agenttesla | 3868-96-0x0000000000400000-0x0000000000442000-memory[.]dmp | Triage

Sharing

General

Target

3868-96-0x0000000000400000-0x0000000000442000-memory.dmp
Size

264KB
MD5

9be6504ce17af262fe7701c5e369a4d1
SHA1

60e750f3a9080299a06589262e53121505950c99
SHA256

8c28093aa0387899aa3bd593ac52ecca8313c36efea5771cdceb6237c73a1c2b
SHA512

4af72bde973d96202fc2f27eeb8955597b7fef09514566ecb7114cfc81081ba9697ccb403e66ae1986b699be324b954adf6817ad438c13479e9db95ab9d38a05
SSDEEP

6144:aqyayKS86L3g+8oRT30pL8hCKZALNfKb:VyayKSJ3l80T3rCKZAh

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.bezzleauto.com
Port:
587
Username:
[email protected]
Password:
Kene123456789
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
3868-96-0x0000000000400000-0x0000000000442000-memory.dmp

Files

3868-96-0x0000000000400000-0x0000000000442000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ