Behavioral task
behavioral1
Sample
2412-11-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
2412-11-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20231201-en
General
-
Target
2412-11-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
0479848fc1c2ec54b4100a5443b24bec
-
SHA1
f11a3fc4d37d074a9857b441a79be2ac699edb2b
-
SHA256
4b36951750ad30a65817b524e8efe9afe273bde0cff2c091f6f0176af479d1ca
-
SHA512
3aad6e1351814154c02c1508184e679aec7bb1e5b5d874f6794f6650ed13f36d1c4118c662dfdd522abd7e9454d3bfec7e4798f9aa0d51dfa787193fb59b7a5e
-
SSDEEP
6144:l0bWum+GI9kzF2eimlwep5ZOM3L2xQ+KpbHu:QWum+G4kzF2e9XZOM7J+
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1179958435408785428/jLjV5a_ciZdpd6t2s27CGCikXETJ6crcchofeUrAVpoZUDRhP4jkMHHhD4ltJmgZhIap
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2412-11-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
2412-11-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 237KB - Virtual size: 237KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ