File name: | sample10.rtf |
Full analysis: | https://app.any.run/tasks/03c5bb40-0eab-4c0f-9433-487681c5b81a |
Verdict: | Malicious activity |
Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
Analysis date: | July 18, 2019, 13:27:59 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, unknown version |
MD5: | A097E6900EDB297A78A38C7D681B585B |
SHA1: | FFCECA5FC25DDF4ECB3EE54111765A8D9BCA6D9F |
SHA256: | 34E4E0F2F24759CB5D28A949E0743A0005274C7B6B0A784ABA82CF3F7D308839 |
SSDEEP: | 96:cf52n/WFyHCJeLAVbAbFyfQFsibh5naNg8H:k52nOYryfQmiXapH |
.rtf | | | Rich Text Format (99.9) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3856 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\sample10.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3680 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
2276 | "C:\Users\admin\AppData\Roaming\asftrew.exe" | C:\Users\admin\AppData\Roaming\asftrew.exe | EQNEDT32.EXE | |
User: admin Company: Saab Integrity Level: MEDIUM Description: Platformer Exit code: 0 Version: 1.0.0.0 | ||||
352 | "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RkwnOfYTEJ" /XML "C:\Users\admin\AppData\Local\Temp\tmpDC33.tmp" | C:\Windows\System32\schtasks.exe | — | asftrew.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3704 | "C:\Users\admin\AppData\Roaming\asftrew.exe" | C:\Users\admin\AppData\Roaming\asftrew.exe | asftrew.exe | |
User: admin Company: Saab Integrity Level: MEDIUM Description: Platformer Version: 1.0.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3856 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRF647.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2276 | asftrew.exe | C:\Users\admin\AppData\Local\Temp\tmpDC33.tmp | — | |
MD5:— | SHA256:— | |||
3704 | asftrew.exe | C:\Users\admin\AppData\Local\Temp\636990570017072500_f1bba211-f608-496c-b23e-31de12d8b746.db | sqlite | |
MD5:0B3C43342CE2A99318AA0FE9E531C57B | SHA256:0CCB4915E00390685621DA3D75EBFD5EDADC94155A79C66415A7F4E9763D71B8 | |||
3680 | EQNEDT32.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\neeel[1].exe | executable | |
MD5:D164A054E788F053262BCD9DE04175C0 | SHA256:636519A199C1650E22127B4B972ACB93AF08CFB3342E5B61CC361E4304CBCE81 | |||
3704 | asftrew.exe | C:\Users\admin\AppData\Roaming\zdk3kolz.fqz\Chrome\Default\Cookies | sqlite | |
MD5:DD9640AF5F03807CF2E3921CBA16AF0D | SHA256:ECF72C454FEF08C5948A565464839A554567E499F995483D6C8B54B32EA2C5F0 | |||
2276 | asftrew.exe | C:\Users\admin\AppData\Roaming\RkwnOfYTEJ.exe | executable | |
MD5:D164A054E788F053262BCD9DE04175C0 | SHA256:636519A199C1650E22127B4B972ACB93AF08CFB3342E5B61CC361E4304CBCE81 | |||
3680 | EQNEDT32.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat | dat | |
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862 | SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A | |||
3856 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:2C39A189637295DD923019C1183D4B0D | SHA256:8C646733D9EAE60486E0A22F4893A17C0AE06C280488BCE0A6A697F53A565338 | |||
3856 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$mple10.rtf | pgc | |
MD5:8C9E5840AC1A8C08D8C8965477A1EB9C | SHA256:AF9D36C9CF654CB6932616896D6C89BBE4D6DECDCCFC707ABBC4764D979C06EA | |||
3704 | asftrew.exe | C:\Users\admin\AppData\Roaming\zdk3kolz.fqz\Firefox\Profiles\qldyz51w.default\cookies.sqlite | sqlite | |
MD5:0FADC4296E7FD3E437963BB826E6F340 | SHA256:B1F9AFD138384F008321699664F69961BB2A36BA0FA1E0A807336696A344836A |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3704 | asftrew.exe | GET | 200 | 34.233.102.38:80 | http://checkip.amazonaws.com/ | US | text | 15 b | shared |
3704 | asftrew.exe | GET | 200 | 34.233.102.38:80 | http://checkip.amazonaws.com/ | US | text | 15 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3704 | asftrew.exe | 198.57.246.233:587 | mail.emtains.com | Unified Layer | US | unknown |
3704 | asftrew.exe | 34.233.102.38:80 | checkip.amazonaws.com | Amazon.com, Inc. | US | shared |
3680 | EQNEDT32.EXE | 112.213.89.40:443 | tfvn.com.vn | SUPERDATA | VN | malicious |
Domain | IP | Reputation |
---|---|---|
tfvn.com.vn |
| unknown |
checkip.amazonaws.com |
| shared |
mail.emtains.com |
| unknown |
dns.msftncsi.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
3704 | asftrew.exe | A Network Trojan was detected | MALWARE [PTsecurity] AgentTesla IP Check |
3704 | asftrew.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
3704 | asftrew.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
3704 | asftrew.exe | A Network Trojan was detected | MALWARE [PTsecurity] AgentTesla IP Check |