Behavioral task
behavioral1
Sample
872-85-0x0000000000400000-0x0000000000448000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
872-85-0x0000000000400000-0x0000000000448000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
872-85-0x0000000000400000-0x0000000000448000-memory.dmp
-
Size
288KB
-
MD5
1993d6d56b66793a9bbb61b61f08e050
-
SHA1
edf425b6e38219b59e3682f142689466311df663
-
SHA256
86f11aa360a201e8ce2e633236479d0569a9d28102a8a6e121aa7c5488e850e9
-
SHA512
301a34c4c4398df51bb8e678f4b1500112bf2a8c86902661557558a886065e4b113478546c5b62f6100ab087dbb1bc96450b09b2f5cafce78cd5093a9191be20
-
SSDEEP
3072:AYgAamSa//pSB8ukCRR7sPzB9T2dWvb95QFj+pNwtVh00:AYg8SagBf6OADyynOVe
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1103875906361118810/4y7iINqCCd1vB_5CHVi8bfs-VsURmj2vh2ZdBw9vV7iC_QaLM-Uzs73INWoN8KSw28mH
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 872-85-0x0000000000400000-0x0000000000448000-memory.dmp
Files
-
872-85-0x0000000000400000-0x0000000000448000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 102KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ