agenttesla | 2688-21-0x0000000000400000-0x0000000000440000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2688-21-0x0000000000400000-0x0000000000440000-memory.dmp
Size

256KB
MD5

71db516731d65ff496efcc8b9b42e5e1
SHA1

836fd7428d72d315b6cb2f80487c023ab4f7add4
SHA256

e97fc71d297740c1d22fcca15b009efaaac2235b4246ef37263dad20940e31b6
SHA512

ea00938ab9a6fa90c8e4d862ca911673ce62e55d5ac42742426b363fd46fc253b81c6c6e7dc83816e113267f410a95e378ec50dea8d8adb27f9c3955f0342f7f
SSDEEP

3072:ZXvGyuyePOV4vpbxtU+VecG0niJze5IBXR+XS:ZXvGyuyePOV4vpbxLLiJz1Rc

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.kxnlaos.com
Port:
587
Username:
[email protected]
Password:
eDe~fz;Cy0{W
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2688-21-0x0000000000400000-0x0000000000440000-memory.dmp

Files

2688-21-0x0000000000400000-0x0000000000440000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ