Behavioral task
behavioral1
Sample
624-97-0x0000000000400000-0x0000000000615000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
624-97-0x0000000000400000-0x0000000000615000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
624-97-0x0000000000400000-0x0000000000615000-memory.dmp
-
Size
2.1MB
-
MD5
de21bd10da6d69e4e32e3153b348601c
-
SHA1
cc86de08cade0b2f75fd52028c0d0cf13df8f989
-
SHA256
9989dfac715ba632c895ca51a144a8250c43bdbf5bb2a4f1b1e9c7827692142a
-
SHA512
402aab67fa177643264aefbd78b543dc3b196bc7297bdf0f31b3d69eff1e55cc296ddf1d7249b25cbf480f2171c179af09b551e4e7bc63914f6be5834fb1ca6b
-
SSDEEP
3072:plEFJ82IA8PS3FZYLtilp2/jV1md+eq8oQcvbOzRkdhuwt2j:/1AwTxipeDvHHgSdhBt
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.primevisionuae.com - Port:
587 - Username:
[email protected] - Password:
Pr1mevision - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
624-97-0x0000000000400000-0x0000000000615000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ