agenttesla | 2416-21-0x0000000000400000-0x0000000000440000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2416-21-0x0000000000400000-0x0000000000440000-memory.dmp
Size

256KB
MD5

60baee93eae2366881f6854ac3df172c
SHA1

326a8ac821b79b38553789ed20de6ab5a4332d89
SHA256

606d0ecb4c0f4148c50165d37bdabdbb8ad5437d05160dd26f243657a870016b
SHA512

02afafe8c42ce3b3b49b710e7f91365d2467a2b252d7db328d2b1877b641fd3b94ef86058bad9fca478ffaf6f8e8405c4d70b5974a3d98eca3fd22b55a08dc4c
SSDEEP

3072:Jzzr+CmyuyURdf5jlbEvt6lbEpOb1gF5YEN4Y:Jzzr+CmyuyG5jlbEV6ljgRNx

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.tadbirdrilling.com
Port:
587
Username:
[email protected]
Password:
h123456789H!!!!
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2416-21-0x0000000000400000-0x0000000000440000-memory.dmp

Files

2416-21-0x0000000000400000-0x0000000000440000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ