Behavioral task
behavioral1
Sample
756-76-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
756-76-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
756-76-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
a9b5a3b3dc8be2c94f0af8a22222870c
-
SHA1
08c0ceafe69c1703ee511727dbd0d5e73a9793a3
-
SHA256
9170d21fd7238263e1f4d3d50627ee75fad06ce9d7fc16b86dabcb708515134d
-
SHA512
d8dba6be88468107a39cb79553b3011113aadfb07a6cad80320fad809888622114ea9869fb5af068056facbbb4e19180dc67b556b57f701027715d6e6f697a6c
-
SSDEEP
3072:QUeIxo3WWHDmzuFTWlGTZomsoUDHvVmpYJa12IDSzjUKx6KHPgcXF5pzMa+6l:3eXHtWlY/UDHvVmpJm3UKx6Y1XFjQa
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5322219147:AAE0Z9Lq-g-SXI1X2beYR26iGFyieqMa3DE/sendDocument
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 756-76-0x0000000000400000-0x000000000043A000-memory.dmp
Files
-
756-76-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 205KB - Virtual size: 205KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ