636d85c41df290b7a8ebef37d1ab
-
SHA1
27be57d340db71dd9c9d02a456ee92a7774f1128
-
SHA256
94227d17ba5828bda2338ff2a0ea20e9a86f2fa2ef13e799e6bd96aee8f990c5
-
SHA512
432226cbdc827fd2f829ad92fdbeaf305d91bab71f6705c27b46ba80ce0165dca1b47441918a49667e4e6e43e375e3fe5d6b4aab2037b28e065ad369f013f13e
-
SSDEEP
3072:CWBIiDIw0JfSJ4uaoVmDsJ4Xx0zumZWYFkuG3IP:5WimfSJvXGXOzuUWYFZ9P
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.procorpadvisory.com - Port:
587 - Username:
[email protected] - Password:
4n!chhbbZ~PO - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
300-67-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ