Behavioral task
behavioral1
Sample
1712-162-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1712-162-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1712-162-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
e6c3c64802d34369d5e64f2d855f4077
-
SHA1
73c3f76f412249072f628cfec2096ec36db81817
-
SHA256
255c7afe320466d4c1d72fccf8952ef9c05617d941c3ed0520d4354f6ec15c16
-
SHA512
0cd63390a0798be1e2387801873f8dd19dc80ebbd43119a658961c45b2a27e7ddf8329dcff85b4ab3bfcda5072138138fc748a8ffd6faceede48910f688583c7
-
SSDEEP
3072:A/2SJ0AoSEhaUh2fLjNmfVdfujEEfXseov/3mOMmaFnhD4O4RCahAUo:A/2SJz5jUr4L3amyao0Kx
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6261426177:AAGKVvStJVx3AbPod6gVs0gLfIFG75EuCzc/
Signatures
-
Agenttesla family
Files
-
1712-162-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ