analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Quote753BQ52419.pdf.xz

Full analysis: https://app.any.run/tasks/c65262b2-4460-4863-86e0-1e3f4384ab51
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Analysis date: May 24, 2019, 13:54:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
rat
agenttesla
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

269150721768B497426B92A9553CEE42

SHA1:

8EEE9D0265B3210223E20989CD5E31FF747987D2

SHA256:

20853EEF268C46BF8995A1B32BE0AC83B1C8015CA3F411D7F28DBCA221409795

SSDEEP:

12288:JgHtYKIfywx/UDnXX4NWu3BTyeytNO3rdcGRab//hFx+6r6UsAtmzcycN9:JgHhIKwWDXW/3BTlyHmdrRab//V+6r79

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Quote753BQ52419.exe (PID: 2356)
    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 3256)
    • Writes to a start menu file

      • Quote753BQ52419.exe (PID: 2356)
    • AGENTTESLA was detected

      • RegAsm.exe (PID: 3256)
  • SUSPICIOUS

    • Checks for external IP

      • RegAsm.exe (PID: 3256)
    • Executable content was dropped or overwritten

      • Quote753BQ52419.exe (PID: 2356)
      • WinRAR.exe (PID: 636)
    • Creates files in the user directory

      • Quote753BQ52419.exe (PID: 2356)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Quote753BQ52419.exe
ZipUncompressedSize: 1188352
ZipCompressedSize: 717594
ZipCRC: 0x3e54996f
ZipModifyDate: 2019:05:24 02:55:00
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe quote753bq52419.exe #AGENTTESLA regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
636"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Quote753BQ52419.pdf.xz.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2356"C:\Users\admin\AppData\Local\Temp\Rar$EXa636.10044\Quote753BQ52419.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa636.10044\Quote753BQ52419.exe
WinRAR.exe
User:
admin
Company:
wiawow64
Integrity Level:
MEDIUM
Description:
Analog.Shell.Broker
Exit code:
0
Version:
527.491.958.182
3256"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Quote753BQ52419.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Total events
505
Read events
481
Write events
24
Delete events
0

Modification events

(PID) Process:(636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(636) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Quote753BQ52419.pdf.xz.zip
(PID) Process:(636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
2
Suspicious files
0
Text files
2
Unknown types
1

Dropped files

PID
Process
Filename
Type
2356Quote753BQ52419.exeC:\Users\admin\IntelCpHeciSvc\GamePanel.vbstext
MD5:690FE0FDFCE7EA35010A3E8CF034FE87
SHA256:140CF9AC7FB1134DA94DAE5D371857CC5FF8FFFF3B3F5CA1761374F976785A56
3256RegAsm.exeC:\Users\admin\AppData\Local\Temp\636943065185116250_0ea51817-170f-4d5e-b8ef-f8a322b35174.dbsqlite
MD5:0B3C43342CE2A99318AA0FE9E531C57B
SHA256:0CCB4915E00390685621DA3D75EBFD5EDADC94155A79C66415A7F4E9763D71B8
2356Quote753BQ52419.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GamePanel.urltext
MD5:85253049C0D443A899FFF314CEA8538C
SHA256:8A97B346AFB44686C62BBCCBCDBC8418D44BACB0D4FEA2BEAF8DF9E7E4E8A549
636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa636.10044\Quote753BQ52419.exeexecutable
MD5:F2BD0E0F0F15A31544B9F04BFFC8C75F
SHA256:841078303A93DE82D9F1119265BDA24CE031BDB7168FA0C4B46014786281C655
2356Quote753BQ52419.exeC:\Users\admin\IntelCpHeciSvc\igfxCUIService.exeexecutable
MD5:715A62729643CC0EE7941D6FECA4225F
SHA256:41622BA30FB6A24611D8C643CEF592101ECE1C67383B8A2ADBF28C0BB2BD65EC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3256
RegAsm.exe
GET
200
52.200.125.74:80
http://checkip.amazonaws.com/
US
text
13 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
172.217.22.46:80
Google Inc.
US
whitelisted
3256
RegAsm.exe
52.200.125.74:80
checkip.amazonaws.com
Amazon.com, Inc.
US
shared
3256
RegAsm.exe
54.36.114.36:587
mail.atensaltd.com
OVH SAS
FR
malicious

DNS requests

Domain
IP
Reputation
mail.atensaltd.com
  • 54.36.114.36
malicious
checkip.amazonaws.com
  • 52.200.125.74
  • 34.233.102.38
  • 52.6.79.229
  • 52.202.139.131
  • 52.206.161.133
  • 18.211.215.84
shared

Threats

PID
Process
Class
Message
3256
RegAsm.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
3256
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] AgentTesla IP Check
2 ETPRO signatures available at the full report
No debug info