Behavioral task
behavioral1
Sample
2816-9-0x0000000000400000-0x0000000000440000-memory.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
2816-9-0x0000000000400000-0x0000000000440000-memory.exe
Resource
win10v2004-20231023-en
General
-
Target
2816-9-0x0000000000400000-0x0000000000440000-memory.dmp
-
Size
256KB
-
MD5
c42b9d233f76b647d3b32bd656900dcf
-
SHA1
6441197cca179f8d757b97835fd9ae969d7665b0
-
SHA256
2e56e958f4a6f6d9daaab4195d527994c7116d09f3988f87c78b874b364bd319
-
SHA512
d9287784277c0f16af79897b979506dfbe9ab5202bb4b4ed843c3ff325a4a8f2cd172a1a48419c732f3f3e4e5665593e017d3c351fe9a236f6ecb1ede8aa9f7a
-
SSDEEP
3072:l0Zlx1JAm9qQzSbG2cVjuVD2Ev1Qa759oSf4wNYH:l0Zlx1JAm9qQzSbG0d2sQaL+wqH
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
sg3plcpnl0195.prod.sin3.secureserver.net - Port:
587 - Username:
[email protected] - Password:
V#[email protected]&Qo! - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2816-9-0x0000000000400000-0x0000000000440000-memory.dmp
Files
-
2816-9-0x0000000000400000-0x0000000000440000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 232KB - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ