File name: | REQ-10809.doc |
Full analysis: | https://app.any.run/tasks/9c60ab7a-47db-4ac3-b623-efb863b123e9 |
Verdict: | Malicious activity |
Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
Analysis date: | September 18, 2019, 15:28:21 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, unknown version |
MD5: | 36C70A160A016F6230B00A51319E98DC |
SHA1: | FDEB7C6723D2A10FC841401291A32B5510BEF13B |
SHA256: | 7980594A4BC4D1068D21AF7ECCCB03ABE5F94F79C9574D7F20892FE99B9F1A91 |
SSDEEP: | 24576:Ei8g1qACQ16433KhCwFBQIQSFXi8San4vni8dOgb5ZnW0irbrl8nE8HVVfDcEHSL:E/ |
.rtf | | | Rich Text Format (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3632 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\REQ-10809.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
4040 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
3564 | C:\Users\admin\AppData\Roaming\,nmkljbhkvjghvchfxgd.exe | C:\Users\admin\AppData\Roaming\,nmkljbhkvjghvchfxgd.exe | — | EQNEDT32.EXE |
User: admin Company: Hewlett-Packard Integrity Level: MEDIUM Description: Tetris Exit code: 0 Version: 1.0.0.0 | ||||
2724 | "C:\Users\admin\AppData\Roaming\,nmkljbhkvjghvchfxgd.exe" | C:\Users\admin\AppData\Roaming\,nmkljbhkvjghvchfxgd.exe | ,nmkljbhkvjghvchfxgd.exe | |
User: admin Company: Hewlett-Packard Integrity Level: MEDIUM Description: Tetris Version: 1.0.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3632 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRA2FB.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3632 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$Q-10809.doc | pgc | |
MD5:25B9C568FC555DCCC8E917720DA787F8 | SHA256:C5B23CF483274405439EBE6A2ED512D4715027345CF76D8AA5625C6E0C4C4331 | |||
2724 | ,nmkljbhkvjghvchfxgd.exe | C:\Users\admin\AppData\Local\Temp\637044210134485000_aaf79a6f-30dc-4ac7-95f4-c2ade38f231f.db | sqlite | |
MD5:0B3C43342CE2A99318AA0FE9E531C57B | SHA256:0CCB4915E00390685621DA3D75EBFD5EDADC94155A79C66415A7F4E9763D71B8 | |||
4040 | EQNEDT32.EXE | C:\Users\admin\AppData\Roaming\,nmkljbhkvjghvchfxgd.exe | executable | |
MD5:7A4D263B873EB31671427EA63EA8F5A4 | SHA256:7D4376E5C3226D6DA29869BF9E865402CDF204022A07231DCBB0AD4CF0FF19DE | |||
3632 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:2DF4F308AF2FB07E84CA859083AE6329 | SHA256:61899216CBACDB87E5FE9CD0E052216B4326CBFAE4D8510182B41924552B01C9 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4040 | EQNEDT32.EXE | GET | 302 | 86.185.81.42:80 | http://www.djmarket.co.uk/oli.exe | GB | html | 219 b | suspicious |
2724 | ,nmkljbhkvjghvchfxgd.exe | GET | 200 | 52.55.255.113:80 | http://checkip.amazonaws.com/ | US | text | 13 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2724 | ,nmkljbhkvjghvchfxgd.exe | 52.55.255.113:80 | checkip.amazonaws.com | Amazon.com, Inc. | US | shared |
4040 | EQNEDT32.EXE | 86.185.81.42:80 | www.djmarket.co.uk | British Telecommunications PLC | GB | suspicious |
4040 | EQNEDT32.EXE | 86.185.81.42:443 | www.djmarket.co.uk | British Telecommunications PLC | GB | suspicious |
2724 | ,nmkljbhkvjghvchfxgd.exe | 197.242.147.65:587 | webmail.noahtrader.com | Afrihost | ZA | malicious |
Domain | IP | Reputation |
---|---|---|
www.djmarket.co.uk |
| suspicious |
checkip.amazonaws.com |
| shared |
webmail.noahtrader.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
4040 | EQNEDT32.EXE | Potentially Bad Traffic | ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile |
2724 | ,nmkljbhkvjghvchfxgd.exe | A Network Trojan was detected | MALWARE [PTsecurity] AgentTesla IP Check |
2724 | ,nmkljbhkvjghvchfxgd.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
2724 | ,nmkljbhkvjghvchfxgd.exe | A Network Trojan was detected | AV TROJAN Win.Keylogger.AgentTesla variant outbound SMTP connection |
2724 | ,nmkljbhkvjghvchfxgd.exe | A Network Trojan was detected | MALWARE [PTsecurity] Trojan-Spy.Keylogger.AgentTesla Exfiltration by SMTP |