| File name: | 07_09_19 _11_42_44_gelenmail.doc |
| Full analysis: | https://app.any.run/tasks/3368c697-1bb3-4a45-bb3b-96ace709b684 |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | July 11, 2019, 16:39:14 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/rtf |
| File info: | Rich Text Format data, unknown version |
| MD5: | 6FF7F083AB1EBC9E1BB789D6C46E5B83 |
| SHA1: | 083A00A32CEA6F65ED4B2B69E0B75EDB84E6C50F |
| SHA256: | 76D14D6BF06D167349029523B223ADAACB7A612CBCC318D58ECE849A9C59A944 |
| SSDEEP: | 96:vism2xPbdVMx0V9UIaV2FIIFAgUF1XwOermejQHLNK2S:RjwyV9U70RUF1Xi4JK/ |
MALICIOUS
Application was dropped or rewritten from another process
- wyval.exe (PID: 3168)
- wyval.exe (PID: 3232)
Equation Editor starts application (CVE-2017-11882)
- EQNEDT32.EXE (PID: 3496)
REMCOS was detected
- wyval.exe (PID: 3232)
REMCOS RAT was detected
- wyval.exe (PID: 3232)
Detected logs from REMCOS RAT
- wyval.exe (PID: 3232)
Changes the autorun value in the registry
- wyval.exe (PID: 3168)
Downloads executable files from the Internet
- EQNEDT32.EXE (PID: 3496)
SUSPICIOUS
Executable content was dropped or overwritten
- EQNEDT32.EXE (PID: 3496)
- wyval.exe (PID: 3168)
Suspicious files were dropped or overwritten
- wyval.exe (PID: 3168)
Creates files in the user directory
- EQNEDT32.EXE (PID: 3496)
- wyval.exe (PID: 3232)
Application launched itself
- wyval.exe (PID: 3168)
Writes files like Keylogger logs
- wyval.exe (PID: 3232)
Executed via COM
- EQNEDT32.EXE (PID: 3496)
INFO
Creates files in the user directory
- WINWORD.EXE (PID: 2900)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 2900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rtf | | | Rich Text Format (100) |
|---|
Total processes
37
Monitored processes
4
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2900 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\07_09_19 _11_42_44_gelenmail.doc.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 3168 | "C:\Users\admin\AppData\Roaming\wyval.exe" | C:\Users\admin\AppData\Roaming\wyval.exe | EQNEDT32.EXE | ||||||||||||
User: admin Company: How, Inc Integrity Level: MEDIUM Description: Free YouTube Downloader Setup Program Exit code: 0 Version: 595.15.459.905 Modules
| |||||||||||||||
| 3232 | "C:\Users\admin\AppData\Roaming\wyval.exe" | C:\Users\admin\AppData\Roaming\wyval.exe | wyval.exe | ||||||||||||
User: admin Company: How, Inc Integrity Level: MEDIUM Description: Free YouTube Downloader Setup Program Exit code: 0 Version: 595.15.459.905 Modules
| |||||||||||||||
| 3496 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | ||||||||||||
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 Modules
| |||||||||||||||
Total events
1 097
Read events
748
Write events
344
Delete events
5
Modification events
| (PID) Process: | (2900) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | b/ |
Value: 622F2000540B0000010000000000000000000000 | |||
| (PID) Process: | (2900) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (2900) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: On | |||
| (PID) Process: | (2900) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | WORDFiles |
Value: 1324023838 | |||
| (PID) Process: | (2900) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1324023952 | |||
| (PID) Process: | (2900) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1324023953 | |||
| (PID) Process: | (2900) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
| Operation: | write | Name: | MTTT |
Value: 540B0000BEB1E5390738D50100000000 | |||
| (PID) Process: | (2900) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | (1 |
Value: 28312000540B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (2900) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | delete value | Name: | (1 |
Value: 28312000540B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (2900) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
Executable files
3
Suspicious files
0
Text files
2
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2900 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR37E2.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2900 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:— | SHA256:— | |||
| 3496 | EQNEDT32.EXE | C:\Users\admin\AppData\Roaming\wyval.exe | executable | |
MD5:— | SHA256:— | |||
| 2900 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$_09_19 _11_42_44_gelenmail.doc.rtf | pgc | |
MD5:— | SHA256:— | |||
| 3168 | wyval.exe | C:\Users\Public\bKqoAfTmyH.vbs | text | |
MD5:— | SHA256:— | |||
| 3232 | wyval.exe | C:\Users\admin\AppData\Roaming\remcos\logs.dat | text | |
MD5:— | SHA256:— | |||
| 3168 | wyval.exe | C:\Users\admin\wydad\vcasehdndbnseb.bat | executable | |
MD5:— | SHA256:— | |||
| 3496 | EQNEDT32.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\ca[1].exe | executable | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
14
DNS requests
2
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3496 | EQNEDT32.EXE | GET | 200 | 167.114.113.137:80 | http://ca.fakesemoca16.com/ca.exe | CA | executable | 1.22 Mb | suspicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3496 | EQNEDT32.EXE | 167.114.113.137:80 | ca.fakesemoca16.com | OVH SAS | CA | suspicious |
3232 | wyval.exe | 178.239.21.3:8234 | cazt01money.ddns.net | Telekomunikacije Republike Srpske akcionarsko drustvo Banja Luka | BA | malicious |
— | — | 178.239.21.3:8234 | cazt01money.ddns.net | Telekomunikacije Republike Srpske akcionarsko drustvo Banja Luka | BA | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
ca.fakesemoca16.com |
| suspicious |
cazt01money.ddns.net |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3496 | EQNEDT32.EXE | Potentially Bad Traffic | ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile |
3496 | EQNEDT32.EXE | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |