Behavioral task
behavioral1
Sample
1740-67-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
1740-67-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230621-en
General
-
Target
1740-67-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
571dc66ba5105b008c71202522fdd657
-
SHA1
57cbdc610c348579cd6a145c61140e7e5cbd0869
-
SHA256
f7d78225dbe615fd9fbc274e3194b7b28340d93bacb740e3d64a98e65c063981
-
SHA512
64a023b34d3bdd5d15e10d87ce47d40e5a6d70f4c99eb72de80abbb8477f5658845b3f2c6dba6334daab7893f82de16335dd6f7ccebefc9d9fc1badbfa4935df
-
SSDEEP
3072:/HK++nkmnUOt1IL/vCBr9zieYXYUeyoHWrdeVBX7o0OK:lmnUoILnCrieUeZcSG
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.opulent-elite.com - Port:
587 - Username:
[email protected] - Password:
opulent81*! - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1740-67-0x0000000000400000-0x0000000000430000-memory.dmp
Files
-
1740-67-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ