Behavioral task
behavioral1
Sample
1760-72-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1760-72-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1760-72-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
9bce15d9a87b82cac8cc4ab1ed44ed5a
-
SHA1
efcc85634f9ee44e3b3b43ea73fb240ebeba9688
-
SHA256
25a2977c443e749eeb02feb9759ba83b967aad42997e95f80b890dd4ccdbc4b7
-
SHA512
417010ff27065da447b6d5d3764ab483f89bfb4ce671b2dae8e60e3839e514229b341edd3c733e202a8047f40c1191cb1051017c06145cb305c5a9991690e383
-
SSDEEP
3072:m041aDO7kn1OjEAFv/yJ6tbsLla2hq/DPFKTF90Bvoz:mKDOQKQ/L5w0T6wz
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.masarengineering.com - Port:
587 - Username:
[email protected] - Password:
mas952hwp - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
1760-72-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ