agenttesla | 1076-717-0x0000000000470000-0x00000000014D2000-memory[.]dmp | Triage

Sharing

General

Target

1076-717-0x0000000000470000-0x00000000014D2000-memory.dmp
Size

16.4MB
MD5

f16eb88318455d73ca5b2536f5a0104d
SHA1

25c511c964ca5518a7309b0ee086d3c39e441397
SHA256

7b5fadcc74beaf518d0c72c768a3537cfa4b5dde3272690bcc959b191857f8ab
SHA512

468d17d81b66ffa59abd24fa0b4b4e4894cd50be54ae9c1aa532d37f07075e61fe08b911c93e79846b94abed04bc4b3f87cb8fd037fdfd7e69cb19bcede94a5b
SSDEEP

1536:yD2u6W8uyGC+bYpKigQOkQbuwCheerq/914f83fYOU5sywPXGN5Qi2PMo:oOuyGC+UpFjCbuukS91EMgOU5xCGN5M

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.synergyinnovationsgroup.com
Port:
587
Username:
[email protected]
Password:
C@p-Y8BoHc#?
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
1076-717-0x0000000000470000-0x00000000014D2000-memory.dmp

Files

1076-717-0x0000000000470000-0x00000000014D2000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ