Behavioral task
behavioral1
Sample
2144-11-0x0000000000400000-0x0000000000444000-memory.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
2144-11-0x0000000000400000-0x0000000000444000-memory.exe
Resource
win10v2004-20231127-en
General
-
Target
2144-11-0x0000000000400000-0x0000000000444000-memory.dmp
-
Size
272KB
-
MD5
fa7ee3a07a68d78299022bd160ff899c
-
SHA1
95cb5e46056dfaa0059fa021b89571aa3939173d
-
SHA256
0296f4282539f51ac2db5fdad5d72977912349be2ef705f6dc9dd28f6d91ba5f
-
SHA512
af3b6d5170b4558bc980c81b6de97f8ef568c879b826f8613864d819b2184bbbe67122bfb7dad1e81cf8b7b8c8a9be8e07ab1e073ff5dcbf0f70c72216278f7b
-
SSDEEP
3072:9eMWGALKGaeqt8TVBAnMtxyfjCZOY+kHDd8Wbmu58RXufXD:9NALKGaeqt8TVBECZNaWiLXm
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.asiaparadisehotel.com - Port:
587 - Username:
[email protected] - Password:
S,i*jv&Bj09k - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2144-11-0x0000000000400000-0x0000000000444000-memory.dmp
Files
-
2144-11-0x0000000000400000-0x0000000000444000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 240KB - Virtual size: 240KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ