agenttesla | 2620-11-0x0000000000400000-0x0000000000440000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2620-11-0x0000000000400000-0x0000000000440000-memory.dmp
Size

256KB
MD5

e8c4ebac5a6c6b703b81419f35823cfa
SHA1

f9d513b854a69d411eb28400d15e715df7ff4e67
SHA256

ea24362557a8bef16505e2d0bb2b610272a1654e4d33c7421e14bc44c0a94276
SHA512

349748672ef73e902a7c6366eb028023cabbc75be5049dfe154055e59a8d6a07f52db08cd08715f33e29cb5a92c588044f2def87a155c2c854aa0c752ffb879b
SSDEEP

3072:mw19CmyuyyRwqVqFbE+/ZWghpv7uQZD5w4UuMgu:mw19CmyuyyRwqVqFbVWAnZaul

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.gazityres.com
Port:
587
Username:
[email protected]
Password:
Was17112022
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2620-11-0x0000000000400000-0x0000000000440000-memory.dmp

Files

2620-11-0x0000000000400000-0x0000000000440000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ