Behavioral task
behavioral1
Sample
2448-66-0x0000000000400000-0x0000000000444000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2448-66-0x0000000000400000-0x0000000000444000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
2448-66-0x0000000000400000-0x0000000000444000-memory.dmp
-
Size
272KB
-
MD5
e7ee0b553a198f67d6f378e1b945a7ae
-
SHA1
58f8405f2b0d3fafdd8f4abfd43492fe3e31a227
-
SHA256
5230bf0fb5ecad1d2e75c6f2b91c73f25d35ef49ca22b99f10f9a6b94c089b58
-
SHA512
4948f680d7c9a49f024991a1c158c5dde022f72b4e517c89606409b846bdb33941a415d4662284521e1b1f6a4a2060f0d51b9f83d901c9ea897146d79dc38c35
-
SSDEEP
1536:l6fX+60i6DI1qRPULsrGonDUaWkS73jo1XePpeBTmGh0Z20YxvAzz0aIhdsDdA9I:0m60NDELiwTV3j+Iz0ro72gAuCrzpPa
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.zqamcx.com - Port:
587 - Username:
[email protected] - Password:
Obama2023@ - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2448-66-0x0000000000400000-0x0000000000444000-memory.dmp
Files
-
2448-66-0x0000000000400000-0x0000000000444000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 243KB - Virtual size: 242KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ