Behavioral task
behavioral1
Sample
1948-62-0x0000000000E10000-0x0000000000E40000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1948-62-0x0000000000E10000-0x0000000000E40000-memory.exe
Resource
win10v2004-20230221-en
General
-
Target
1948-62-0x0000000000E10000-0x0000000000E40000-memory.dmp
-
Size
192KB
-
MD5
d9f430e865a33a247b5fcb1ddb53f70f
-
SHA1
691fad2196fdcaaf5d9c886684b61af0d8840842
-
SHA256
294835121243a726ec531a9e291830a1c5f96080d63d90a72e831083ce5c6320
-
SHA512
1823ec0f09c6bac23e2ce6b11177e58993a9bae682cf21a2ff0538ceae9447fead3ce439fbf4fa9346da017538a7c4df4223a15ecad55c54b7557ca73cf47b59
-
SSDEEP
3072:0bQhMulkm2x68KrtUtCgDeDwKgPS5xcZEcmriQor:Zh2m4TvRaDLAiZjo
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/
Signatures
-
Agenttesla family
Files
-
1948-62-0x0000000000E10000-0x0000000000E40000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ