agenttesla | 4064-580-0x0000000000470000-0x00000000016C4000-memory[.]dmp | Triage

Sharing

General

Target

4064-580-0x0000000000470000-0x00000000016C4000-memory.dmp
Size

18.3MB
MD5

49bfee20244ea16bfbdbba87ebe3a2db
SHA1

1f645ea5c701d8dcca10f8583e6d3321b1cd5c34
SHA256

a52ab7d259f2807f1023e7c6fb388ae820cc9a2cda07f70da6e326a0fb92612f
SHA512

dde8eca26a24cbe30aba4a8f6d3fa011dbbfd8ae33080fccc7e7416fe4e469549876bf6a2d460ba1012cd66a1d45d83c2c45c08e97b31ae8c4268d9364a5a8e7
SSDEEP

1536:MD2u6W8uyGC+bYpKigQOkQbuwCheerq/914f83fYOU5sywPXGN5Qi2PMo:qOuyGC+UpFjCbuukS91EMgOU5xCGN5M

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.synergyinnovationsgroup.com
Port:
587
Username:
[email protected]
Password:
C@p-Y8BoHc#?
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
4064-580-0x0000000000470000-0x00000000016C4000-memory.dmp

Files

4064-580-0x0000000000470000-0x00000000016C4000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ