Behavioral task
behavioral1
Sample
1760-4-0x0000000000400000-0x0000000000476000-memory.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1760-4-0x0000000000400000-0x0000000000476000-memory.exe
Resource
win10v2004-20240412-en
General
-
Target
1760-4-0x0000000000400000-0x0000000000476000-memory.dmp
-
Size
472KB
-
MD5
bf3af2073cdb320952c4f7cc1738aa13
-
SHA1
2e0a13e2a0307e41f7ae241b995d26b7a9dcde0e
-
SHA256
f4cd6c9c2dbf7c88f0d993d250e290bce827622d737473ececa17d76a213d143
-
SHA512
b424721ec8755bbc2140f80b7697585ac740535ec1349e2e0fc70afec5c803af53191415311e34afd7123c1631284c55783897e5112d5563e82cbc6508883b51
-
SSDEEP
12288:QGOzvLvzFvHJGPN5MP7r9r/+ppppppppppppppppppppppppppppp0G:szvLvzFQk1q
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.medicalhome.com.pe - Port:
587 - Username:
[email protected] - Password:
MHinfo01 - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1760-4-0x0000000000400000-0x0000000000476000-memory.dmp
Files
-
1760-4-0x0000000000400000-0x0000000000476000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 237KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 212KB - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ