Behavioral task
behavioral1
Sample
2900-10-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2900-10-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
2900-10-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
f6dad0213259e196c137aaf398b01ab7
-
SHA1
509404fb48f1ca4d8927992c989e92e18a066aab
-
SHA256
95894f04e3a024e13a6e18aeccce86ccde80346e28b2ce2456f6694d1472a0e8
-
SHA512
edb0fa96ea08b910bc5427c2cad1eee85c20f2f06c6fb83c93bf4f2b08a3f3ad1a659fd46786ef573591b90b3f7a2a1c0987569878490d73420b2c4ff2fb5a5e
-
SSDEEP
3072:aNEUzyKd7foqOxQ698QHtWx5+LxJv50UgjY5FOd370:aNEUzyKd7fvOxv6OR0Ugjndr
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
QWIM%xo8 - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2900-10-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
2900-10-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 234KB - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ