Behavioral task
behavioral1
Sample
4500-139-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4500-139-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
4500-139-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
8a8f4613c518877c9a41f4217c9c4adb
-
SHA1
f3890080b42077793e652e7d6b93b03026fea5a0
-
SHA256
205d5bf036e809b14e99e4feffbbd862a0ea64dc874981206425cfedb7427274
-
SHA512
b34dbf0b79dba48b97dda83c7ba02220394c9daff85cc7395f2284c4c8c476c345e2c470e82943c1c471aac97448e669320f8f14543f260eebfcf368f148da2e
-
SSDEEP
3072:OUbqNqVCnCIWi1jn/VEcvRqQWniGbtAEqHRr3MeCrkZHdNcAoOjB:vbMnCD4DmcJqQb5HiyXHj
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1073351841217261789/NnPDWHoGskysnt_cVO37Yvso4HCKBMX4OJzJQ65V2g-M4gX029QlSHO_kclyL9PXI8Lw
Signatures
-
Agenttesla family
Files
-
4500-139-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ