agenttesla | 2484-85-0x0000000000400000-0x0000000000430000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2484-85-0x0000000000400000-0x0000000000430000-memory.dmp
Size

192KB
MD5

9bb681585c5e0ef3886422cec18bb99f
SHA1

0622aea21e372ee7a11d93928c406f152b0d935b
SHA256

342f8843b237a523347ba3be47dba9c2faba9ce3e083614139b543593b65d881
SHA512

6e20e1cea284644561d06c8c0ec0784a72ec3ee1f41aee2b6cdabf83978a62731f59c8415b8e232fc8c0b48b1e627d8792408026d5ca1745d3392642783b86e4
SSDEEP

3072:FkGJgOUHQaT706+agN2Mvy1QOEcFDNx/Jdv4clJiGNzhh0:a2M7706+ag0Ma1lEGNx/Ucr9Nzh

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.kennettextile.co.th
Port:
587
Username:
[email protected]
Password:
M@1h5s2q
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2484-85-0x0000000000400000-0x0000000000430000-memory.dmp

Files

2484-85-0x0000000000400000-0x0000000000430000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ