| File name: | 6c2fbf874d04c404abb34b7c669e19996cb38175167445eb96e1186c2098ca74 |
| Full analysis: | https://app.any.run/tasks/f0bc9369-92e9-45e4-b521-e93304043b88 |
| Verdict: | Malicious activity |
| Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
| Analysis date: | December 14, 2024, 01:21:45 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | E115445950C680D96DD85C0C92615166 |
| SHA1: | C0C2BA6AAB46C9F8BED59B7E5266412ED86416C5 |
| SHA256: | 6C2FBF874D04C404ABB34B7C669E19996CB38175167445EB96E1186C2098CA74 |
| SSDEEP: | 24576:cifL+UnWiyi80fNnTggMtmv/M1U3jyILEGMpOLcXIFhMZk:cifL+Diyi80fNnTggGmv/M1U3jyILEGt |
MALICIOUS
Generic archive extractor
- WinRAR.exe (PID: 6508)
Steals credentials from Web Browsers
- RegSvcs.exe (PID: 6744)
Actions looks like stealing of personal data
- RegSvcs.exe (PID: 6744)
Connects to the CnC server
- RegSvcs.exe (PID: 6744)
AGENTTESLA has been detected (YARA)
- RegSvcs.exe (PID: 6744)
AGENTTESLA has been detected (SURICATA)
- RegSvcs.exe (PID: 6744)
Antivirus name has been found in the command line (generic signature)
- MpCmdRun.exe (PID: 5404)
SUSPICIOUS
Connects to SMTP port
- RegSvcs.exe (PID: 6744)
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 6508)
Executing commands from a ".bat" file
- WinRAR.exe (PID: 6508)
Starts CMD.EXE for commands execution
- WinRAR.exe (PID: 6508)
Contacting a server suspected of hosting an CnC
- RegSvcs.exe (PID: 6744)
INFO
Reads mouse settings
- Advice_07122024.exe (PID: 6680)
Checks supported languages
- Advice_07122024.exe (PID: 6680)
- RegSvcs.exe (PID: 6744)
- MpCmdRun.exe (PID: 5404)
Reads the computer name
- RegSvcs.exe (PID: 6744)
- MpCmdRun.exe (PID: 5404)
Manual execution by a user
- Advice_07122024.exe (PID: 6680)
Create files in a temporary directory
- Advice_07122024.exe (PID: 6680)
- MpCmdRun.exe (PID: 5404)
Reads the machine GUID from the registry
- RegSvcs.exe (PID: 6744)
The sample compiled with english language support
- WinRAR.exe (PID: 6508)
The process uses the downloaded file
- WinRAR.exe (PID: 6508)
.NET Reactor protector has been detected
- RegSvcs.exe (PID: 6744)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 6508)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
EXIF
ZIP
| ArchivedFileName: | Advice_07122024.exe |
|---|---|
| OperatingSystem: | Win32 |
| UncompressedSize: | 1185792 |
| CompressedSize: | 690382 |
| FileVersion: | RAR v5 |
Total processes
123
Monitored processes
7
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2192 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6508 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\6c2fbf874d04c404abb34b7c669e19996cb38175167445eb96e1186c2098ca74.rar | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 6680 | "C:\Users\admin\Desktop\Advice_07122024.exe" | C:\Users\admin\Desktop\Advice_07122024.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 6744 | "C:\Users\admin\Desktop\Advice_07122024.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Advice_07122024.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Services Installation Utility Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 2092 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR6508.15090\Rar$Scan27689.bat" " | C:\Windows\System32\cmd.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1344 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5404 | "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR6508.15090" | C:\Program Files\Windows Defender\MpCmdRun.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Malware Protection Command Line Utility Exit code: 2 Version: 4.18.1909.6 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
2 641
Read events
2 632
Write events
9
Delete events
0
Modification events
| (PID) Process: | (6508) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (6508) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (6508) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (6508) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\6c2fbf874d04c404abb34b7c669e19996cb38175167445eb96e1186c2098ca74.rar | |||
| (PID) Process: | (6508) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (6508) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (6508) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (6508) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (6508) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\VirusScan |
| Operation: | write | Name: | DefScanner |
Value: Windows Defender | |||
Executable files
1
Suspicious files
2
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6508 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$VR6508.15090\Rar$Scan27689.bat | text | |
MD5:0B91C902EEBEB6F53416086A316321C0 | SHA256:C6A10C74243135C91CE750202AF42AC0C67A3285D8CB6F57CAE88DBBA0E06234 | |||
| 5404 | MpCmdRun.exe | C:\Users\admin\AppData\Local\Temp\MpCmdRun.log | text | |
MD5:5586876114CF60683A7F818D48FA48BA | SHA256:7D8B2D76AAD05C46FCA25235F11112C4630899FC7B9A01FAD180F4B4260141C8 | |||
| 6680 | Advice_07122024.exe | C:\Users\admin\AppData\Local\Temp\camellin | binary | |
MD5:F116536E146BA9B14B9CB3A20AC53D6C | SHA256:43D6728A93D1FEF4E6A997D9FAE7366D796AB34DC29751239ADAC2C97A65EC80 | |||
| 6508 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$VR6508.15090\6c2fbf874d04c404abb34b7c669e19996cb38175167445eb96e1186c2098ca74.rar\Advice_07122024.exe | executable | |
MD5:5F7D704D6CCC83F30D9F758B2323E59C | SHA256:EE23238FC24DE9406EFFE1973B94C05C19E1347C38046AE74DC07159BEC01F3C | |||
| 6680 | Advice_07122024.exe | C:\Users\admin\AppData\Local\Temp\aut6A27.tmp | binary | |
MD5:F116536E146BA9B14B9CB3A20AC53D6C | SHA256:43D6728A93D1FEF4E6A997D9FAE7366D796AB34DC29751239ADAC2C97A65EC80 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
23
DNS requests
10
Threats
7
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1684 | svchost.exe | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1684 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1684 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 2.23.209.133:443 | www.bing.com | Akamai International B.V. | GB | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1684 | svchost.exe | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1684 | svchost.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
4712 | MoUsoCoreWorker.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
mail.mbarieservicesltd.com |
| malicious |
self.events.data.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | A Network Trojan was detected | STEALER [ANY.RUN] AgentTesla Exfiltration (raw TCP) |
— | — | A Network Trojan was detected | ET MALWARE AgentTesla Exfil Via SMTP |
— | — | Misc activity | INFO [ANY.RUN] SMTP email client opens transfer with server (EHLO) |
4 ETPRO signatures available at the full report