Behavioral task
behavioral1
Sample
1564-74-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1564-74-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230221-en
General
-
Target
1564-74-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
c9a028ea496d6446f3ab81229c127a22
-
SHA1
b5d79e07a2d150f8635691dc7ab50033e8e4087c
-
SHA256
a6a455fbeb968ad41f64e98fa6f9651b00b11aca9bfdb160a0e88328fdd3b4d0
-
SHA512
233dfa5a311b5bf11516b6afb0b2fdaf9d5c1ca43dfd6ca0d03fc9141304ae19dd3f3c16974d03bc40d331bb83fdd0a37be56f86a64f3c37953bae7b49a198d9
-
SSDEEP
3072:mHPHjFPvjnHR7AgJvndDACpZmZ0TUFZfHyUiBljCPjawqf8Ds4:mxvjx7TvndDACpAZAUFxPirOjawHI4
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.crockeryemporium.com - Port:
587 - Username:
[email protected] - Password:
oluchukwu554 - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
1564-74-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ