Behavioral task
behavioral1
Sample
2204-140-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2204-140-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
2204-140-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
ac1f606a67187f6bb5900f53e774e2b1
-
SHA1
18fd035da3e5076c237ec961e6ae9a304b6093fb
-
SHA256
6904a424ac4cca5f15f1c99d4901614b1eb1fe1d29a11382a23c71c1917fcd4b
-
SHA512
8e263a030405431209ae5a1b0b87599b7d5443862d9e79a7e708d8f1c5363cdd65a71248cd5b2f5a5ec64c792ebc9272dfb5688d34fc8a160955e2692684cf19
-
SSDEEP
3072:og1J9mKS20Da61Qdrj21pNo52ucM5VC5SBh9qRgM:og1mg0DQxjfRD5ls
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6205694016:AAFra52NaS7UwXdNdP3UoFHG1Y79jlGWBko/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2204-140-0x0000000000400000-0x0000000000430000-memory.dmp
Files
-
2204-140-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ