Behavioral task
behavioral1
Sample
2616-10-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2616-10-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
2616-10-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
a5ad933857968cb30d19ff9b784dd966
-
SHA1
4d2d882a21136dcfb1c0198e21fe7d3253668607
-
SHA256
662e8dc3bca880705192605ea063beb0a438bd6a45b2300513237cc3ef7ebb8d
-
SHA512
b21dc42d9148556ebf033ceb9c81f13a141743359304b05a0904ba40e9d88acd6f7d3cd70d1c777fab1d16fdbcdbeb46d41391c57b68010aec6111ebd0e775ac
-
SSDEEP
1536:SYTjtEBHCyF0B5nhm0VKArqkKHxjIUX9wLb3CSqYsSt2EJ+Kv7ASUpcSemFJYFf4:t1AJFKqVAx6xjl8b4M2g+BcSecYhYSq
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.absbldg.com - Port:
587 - Username:
[email protected] - Password:
7Hudauff - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2616-10-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
2616-10-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 235KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ