agenttesla | 584-70-0x0000000000400000-0x0000000000430000-memory[.]dmp | Triage

Sharing

General

Target

584-70-0x0000000000400000-0x0000000000430000-memory.dmp
Size

192KB
MD5

749081d9728b7545140052000e9eb0cc
SHA1

7f94e5552e8a46d73f3a1148ad01c65abb58f561
SHA256

3772a0b946b28be55657477bbaa21685c8e3e0fedde4f741568c3ea6b5408a9b
SHA512

3335d000b3b809f5c122a22aaa2edb37cb5732fcd4037a14f8baec1d98f68be0a7c7bd86f9e5acb71a622529613030d927bc6fc512c4ecf4e822b34eda0162ea
SSDEEP

3072:SIHVFK2vUzm7Zx99j5msYdCe6yMImchhk2MMcGzUk9SGcE:SIjK69z6YyM6OWc

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
wkrd%Jw9
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
584-70-0x0000000000400000-0x0000000000430000-memory.dmp

Files

584-70-0x0000000000400000-0x0000000000430000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ