Behavioral task
behavioral1
Sample
2808-10-0x0000000000400000-0x0000000000454000-memory.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
2808-10-0x0000000000400000-0x0000000000454000-memory.exe
Resource
win10v2004-20231023-en
General
-
Target
2808-10-0x0000000000400000-0x0000000000454000-memory.dmp
-
Size
336KB
-
MD5
de40eb64e6db1655fa13e7e84a687496
-
SHA1
78422b50e328e6e8153b9d4303cd4a50831c66af
-
SHA256
5824061b0050cb7a5d49e8cd15afb84d610e434273829eceab115cdff036d43f
-
SHA512
2b08cae1b7dddef8c07dd12a0ac8a1f3114b97dd1f44ba6f13cb659974398b32a013a16fc5cb026b883f65b0288a044608cec740eab237dedb1a3bee9bc0d660
-
SSDEEP
6144:TTt0/HgVzKpltJ9xtixKISaMnPSs3gQNJ/779eftjo:T50wgtJ9xtiYISaMnPS4N79eu
Malware Config
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2808-10-0x0000000000400000-0x0000000000454000-memory.dmp
Files
-
2808-10-0x0000000000400000-0x0000000000454000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 241KB - Virtual size: 241KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ