agenttesla | 2124-11-0x0000000000090000-0x00000000000C0000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2124-11-0x0000000000090000-0x00000000000C0000-memory.dmp
Size

192KB
MD5

59925568fdfcfb0123a5168639d4b7fe
SHA1

4687dc4a0acd0b72683405b83697afa3d2fa2e23
SHA256

6c46e4c02af82f18a2f7e374f43823d5d2eafa68a9175cb6c50f26d90140b0bb
SHA512

cb0957ff6da33ef8f814beb2f87c6e0fda8edc557e0684e62259c0635f0260cc0ca92597bbc9c9dd52004ddf081c1df5c7dddb2f037455787b34d6de3bad21cd
SSDEEP

3072:vfEOgdvxglpHM+Q9Hhpn8WZE2NQyloz3ByF:k1xgnM+Q9H78sNmz3

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.worlorderbillions.top
Port:
587
Username:
[email protected]
Password:
@qwerty90123
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2124-11-0x0000000000090000-0x00000000000C0000-memory.dmp

Files

2124-11-0x0000000000090000-0x00000000000C0000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ