Behavioral task
behavioral1
Sample
512-140-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
512-140-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
512-140-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
0a657c7cd224be982b84426fd083985c
-
SHA1
40072e47054a4f3d3b967ced1df259e559a7722e
-
SHA256
1a8f07e5f7a3445428b46bd58b1c6493c03aa1ac72fb02790dc94978f6abf239
-
SHA512
92d426f8d10878bd32dc8f68a118cdb0a673b3fee70d064698b15ad5d4d3a299c7a9fcf82858de761956f7686adc22f78c25bed370e0c4b89e8d924d8b926105
-
SSDEEP
3072:6E5wVAlOdGUMJiJqoV9artYqZd6bHWuhpm4/:DDUpgIartTHYHWgU4
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.procorpadvisory.com - Port:
587 - Username:
[email protected] - Password:
[$)3+;;fS3!q - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
512-140-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ