Behavioral task
behavioral1
Sample
3144-209-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3144-209-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
3144-209-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
9cca56b0ca3c883b1dd1fd17100b0448
-
SHA1
5ab13d59fa57e3c0d2137ea18428aa75b7c187d5
-
SHA256
836a8edb7ced90ce5d0f63562b0e7d5a0614fd03aa0d2757da819c30a2d1af63
-
SHA512
0c58eec46da01ec5acd79f88f59b46f1a315441662b1c982f1ddddd7c252cf213522d3ce7a7fa10e8fe1a9081528ef5d897443da1e5c1de6bd9b553681f92871
-
SSDEEP
3072:VN5eHVjQum8hyVsU2Pu3l4RA23H9rXTNprgUpWUKhR9qLgfPJN6+5Fxmt0GsLK8N:pKQum6ssU2G3l4RA23H9rXTNprgUpWUo
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pushkinworld.us - Port:
587 - Username:
[email protected] - Password:
Wsxokn@123 - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3144-209-0x0000000000400000-0x0000000000430000-memory.dmp
Files
-
3144-209-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 165KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ