Behavioral task
behavioral1
Sample
1748-66-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1748-66-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1748-66-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
7e73d1675d52aad4a5ccbabb240700ee
-
SHA1
7a7599fb1083be8e1297e45b61102f6157078f70
-
SHA256
26b2393026e61dce8ffa1ba45916b3dce6abd3d99b1c0cb4c0cbc75105f16e2c
-
SHA512
cdd0dcb668211cf47c9910128c7df640be93f70a562d277e1ab7915dada275bc52b9efe6ffc6ad2d45b331241c75822e6ad5d7ad2d4c1dcb98d564c07d5d396d
-
SSDEEP
3072:+JFBxpM0n04NWObOalUSQZJOE3PgBLGHVymnmYM3iQ3qPxJd:+JFJMYpF1IgBGHV9miQ3qpJ
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6192832133:AAF7C5Hu2cAny_oozlOAGw_7DWfvYVumEbE/
Signatures
-
Agenttesla family
Files
-
1748-66-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 163KB - Virtual size: 163KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ