Behavioral task
behavioral1
Sample
2648-9-0x0000000000400000-0x0000000000440000-memory.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
2648-9-0x0000000000400000-0x0000000000440000-memory.exe
Resource
win10v2004-20231127-en
General
-
Target
2648-9-0x0000000000400000-0x0000000000440000-memory.dmp
-
Size
256KB
-
MD5
7b157b2515c7f9133acad9f9d12c0c18
-
SHA1
db72976ecfb72a8dabdd254cdb341079fcabdaab
-
SHA256
0051b3c1f3a29fba238951f0af1575abe6313889ecb2f5190145f240a6c60c97
-
SHA512
45036864d625fb23239172a48b9946a0f8136fbd2222c0b4e280779367280ef967fd6bc8f0b4774874a6650cbbf6b9ad7c6410504214f88afb772608bf813e03
-
SSDEEP
3072:Ap4efeCmyt7Y4G2mb6aLzIskaE5dOy6K3:Ap4efeCmypY4G2mb6GIskapyt
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.coaatja.com - Port:
587 - Username:
[email protected] - Password:
consuelo63 - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2648-9-0x0000000000400000-0x0000000000440000-memory.dmp
Files
-
2648-9-0x0000000000400000-0x0000000000440000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 232KB - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ