Behavioral task
behavioral1
Sample
2724-10-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2724-10-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20230831-en
General
-
Target
2724-10-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
e04550bec2cfc1d862e8da750bdc7e8b
-
SHA1
20b5537966af9cce13af1718f645922838ab0839
-
SHA256
b5e1265d7fef2f936477c327c490fc022698ed3b4a942a8d23dc75753260d662
-
SHA512
f6977bee7ecaabf0c76e636326da57a6362fef632820ed32916adfcabb038988f339740cf8c3b2a74c45c8578ad960640413ca0e6740ae0bd8a166a6181c72a5
-
SSDEEP
1536:ZrL6D3VvoxFR8SyE7chUMowlFZ/W1roe4tdLGD05SVafm+RTLfCOpzv5tnfSXYe5:ZPOloTAoobEcekdvSVGfCOBfaXYe5
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1146743802510446683/YYnmTIhYhWdJQW8A5MvyTr_WHJJGCBNmlBjMwv5vLOf2Uf13GWnGYfrqY4ycNVYFwSts
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2724-10-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
2724-10-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 239KB - Virtual size: 239KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ