Behavioral task
behavioral1
Sample
332-65-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
332-65-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
332-65-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
d09fef3c435f6cabbf057192b9a9135d
-
SHA1
fa741352c3f9508861af4b4bbb09ebfdd56a2521
-
SHA256
8640363ffbd417a7bb02917b7844c0b2a006342d8222402267cf2de9f54a611c
-
SHA512
33966318136a7278712e987ebf496a3d0021ee00d3795025b91c25957d6eb0662ff84b571f3d3ee2d6bbc782f492cdd88e4e91f367eb653ab77be25bfb6f4d2f
-
SSDEEP
3072:vLEbu6dj11xElgWZ5dSaxE9ijspXo65xtjET:L6RCgUuaVjS46xgT
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.carmtld.com - Port:
587 - Username:
[email protected] - Password:
fronting@123 - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
332-65-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ