Behavioral task
behavioral1
Sample
2244-9-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2244-9-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
2244-9-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
04b57ad9342f962d588e9584fee73329
-
SHA1
7ef4f7ddc55d749ee2798b0ab0a038013a2b113e
-
SHA256
3cb57b97b15baa57248e0edab105a837277794b4f05c6bf4a2bd5e4774318381
-
SHA512
ada168ff45ca0081e2d14778148710c9d372fc2513cb512e9910731ee0d935c3a22c4cf1c6596e571eadba2647f9c29a7100f3ef4c2da3ee6d92a3c9a55dcb69
-
SSDEEP
3072:92rubzHT3LXjpEJmJW5Hb2Q/wFkH8RH4MuWJ5uyPdJW:92rqT3LXj+JmU72hCH8RHnuWHP7
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.wasstech.com - Port:
587 - Username:
[email protected] - Password:
Sunray2700@@ - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2244-9-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
2244-9-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 235KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ