Behavioral task
behavioral1
Sample
2640-416-0x0000000000400000-0x0000000000440000-memory.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2640-416-0x0000000000400000-0x0000000000440000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
2640-416-0x0000000000400000-0x0000000000440000-memory.dmp
-
Size
256KB
-
MD5
00b72ee04e01d60f7c1214cba247203e
-
SHA1
fc4e28ef93cdf8b81bbb23e24e427e187bc4e5be
-
SHA256
29df7b9746ebca9d39e90c366991c947962be5c8170161cc5f83364b7ebfff9f
-
SHA512
1f5e2fed601b51e509afa3ee47599f2240ffce7b8c269a8635d8621f40d9c83044592247038ec910761698fdf0f96c709ec491c64b06827d5a19253f88aa641a
-
SSDEEP
3072:izXmieCmMHHSQwbgE0zxQsI7m/AJ5+lCqro:izXmieCmMHHSNbg7FJI70AkC0
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cornery.com.my - Port:
587 - Username:
[email protected] - Password:
Market321* - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2640-416-0x0000000000400000-0x0000000000440000-memory.dmp
Files
-
2640-416-0x0000000000400000-0x0000000000440000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 232KB - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ