Behavioral task
behavioral1
Sample
2736-11-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2736-11-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
2736-11-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
e8269b826f879bc2bf37f82f76634ffd
-
SHA1
17d912fe400e2dded598b3a6e76b7eb9c086dea5
-
SHA256
6da765e9794032193d336281a1d135ad688ed988248236639f187922dbe94b8b
-
SHA512
ac820fdff16221f2b29de7f04ed837e0f001252e0a2e7766d27cc5e35b809dc834e9dd9faaab02d264ff136dd372444f471b7e246bd8af2c6da18f3f844d9d41
-
SSDEEP
3072:Z9fji2luWBji3gSEINjNM69qmMAgcJkEAX:Z9f22lFBji3gSrb9qmp9uEC
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1153223870891958314/4fjTdg6uWPR-Mfasd2z9A9lMK59UySWkNCvaFZXMHtU0FDbkkjIMF2XSDIeUY1fHd9R4
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2736-11-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
2736-11-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 239KB - Virtual size: 239KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ