Behavioral task
behavioral1
Sample
1964-11-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1964-11-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20240412-en
General
-
Target
1964-11-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
65c248117cd91d86f01a0add9399d976
-
SHA1
d9131cb4239926f85cb54beaafa85205e003a7bd
-
SHA256
110dc34592ed57ff06db5dcfba4e1dd8ef674faae77561eef45bc5df5a3d4890
-
SHA512
a820cf28b97d61ffede6c377d3356007ae57a564bbfed7c74bbf4c73e9e936ec9f0271b3caa4fc6bb9d2d85e3409d8317c28d46953ee0f37955c9f6ce18b6aa6
-
SSDEEP
3072:Kgfi6CyKaiRKDQ+5s4izScJ20N6U52TxagA2:26CyKai4DnziOcI0N6Px/
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.myhydropowered.com - Port:
587 - Username:
[email protected] - Password:
jnKkQ2DFtjsDqGZ - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1964-11-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
1964-11-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 235KB - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ