agenttesla | 4492-12-0x0000000000400000-0x0000000000442000-memory[.]dmp | Triage

Sharing

General

Target

4492-12-0x0000000000400000-0x0000000000442000-memory.dmp
Size

264KB
MD5

eb9246177b764b86458e913afd1bbaa3
SHA1

ac0b458a83ef66e7aff882c3638bb0954937773c
SHA256

c9900ef0834ea2f50fa0521af5adddb13717b81f30b5c615c7eb6d78a86f08ca
SHA512

29e57098da9013477e714467c2381248b29c3b223f32fc41a66697d14083ac7ede8671918e019940f1e1d3facdf0f9c999fbfdb78c4c39f78334a6e1243c169a
SSDEEP

1536:w45Jv8qODYJS//0W/JX2u8A+7Pz3f81irR0R1Qu5bjbqojV+7wmJ6JXV4YSOpgKX:w45BKn/JG73b6R1fbvVSwIQV4nO2j47

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.reneacruiseshalong.com
Port:
587
Username:
[email protected]
Password:
KeToanRenea123$$$
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4492-12-0x0000000000400000-0x0000000000442000-memory.dmp

Files

4492-12-0x0000000000400000-0x0000000000442000-memory.dmp
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ