Behavioral task
behavioral1
Sample
2780-9-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2780-9-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20231222-en
General
-
Target
2780-9-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
055b7f6103515665b3122cd5b3150bb0
-
SHA1
7a5e2e2ff3fcb551f90ba49e12cf241dd82847c9
-
SHA256
d9a1ee23c8f8161db5754df8a41b9e252e6ba04729fb10ee30f97dbe2fa97489
-
SHA512
171cb9bbd814eef97d221d5658b403da4b4ee6ad65a6083f1973398f8fef1be6e0e1dfb52274d156ad572b830917f7ff286a9315d48f3d235ec3457c95fa684d
-
SSDEEP
3072:i59dVYGwhQo8QYPgGbRwELnYI0CjwBTi:iNVpk8QYPnbVnTkg
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.europeanhome.vn - Port:
587 - Username:
e-commerce@europeanhome.vn - Password:
Changchang137 - Email To:
e-commerce@europeanhome.vn
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2780-9-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
2780-9-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 235KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ