Behavioral task
behavioral1
Sample
4344-168-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
4344-168-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
4344-168-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
f91738052d0160ae6d8f3181fb08695e
-
SHA1
ade4612efe91810100f0fca35ae8e631f2a6a1be
-
SHA256
3c4405df10c2d4bacba9f43710c956142421e5a5f9bf657e181e13b17b9c68b4
-
SHA512
a7e913a1db1a1194f5f66ff49702ff6d55e556a26bb9990a3ee4fb3cb23cc6525edf9caa03fa6ed170575a6bbad861d8decea6b910c42d893aa5dd3c9c24dc95
-
SSDEEP
3072:TuhdnHYmrb1/h7iodkRD0hJkB3p7aJgNOztgVp4OrQMJxemwrBD1D+Lkd:Tu8yb1/AodkR5EWEUljxe/9
Malware Config
Signatures
-
Agenttesla family
Files
-
4344-168-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ