Behavioral task
behavioral1
Sample
4912-945-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4912-945-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
4912-945-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
5d21c1e8f26d700ab2424944fcc52c83
-
SHA1
e1d799c4bd1b1386ef8fea5c8fcab4dd092780c5
-
SHA256
3a4744ad7cb39015661f807eb83fb8c70cba88a6c3772d87cb97e04094669866
-
SHA512
ce829c839ba5077ef77af50472689aa2d6f228f1e0101888eb72d313addd08a950db6789115a3f82ba34f8564c4e4eeabb83c61fe62ed61136a3143687afe4e9
-
SSDEEP
3072:FymieCHlEIedVZftEbHtoDmJgNtH65omlElg:FymieCFhedVZftEbNohNtHQl4
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.macfinmail.com - Port:
587 - Username:
[email protected] - Password:
^6&Z=C94llIn - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4912-945-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
4912-945-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 232KB - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ