Behavioral task
behavioral1
Sample
2768-71-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2768-71-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
2768-71-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
c4e6cc47dbccc2188e0d18db1ce7edd6
-
SHA1
b0e2e58a82725041815acfee96a6b8c05c3716ee
-
SHA256
8ede4b9d87ad057247ffa98290de2f17cf489be4260051fca8b08d9f7858d8e0
-
SHA512
5a54c74876aca04ab5b467a88cf045af824740f9b4a0645ac157ba5bba6fb1259add14711e5ae254f5798dfd7a70b256e15af76299b07e4fce1dc971fb5f2215
-
SSDEEP
3072:HvhSLGdqTUjaf3fJtAlJ1IfZ5wQiilf7Qpfz1:HvhyD6C3fJtAP1Y95dQF
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1153539462454853703/uBqITIGCHxh487IDtEi05_T0CVFY7MPJ28kszIkbpskJK5Vlm6XKFG1spM2XKrJU3dsq
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2768-71-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
2768-71-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 239KB - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ