analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PO #A-0183HT 7785 .doc

Full analysis: https://app.any.run/tasks/c354a440-bfba-4b02-9f32-1b70e160f330
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: December 18, 2018, 07:10:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
CVE-2017-11882
loader
trojan
nanocore
rat
Indicators:
MIME: text/rtf
File info: Rich Text Format data, unknown version
MD5:

0282A5389333425A090A4CAAFBFDF84E

SHA1:

7FDA3E754A9C1BCC93CAA4F7AB1BDA0E202CCC44

SHA256:

7DD52DDAA5F02B4159D513FB65B49FFF5A131CA8A1C5CA2B1790F77E4E76DC95

SSDEEP:

1536:Uyd9WL+ta/dLHC6mf5gAKJ+7zJxe4YGdiV2:z9Wga/y8rGZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • abuyyui.exe (PID: 2936)
      • abuyyui.exe (PID: 2868)
    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 3256)
    • NanoCore was detected

      • abuyyui.exe (PID: 2868)
    • Downloads executable files from the Internet

      • EQNEDT32.EXE (PID: 3256)
    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3256)
    • Changes the autorun value in the registry

      • abuyyui.exe (PID: 2868)
    • Connects to CnC server

      • abuyyui.exe (PID: 2868)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 3256)
      • abuyyui.exe (PID: 2868)
    • Application launched itself

      • abuyyui.exe (PID: 2936)
    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 3256)
      • abuyyui.exe (PID: 2868)
    • Connects to unusual port

      • abuyyui.exe (PID: 2868)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2940)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs eqnedt32.exe abuyyui.exe no specs #NANOCORE abuyyui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2940"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\PO #A-0183HT 7785 .doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3256"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2936"C:\Users\admin\AppData\Roaming\abuyyui.exe"C:\Users\admin\AppData\Roaming\abuyyui.exeEQNEDT32.EXE
User:
admin
Company:
Glossopodium7
Integrity Level:
MEDIUM
Description:
IODAMOEBA
Exit code:
0
Version:
3.06.0008
2868C:\Users\admin\AppData\Roaming\abuyyui.exe"C:\Users\admin\AppData\Roaming\abuyyui.exe
abuyyui.exe
User:
admin
Company:
Glossopodium7
Integrity Level:
MEDIUM
Description:
IODAMOEBA
Version:
3.06.0008
Total events
1 104
Read events
756
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
3
Text files
1
Unknown types
4

Dropped files

PID
Process
Filename
Type
2940WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRAA0E.tmp.cvr
MD5:
SHA256:
2940WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:1D7E7059A7A45BB46E43FBA9F3182271
SHA256:BC9CC8270124E8A3346DD49A0BF9425D1EBF1D0EC43A98DF508DE07D71C45B36
2868abuyyui.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:24C5D04540ACEDCBF6E7F9EB9184C88D
SHA256:2D02B39F5612F03213496B3BBD113649488A617F0B93E86D23CD1CB4063C3D27
2940WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ #A-0183HT 7785 .docpgc
MD5:E80DFE9959707CDC91E0A4824BC6009E
SHA256:2D05F65E0B85A4F4F5815292EEA633AD5FD360C2B5E189C240AE12867ADCFA51
3256EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\azbuyt[1].exeexecutable
MD5:B0D81FBC0EBDD346C08B32A1888701F7
SHA256:E7AD01F3A9CADDDDEE72103BB8591B02A5C23872B9A076C8A0284B2270FC44BF
3256EQNEDT32.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.datdat
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862
SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A
3256EQNEDT32.EXEC:\Users\admin\AppData\Roaming\abuyyui.exeexecutable
MD5:B0D81FBC0EBDD346C08B32A1888701F7
SHA256:E7AD01F3A9CADDDDEE72103BB8591B02A5C23872B9A076C8A0284B2270FC44BF
2868abuyyui.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exeexecutable
MD5:B0D81FBC0EBDD346C08B32A1888701F7
SHA256:E7AD01F3A9CADDDDEE72103BB8591B02A5C23872B9A076C8A0284B2270FC44BF
2936abuyyui.exeC:\Users\admin\AppData\Local\Temp\~DFDB1E718AFC2ABACA.TMPbinary
MD5:4879A942A6C0E833607242C00760E5F1
SHA256:200D86D3668AC2083250821C54B12DAEE6D6E9D95B889788B76E25AD5F7168DB
2868abuyyui.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.datbs
MD5:32D0AAE13696FF7F8AF33B2D22451028
SHA256:5347661365E7AD2C1ACC27AB0D150FFA097D9246BB3626FCA06989E976E8DD29
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
5
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3256
EQNEDT32.EXE
GET
200
196.41.122.37:80
http://topdottourism.co.za/doc/sm/azbuyt.exe
ZA
executable
578 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2868
abuyyui.exe
8.8.8.8:53
Google Inc.
US
whitelisted
3256
EQNEDT32.EXE
196.41.122.37:80
topdottourism.co.za
Cybersmart
ZA
malicious
2868
abuyyui.exe
185.148.241.40:3413
jacksmithcarter.ddns.net
Ideal Hosting Sunucu Internet Hiz. Tic. Ltd. Sti.
TR
malicious

DNS requests

Domain
IP
Reputation
topdottourism.co.za
  • 196.41.122.37
malicious
jacksmithcarter.ddns.net
  • 185.148.241.40
malicious

Threats

PID
Process
Class
Message
3256
EQNEDT32.EXE
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious .exe downloading from /doc/ path
3256
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2868
abuyyui.exe
A Network Trojan was detected
SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain
2868
abuyyui.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
2868
abuyyui.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2868
abuyyui.exe
A Network Trojan was detected
SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain
2868
abuyyui.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
7 ETPRO signatures available at the full report
No debug info