Behavioral task
behavioral1
Sample
2028-84-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2028-84-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
2028-84-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
43d03c8f5e084de3fb9552b22b6710dc
-
SHA1
4ee1f99247e3bf773e12c51fc0d9cc9ca94038a1
-
SHA256
66c83e3bab5140b93d55083b1d01482673b45ef0b52d901a923ccab479e8bafa
-
SHA512
5906816707e88fa8d0d5a7dbd7c4a6adc9f48bdf3e9ebbe8ff8ef2e08e473444329a4e103c4c80eb50bc3477f96b85a8df89c89c90dc360ea7156bcd268467e3
-
SSDEEP
3072:CFOXnC+moKSjDVo9sUfDN9WYWMPtJ3175wGmJQNSrav2f:+OXFAS6LaYtFdwGmJcSGv
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.redseatransportuae.com - Port:
587 - Username:
[email protected] - Password:
method10@10 - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
2028-84-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 165KB - Virtual size: 165KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ