Behavioral task
behavioral1
Sample
668-9-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
668-9-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20240802-en
General
-
Target
668-9-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
14eac7976fa425369386ef9ab34f13f9
-
SHA1
57a0883b1701f7d42bd6c3adf10e3b9bed6f78e8
-
SHA256
7d416086e6cecf9788fecb9e340d2f995b6343978fe50a6c53822e48a6ce0e5e
-
SHA512
b931e3e8ca18cfc35a215dd41b7c5e6a91ef60e74b0fa9e707286643115f3d878db0603954934ee13feb010aa8c0acd2179b84bb323e8730ac841231cd3336da
-
SSDEEP
3072:EOn9xtpdwFHfGaMqDQ2P92Seby7iywn6zWmUmm4y25uBNebZ9Z:39xtpdwFHfGaMqD992SedyeSylN0/
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.b-trust.org - Port:
587 - Username:
[email protected] - Password:
bg680304 - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 668-9-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
668-9-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 239KB - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ