agenttesla | 2916-168-0x0000000000920000-0x0000000001022000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2916-168-0x0000000000920000-0x0000000001022000-memory.dmp
Size

7.0MB
MD5

f6894fdfc2ae606a8602051992359221
SHA1

093c7dff3b9a209958b0b9e0e5d4b478c1e218f6
SHA256

a0ed4595ed7bd65b76840c9d3837f65047c2763452c0fd9a4ca9e1c9afa25395
SHA512

150b472794dcff69994ee988ea36986a5aef848fc13a1609baccdf93c15d440d27ccd57f5e9398ecbae6bb781a82ec26c735d47f7599689844e7ae8b039a5d0b
SSDEEP

6144:GBtp1JwTk3GKpaoYoA7X4g/XrHuMMsFRj:GBtp1JwTzKpaoYo+40bOM3

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mymobileorder.com
Port:
587
Username:
[email protected]
Password:
Grace@20233
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2916-168-0x0000000000920000-0x0000000001022000-memory.dmp

Files

2916-168-0x0000000000920000-0x0000000001022000-memory.dmp
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 240KB - Virtual size: 240KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ