Behavioral task
behavioral1
Sample
2132-9-0x0000000000400000-0x0000000000440000-memory.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2132-9-0x0000000000400000-0x0000000000440000-memory.exe
Resource
win10v2004-20231127-en
General
-
Target
2132-9-0x0000000000400000-0x0000000000440000-memory.dmp
-
Size
256KB
-
MD5
219e6180f383599e6b59d892af23fa05
-
SHA1
7685fb57941766da12462fe7e144776341b746f1
-
SHA256
44eb1fbdc2f77b6dff29a80e0fe3f34eacbdac9c1d7c9aa0f2bc240727a2434e
-
SHA512
8895afa188a5d77bff88f817cdcb0175c4486cefeade9483a13ded757519c7714db60dc6acb10f56cc73de800914ff2064b74413db0e6c1134a514d76b4be797
-
SSDEEP
3072:AuLZoGC+iGWrehvBjJebRh4lhC8IWj5skKCR:AuLCGC+iGWrehvBjJebT4meBKG
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
MAIL.starmech.in - Port:
587 - Username:
[email protected] - Password:
gaging@2022 - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2132-9-0x0000000000400000-0x0000000000440000-memory.dmp
Files
-
2132-9-0x0000000000400000-0x0000000000440000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 232KB - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ