Behavioral task
behavioral1
Sample
2664-19-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2664-19-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20230831-en
General
-
Target
2664-19-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
b0dc4d5bfff91d0b33308a983ef40898
-
SHA1
373dbd6093f0b7d60e272e9da60e712bf843207c
-
SHA256
38760a5c64e6d3e80e3adafd52828231230e21023b73457388318e742180fc84
-
SHA512
f611049dffabfa2ae6adb4a29bd2b8115eec18546e6db01559e7782721f19ccb58d2570e4d5b69ed95bfffc3b1485448e05e57de4f64ba286d9ae5f46505b931
-
SSDEEP
1536:KyrIOijmKULzbw6rr7NIGvEBcoC+0ZsWJAEBWAk5Q5vW0zaIU8xlP2oBc8LdEK5M:KxHU/thjsZsU0zaMp2o5pEP/xzSS/
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.begos.org.tr - Port:
587 - Username:
[email protected] - Password:
Bucaorganize@2002 - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2664-19-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
2664-19-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 235KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ