Behavioral task
behavioral1
Sample
2040-63-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2040-63-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
2040-63-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
571574e5d0d56383acca1bc14954a6b9
-
SHA1
d4242ce64964cb7601fb8a6d8397bd81bd142a6b
-
SHA256
56e1f1fd60ce2331ce7577101245464b7c86e2724727a21904cb86385b17b9c2
-
SHA512
24b6c2b212adee1da266cecb76ca494833a4168f1f851fc3e9f6ced476f984a1b36ca8979e6e3d731d1a321964c4a4b1d26eb81be600a656de4ac2e8c6bfe792
-
SSDEEP
3072:1WoK7PtAKASZda6FxCdXq1Ibb+S8xmzX940oigI4:1N4tRdnWd2rKX953X4
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.snsagro.com - Port:
587 - Username:
[email protected] - Password:
dks20053016 - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
2040-63-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ