Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
2964-31-0x0000000000400000-0x0000000000440000-memory.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2964-31-0x0000000000400000-0x0000000000440000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
2964-31-0x0000000000400000-0x0000000000440000-memory.dmp
-
Size
256KB
-
MD5
e5767ed68d8606a277de649fd4ecaba3
-
SHA1
2090a31b8fbcf002ffd7aa6f88b1d6a543fd99f3
-
SHA256
1b7eb01b503465c3797e323f071588c21f63a1f8f0e93c3b3f53f1e335914030
-
SHA512
330a357308e2d3e518f6b2285011cd92bf432b7efb2adf413b43556315b9a74953b3581f3653acb7a75c523f36c80b63c002132c6d2bc4c5d16cc40963528ecc
-
SSDEEP
3072:fenp+iGyuVYE6LbqV1tE7sEhad1GRzK5MXAa4x:fenp+iGyuVYE6Lbq5Ecd+zbAv
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.iaa-airferight.com - Port:
587 - Username:
[email protected] - Password:
webmaster - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2964-31-0x0000000000400000-0x0000000000440000-memory.dmp
Files
-
2964-31-0x0000000000400000-0x0000000000440000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 232KB - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ