Behavioral task
behavioral1
Sample
868-84-0x0000000000400000-0x0000000000615000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
868-84-0x0000000000400000-0x0000000000615000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
868-84-0x0000000000400000-0x0000000000615000-memory.dmp
-
Size
2.1MB
-
MD5
7605129817eb99bfbe0b45927a316e37
-
SHA1
de49a3a017f856d31e01bab474a1f77ac25b2107
-
SHA256
84baaaa830273bf1b262be6f8919bb71a6a7d1230deb897a9bc89a0c72851def
-
SHA512
c35c7deeb68fdd151307d6a6a82e3d5576c07d1ca65e62da493ac60f9baa89b58b402fefcf20af88d59ed23b2b191fa575a6cd5cac1172578e6e0249488b4f24
-
SSDEEP
3072:OIskB5XoU87XHyqG0kpKG0CzFZ7ktpSYNTpf8ZPNCD:7eUAhG0kpKGnnysapSP
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.coolinic.com.my - Port:
587 - Username:
[email protected] - Password:
Nadiya1611 - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 868-84-0x0000000000400000-0x0000000000615000-memory.dmp
Files
-
868-84-0x0000000000400000-0x0000000000615000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ