Behavioral task
behavioral1
Sample
452-12-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
452-12-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
452-12-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
501e9aa761578cf8dd409be98f24b8da
-
SHA1
814db6d22cdd4de5f6ff31a3c77dd9481afadfa5
-
SHA256
63515177242a1168c37903da930b56410cce44421e2e417b298c2ae34737bd9a
-
SHA512
ae7e8d086fdbb02f98d3442bbb356cee10d667d36386f20a04dde59dd2a431f5c67773c1a008096229928a0a38090da6b795fe70160c460b1cf49b714444ef37
-
SSDEEP
3072:bkgv/Xnv/STr3MDVWYOErR5UHk5i9MQpgaYeuw:bkgv/Xnv/STrad5M1MQG
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1222063930139086928/2Vg1Z1z7AWyTYIiICGAds8u69Kb-0e0rknSGkQxVLW2pI6G-7AwX8FCkrKw70QfPItcz
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 452-12-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
452-12-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 235KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ