Behavioral task
behavioral1
Sample
2752-11-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
2752-11-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20231130-en
General
-
Target
2752-11-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
71551b6eecb5f43efded05b7d166c20f
-
SHA1
7bc5919ff61fd9a6d8f446dd1a95372a13bc7405
-
SHA256
717ca1c5e358569c0dabfd8b51f71694b36f1348c7469c4cd8643b6ca7d7cdeb
-
SHA512
467cbe8de6b2766caff37c9a5974b5bb2f19d427cdf5bc8cdd94b1ddd9fb660561f6545839195bfed60678d01f544394bb4ca553f2e861fea3af05ce4c7ecd46
-
SSDEEP
3072:fTS+jnffXnwVhl1mAD9HiKwyG9/oayhlU6hqc5hnGnZql:7S+jnffXnwVhLmAD9CKwytlFsqGnY
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6833930321:AAHwDIEAPHebsHtw__k-gJGBZ92DAJlw8_s/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2752-11-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
2752-11-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 239KB - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ