agenttesla | 2112-19-0x0000000000400000-0x0000000000442000-memory[.]dmp | Triage

Sharing

General

Target

2112-19-0x0000000000400000-0x0000000000442000-memory.dmp
Size

264KB
MD5

7d114d3be25a1f797ea0466554c1a8ea
SHA1

df5c7993958713a6b6ccb94a05ce33918f7bcee0
SHA256

5a574abbe63a3682af3aa2369bc0abcf2811eddca97ddc66f9f3eccb97417478
SHA512

696bb5e47a3bf1277861a7d5a2668d653aed18c737d6988fa9d95fa8465cd081ba4d62f8b2c3be31ab2e70abbc449619a8695805caa888c6c3e400bcb9fb2886
SSDEEP

3072:sVsAIyiKaCkHIEnUpumpQhufVQJxThgpTRZdMaRgD5xBJ7+us:7yiKaCOpUwwcbJx9gpTvKaRgBJy

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.kowalskiokna.pl
Port:
587
Username:
[email protected]
Password:
artgeruhst75g
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2112-19-0x0000000000400000-0x0000000000442000-memory.dmp

Files

2112-19-0x0000000000400000-0x0000000000442000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ