Behavioral task
behavioral1
Sample
2132-17-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2132-17-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
2132-17-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
9f8406577544f6366f22c06044a64712
-
SHA1
51b74a28297a0c779adcab321d307e4889b4642c
-
SHA256
5cb45686dc78773208c5981f60d5b5dfcb70d9df54cc8ea8786730840d33ec5b
-
SHA512
9ffb829cc1169126e7dc845d185abb89763521c056aa3ef0f6ec6054ea75b20074d1dbb79f7bcfba6994f1a669a74a1ed036d76809a13d991193f2812ac6ac15
-
SSDEEP
1536:YNMyCEVG7cfdtXdMWPBFgJaJIBNB0Am+PcVCVrvix80VKLcR9zeTZjfnSXZwc+/L:YNfVG7Ut49UYhSXZX+/BuAZF9H9I2gs
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.wecaresvc.com - Port:
587 - Username:
[email protected] - Password:
u9367gk8qc - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2132-17-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
2132-17-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 236KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ