Behavioral task
behavioral1
Sample
1436-43-0x000000006F1E0000-0x0000000070242000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
1436-43-0x000000006F1E0000-0x0000000070242000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
1436-43-0x000000006F1E0000-0x0000000070242000-memory.dmp
-
Size
16.4MB
-
MD5
999736da135a09656cee28c27059a666
-
SHA1
d6473154c1d8d18eb9551c541ff935636b319c90
-
SHA256
3f85c7f9656f6ae690439702407074012a537af674f232887875d120173e330f
-
SHA512
c0da0cb0aca133956363eac4c45fbcf040d602686282bde7e218f1af44436adf6b1ab12fbb7292439a900185438e0c1fd02525f838e25ee78f7e38560f3c3245
-
SSDEEP
3072:STA4QlexyjYLQSgibPyCeItkN6zcZ5AuyfpKXqU:BPjYLQS5bPyChtktEuyZ
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.1and1.es - Port:
587 - Username:
[email protected] - Password:
Adara2020* - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1436-43-0x000000006F1E0000-0x0000000070242000-memory.dmp
Files
-
1436-43-0x000000006F1E0000-0x0000000070242000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 235KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ