Behavioral task
behavioral1
Sample
2000-60-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
2000-60-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
2000-60-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
97bb8cd3f28065fd5b529f0ed4b937cd
-
SHA1
6538154b7accef625b655f61943324924783ae0a
-
SHA256
241117264a5058b697a0f316398773fa3e5da5d3a910a1dc076d6c23894babc5
-
SHA512
3ef0990510992f2016745df1d1b8cc21aa1b6c87568a24b63d05b997e22140143409fe5a666371d4411f4d85d1e7c749f0e8e1405046634147a37285b215cc54
-
SSDEEP
3072:xXmd9wtNit0rsL9c9SHukwU0I5dQlkWCDASXO9lYyoBlBmw4VyeXa1:xXmd9XZISOkwId8kF0SXAlYyeKVyMk
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1102722564712841296/3-EpoUbqBExsjHTlAszTcqqS1MRQ8Tai6WQXR4RQMFNg3cR9b8adTdUAL_l__l4PCJKc
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2000-60-0x0000000000400000-0x0000000000430000-memory.dmp
Files
-
2000-60-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 165KB - Virtual size: 165KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ