Behavioral task
behavioral1
Sample
524-70-0x0000000000540000-0x0000000000584000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
524-70-0x0000000000540000-0x0000000000584000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
524-70-0x0000000000540000-0x0000000000584000-memory.dmp
-
Size
272KB
-
MD5
decff7bd862c9fbc05c44770979b2a35
-
SHA1
2a4975ddbd65e4a3426ec1c3ed5faae5594c5e25
-
SHA256
3e366814fce60ef51bbf88a31a828c4b3d1fca35231834ca56c3d98a17b6de28
-
SHA512
e5de191a283f41f6e3ba0929e8265e40d1e4f52ce16ae23e85be5fa0c55c32dfe10e4a5bdb24bd4aa29d1ee7e65744535a85ef61f44e2bcffec43de3ebe3147d
-
SSDEEP
3072:VGgnzWocTMTJO/wtWHTtQ8AxnX+wCdgqi0g4v1ze2tdsqO0V2Gsmal1zjyLRxOCB:FeYcTT4XQd80xn7A0V2jl13SRxzp
Malware Config
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 524-70-0x0000000000540000-0x0000000000584000-memory.dmp
Files
-
524-70-0x0000000000540000-0x0000000000584000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 246KB - Virtual size: 246KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 644B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ