Behavioral task
behavioral1
Sample
2324-11-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
2324-11-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20231020-en
General
-
Target
2324-11-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
c7ad8f14d67a2fd358cbf0cce1f5a490
-
SHA1
ce84f0cd04011f3db56c97c6ad5454bdb50a42d5
-
SHA256
808c9ebea7e6ffee78c8c26da41d94db3e9d91b42e244650002556cdd9add130
-
SHA512
596a82adf7cdd2dbee240999134a868aa267fbae5f112a3af214a10e4aab77a56cc60df64615906e36867897eb622f404f9dafa557f0a692ec8a23328b21149b
-
SSDEEP
3072:4p+RXvfXH+SA/MoCp3EF0RDvgLVN7J5n0YTBMsEOQ:4pgXvfXH2/MRp3vh+VN7YYTm
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1165884453684518964/WyF5wFDSDPj7xwaO693EsrMZiDJFajkrZhrWOtVVClbz45kfo6NVycWocBfks8fgBxE5
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2324-11-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
2324-11-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 235KB - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ