agenttesla | 2772-19-0x0000000000400000-0x0000000000442000-memory[.]dmp | Triage

Sharing

General

Target

2772-19-0x0000000000400000-0x0000000000442000-memory.dmp
Size

264KB
MD5

c05f6350b91f6084b2232a40e5cf65cf
SHA1

46df31530698599657f5c89a091a2845f93a9caa
SHA256

655e001b97e18f7129e7f0eda13608727db851ea97289ecf15920b4ec650f751
SHA512

cdbac9b9b5d3fdf1adcae8c10cdae7c025838514d1759e8d0431676f657cc6bbd975b4018c04485315fda90a577067c00fc8ceae5c83619640ab932406b23eac
SSDEEP

1536:HLSGif9XNexawTsr4W+bC2CkUx8wIZ/b9OqmD/WoohzPi6J7gUlU6GTX0PpNO/EM:He9lNexamU4W71CGuooRa6J7g6S4VwV

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.asiaparadisehotel.com
Port:
587
Username:
[email protected]
Password:
KTNL)LqQaA(8
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2772-19-0x0000000000400000-0x0000000000442000-memory.dmp

Files

2772-19-0x0000000000400000-0x0000000000442000-memory.dmp
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ