agenttesla | 3060-15-0x0000000000400000-0x0000000000442000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3060-15-0x0000000000400000-0x0000000000442000-memory.dmp
Size

264KB
MD5

0369baa66e99f0f4d40d216eb7f54189
SHA1

a1512db8b9ee75d022efff44218a1e41b2383557
SHA256

d3fd159444a25ba1e7123d38c9f9465d5aa8ba3a60c3dc132a037ba08ef57eca
SHA512

911557a4c0500e4bb9d323ef7bdcd5ca0b2a54a5161a860b8264ac2592c32a48c943a49d0f7b223ee1d026a567708521525d554575594cb5036612bcf9e0690c
SSDEEP

3072:0uJN0wAxf3f3/5W013VovLSaUKh1iwcwr65dtqA9cA3p:hJN0zf3f3/5W013V2+anhAwcwrQqi

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
s30.securelayernetwork.com
Port:
587
Username:
[email protected]
Password:
%lmb-a,[(1ty
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3060-15-0x0000000000400000-0x0000000000442000-memory.dmp

Files

3060-15-0x0000000000400000-0x0000000000442000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 236KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ