Behavioral task
behavioral1
Sample
2680-12-0x0000000000110000-0x0000000000152000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2680-12-0x0000000000110000-0x0000000000152000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
2680-12-0x0000000000110000-0x0000000000152000-memory.dmp
-
Size
264KB
-
MD5
bfb0544ccad79ea4f11d81a569491467
-
SHA1
0b1888452e08eca73df52059c4382a0f66e554db
-
SHA256
d73a092bb51a9ab5934afd52ce33a0e1561f972b3194d0139c961c2a2887a34d
-
SHA512
1228c32808261d0b580fc89e120b8ff3457b7f3c0a14d147f2a3178f43a27a2fdc88832be079ce5ab75a276f8623b08e0f31344f295e4e5d11a865a8d6cb1aa5
-
SSDEEP
3072:bJwOakQzbO0yTD1KtYuVfv/k8ygxCZ8DZU6X+B/4dp:yHkKMTDMtYuVvMaC6DZ/X+R4/
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
business62.web-hosting.com - Port:
587 - Username:
[email protected] - Password:
[email protected] - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2680-12-0x0000000000110000-0x0000000000152000-memory.dmp
Files
-
2680-12-0x0000000000110000-0x0000000000152000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 237KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ