Behavioral task
behavioral1
Sample
3064-15-0x0000000000400000-0x0000000000440000-memory.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3064-15-0x0000000000400000-0x0000000000440000-memory.exe
Resource
win10v2004-20240419-en
General
-
Target
3064-15-0x0000000000400000-0x0000000000440000-memory.dmp
-
Size
256KB
-
MD5
e3f2b383d0512a391a873b9404068358
-
SHA1
b9689cd0f11eec0df93773cd7f11771e978c42f2
-
SHA256
64e37ca2ba6b1c66a89f0c089f75ac4d7781d9d1e10eb796b499c200edf19429
-
SHA512
ae49a656e22de324686e8b18a962c9f199cb4ddb55dcd68cdd8d560248ec4b6f5d117dab70886abe849976b743990909913a8be141dc4d0c069d33c43d1c6c69
-
SSDEEP
3072:wenp+iGyuVYE6LbqV1tE7sEhad1GRzK5MXAa4x:wenp+iGyuVYE6Lbq5Ecd+zbAv
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.iaa-airferight.com - Port:
587 - Username:
[email protected] - Password:
webmaster - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 3064-15-0x0000000000400000-0x0000000000440000-memory.dmp
Files
-
3064-15-0x0000000000400000-0x0000000000440000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 232KB - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ