Behavioral task
behavioral1
Sample
1932-59-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1932-59-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1932-59-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
2254d0afc3d4712c6ba61844218974b4
-
SHA1
62f608f001850ca571ea206aba73049a23e05e8a
-
SHA256
2a46cbe06819f82b82ee766843c2531691fc38fd3d45495ab799873d43fb9806
-
SHA512
d05dfe03de0e5443da87ec6590ba1687b9a4de09f4d5a35f4c17b437ebeb2fbfba74ddb4f3ebcfc437017cc0b16587255ca904d0c052e06f93d55a5153a71606
-
SSDEEP
3072:A4YVO8n06snLyYwESlj9Yxk2uwsSxmjdCEYEvMcVTxGAUm:1YDGLytF9l2u/UEpVEbm
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1083289314915528704/2IvR6CGsuTELo0cot0iO3yiBKH2Uao1QQtK5JrG1Ip4LfsS5PlJb6hOmAqgpAatI28fv
Signatures
-
Agenttesla family
Files
-
1932-59-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 165KB - Virtual size: 165KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ