Behavioral task
behavioral1
Sample
472-56-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
472-56-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
472-56-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
21c1725c9f42de86f98bc3c7d3b70305
-
SHA1
f459de4f7b7cc09dcea21f770406e7380d9699b1
-
SHA256
1266c3db6d63f669f542e71723a39b2fdca0704f16714554cf13d55b4e4e2be3
-
SHA512
74ea13d9b79c18e4a9375d6fb4495181196a03f5b2225a3f47a4f0b59a32e2a9ec404aa72d75ed339fb091f0d5a4a3aae466a6e5907c4808727ec81120ba8c88
-
SSDEEP
3072:fW6hGy2Sk1vYd9mLC2enTYmqL4GvGLlHU1KmzFP5uhC:fhhGekad91T/Ll4KmzFR8
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.wecaresvc.com - Port:
587 - Username:
[email protected] - Password:
5ak97py6z - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
472-56-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 163KB - Virtual size: 163KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ