Behavioral task
behavioral1
Sample
2568-14-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2568-14-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20240802-en
General
-
Target
2568-14-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
d7f7ce8609e376c0fdb31fa905e665d0
-
SHA1
ac9475b9f419e4352f9ce8338336f962230bfb94
-
SHA256
2c4fd4e167e79a3c1ae01fb7802b31772e7d7ec5b0d6ac1a025b60b9c8f28563
-
SHA512
f9eb1b90eb33a3e65984160497f3951f8ef6757ece4afae1b49d6927045cbbea9947a1fa1344bec93c077653b6013bb8d9b1a7aeb8d9e6ddcaf79e2391575835
-
SSDEEP
3072:GcxtpdRvI7RYVt9w4FZu8Ok2Luk/jtJ5oRfOPhy:1xtpdRQ7RYVt9w4FZELfjtefEh
Malware Config
Extracted
agenttesla
Protocol: smtp- Port:
587 - Username:
ftp://[email protected] - Password:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2568-14-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
2568-14-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 238KB - Virtual size: 237KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ