Behavioral task
behavioral1
Sample
1972-83-0x0000000000400000-0x0000000000444000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1972-83-0x0000000000400000-0x0000000000444000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1972-83-0x0000000000400000-0x0000000000444000-memory.dmp
-
Size
272KB
-
MD5
68d99ab9d227dba2d07279c6be507feb
-
SHA1
c9a3515e04ca84e4ec9bab343e47803fdbdd3689
-
SHA256
21a6ec0b73caa020f6988a3e9c0b9385b2e1938019c678d13aa6cdd885acbc58
-
SHA512
b117b1891af615948103eb13bee5242a9735713b720b7d95264aa5858e126605c8b20692b549b9cdcdd68b06c35101187e347632e3758ce1a38b9385fecbe7be
-
SSDEEP
6144:4DthOzj8tzKQCmwqBbvBhQ6oubr+SxlGxA:4JksQmwqZvDJbrTI
Malware Config
Signatures
-
Agenttesla family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1972-83-0x0000000000400000-0x0000000000444000-memory.dmp
Files
-
1972-83-0x0000000000400000-0x0000000000444000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 144KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 119KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE