agenttesla | 836-277-0x0000000000400000-0x0000000000430000-memory[.]dmp | Triage

Sharing

General

Target

836-277-0x0000000000400000-0x0000000000430000-memory.dmp
Size

192KB
MD5

97909c303ac55f0df6bcb0b5bf4ba105
SHA1

f369f3cc8be843a7bfcde5c501fdffdcf24e6a93
SHA256

a18ac75bc821c9ec801b9388f3e38e4d2fa971e49188b9bf03240d41b8afd921
SHA512

2d92fa95ef02d79aaf744c8a10b7199269db6c33ff9e4fe76c6bc23ea81cd8f400b5c0047bf6390173291e09cc2ba0ee9894640ca3c227442fa58c4e57cdf47d
SSDEEP

3072:L+n3kLQpxQLchWVBW7ZWbmcKV+QBWMdWeM2UcviC4:LPIxQyWVBW7ZXP9BWMdWeDv

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.cutecycles.com
Port:
587
Username:
[email protected]
Password:
Ashwani@Cute@123
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
836-277-0x0000000000400000-0x0000000000430000-memory.dmp

Files

836-277-0x0000000000400000-0x0000000000430000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ