agenttesla | 2492-21-0x0000000000400000-0x0000000000442000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2492-21-0x0000000000400000-0x0000000000442000-memory.dmp
Size

264KB
MD5

cd308bfc0f4474a6b2b33442ad7b63ff
SHA1

3bf9df1afdfaf30409b8273f321b18519f6e5059
SHA256

65e3dab2a83fc2dd8a9cec97e6b62d3932776738e2a32fc9012f142e434c96f6
SHA512

331813bc1ddd1bfb1d9930ef0bc1b9dee9bdf48a118ad1a6aa1b4959b36549be3810caaf4f2e23d7f77c6c4cab74c7714ae0fbcebd278b41bf32ff42b5ec05f4
SSDEEP

3072:F085q24UL1u/z7LTj7EqALIvw7VQ9ub0UC5AyzxE:Fp4UL1u/z7LTj7EqOAV9Kt+zq

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.seawaysfreight-bd.com
Port:
587
Username:
[email protected]
Password:
22@ImP%sFl#
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2492-21-0x0000000000400000-0x0000000000442000-memory.dmp

Files

2492-21-0x0000000000400000-0x0000000000442000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 233KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ