Behavioral task
behavioral1
Sample
744-41-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
744-41-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
744-41-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
b9a08a3008c853a708530d78da16a64c
-
SHA1
5e0c0671a0a8b129910a27bf673c5f86d79ed301
-
SHA256
a8d60cdcf796c792e4a219145ec09b4530b674c01897eb4efcf62f14c4b69993
-
SHA512
9efa39ed91cad83506c6f6daad9e3e8fd7ef3585bd2a1cfa8420baa3e46ab25489a65a71f098afb957f183c720689a0cee2cddb12e3a94d76a49552233e2a1fe
-
SSDEEP
1536:GsJi4XL2sXu18zUHxxt5Aq7llAZ6Uj3azvdoxbSXAH0JZp2BI/vsnYm1p19v3wFk:Gstq3/5BAEUDaxUbSIj1p19vgFc
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
hyosfa.com - Port:
587 - Username:
[email protected] - Password:
Aleruchi@123123 - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 744-41-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
744-41-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 235KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ