Behavioral task
behavioral1
Sample
1624-9-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
1624-9-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
1624-9-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
8e9b490489a21318586e1be80f195907
-
SHA1
356deff4a50495ddabb90795c24a7ffe7df7e136
-
SHA256
c8b4b0b84984fe9c83940d7638a28330ef76b095ed6ce3a94beebb669183cfde
-
SHA512
bcc4ba28177f382a1662cf3f4e71dbd92f4d7b176923f5227d8983b9b4294ea58194fae34d41171230bc68cc6431bcfcc4476631997ee45aee86f5252921c3bf
-
SSDEEP
3072:nLRWQjjQWk+DRZrrKH97BRbTPpMHNATGk6y:LZ5TKH977b7uA8
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.nissi.ug - Port:
587 - Username:
[email protected] - Password:
M4oNdAy! - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1624-9-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
1624-9-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 235KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ