Behavioral task
behavioral1
Sample
2696-22-0x0000000000400000-0x0000000000444000-memory.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
2696-22-0x0000000000400000-0x0000000000444000-memory.exe
Resource
win10v2004-20231130-en
General
-
Target
2696-22-0x0000000000400000-0x0000000000444000-memory.dmp
-
Size
272KB
-
MD5
c73b0266c15f394e518b719bf70fcb8c
-
SHA1
ad7201f8c565dbad33b07b41c64d7f8635609a02
-
SHA256
877f161728683f45a566d1c376b377806fb84391f3ab9bf84f9efbd1833936a8
-
SHA512
16b89dbbbfe9f513a84f53b7b839c05fd676c1b3b657e60fe1c13a390141e40725ae6fe9ce0b8db0b9666577c61a93b201f3a429985064a333c89afc2047b7d0
-
SSDEEP
6144:DYgNdAOKG6eyw7s1Z7PYZD13XzzRVye5dCvqOIQ:DdAOKG6e/7kyD13XPRMe5dCj
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6439280362:AAFxJ6Gm_hfG3MYnjXvw0e4QQEIFTsOjkuk/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2696-22-0x0000000000400000-0x0000000000444000-memory.dmp
Files
-
2696-22-0x0000000000400000-0x0000000000444000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 243KB - Virtual size: 243KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ