analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Delivery Note - AWD 200038485852- 2349203968876.gz

Full analysis: https://app.any.run/tasks/37abda00-2a76-4c0b-9b5d-e9f58cc5c4ae
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Analysis date: October 22, 2019, 06:47:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
agenttesla
evasion
trojan
rat
Indicators:
MIME: application/gzip
File info: gzip compressed data, was "Delivery Note - AWD 200038485852- 2349203968876.exe", last modified: Tue Oct 22 03:44:08 2019, from FAT filesystem (MS-DOS, OS/2, NT)
MD5:

1203CE1D3BBA02C90A0B73937F7BB725

SHA1:

3A4EC86162142EFAE157580BA630FE7D969094E5

SHA256:

90DBE9F00B5703E671C52E6995395989C85A780FC882699176F6E02525323566

SSDEEP:

12288:+qUyx17F5e1uiO0KyrO5+16zj8NO6BXCbh122ohgDC8MJW+iHtrj4559Nco6x+/Q:+qHu1c0b65+16zwNXAXoh7bwt4Yj0VS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Delivery Note - AWD 200038485852- 2349203968876.exe (PID: 3376)
    • AGENTTESLA was detected

      • RegAsm.exe (PID: 2184)
    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 2184)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2168)
    • Checks for external IP

      • RegAsm.exe (PID: 2184)
  • INFO

    • Manual execution by user

      • Delivery Note - AWD 200038485852- 2349203968876.exe (PID: 3376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.z/gz/gzip | GZipped data (100)

EXIF

ZIP

ArchivedFileName: Delivery Note - AWD 200038485852- 2349203968876.exe
OperatingSystem: FAT filesystem (MS-DOS, OS/2, NT/Win32)
ExtraFlags: (none)
ModifyDate: 2019:10:22 05:44:08+02:00
Flags: FileName
Compression: Deflated
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe delivery note - awd 200038485852- 2349203968876.exe no specs #AGENTTESLA regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
2168"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Delivery Note - AWD 200038485852- 2349203968876.gz.z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3376"C:\Users\admin\Desktop\Delivery Note - AWD 200038485852- 2349203968876.exe" C:\Users\admin\Desktop\Delivery Note - AWD 200038485852- 2349203968876.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\delivery note - awd 200038485852- 2349203968876.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
2184"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Delivery Note - AWD 200038485852- 2349203968876.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\regasm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
Total events
498
Read events
476
Write events
22
Delete events
0

Modification events

(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2168) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Delivery Note - AWD 200038485852- 2349203968876.gz.z
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(2184) RegAsm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RegAsm_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
Executable files
1
Suspicious files
0
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
2184RegAsm.exeC:\Users\admin\AppData\Local\Temp\637073273340878750_9afee31a-ca67-4b5a-a3ff-4358a07021a7.dbsqlite
MD5:0B3C43342CE2A99318AA0FE9E531C57B
SHA256:0CCB4915E00390685621DA3D75EBFD5EDADC94155A79C66415A7F4E9763D71B8
2168WinRAR.exeC:\Users\admin\Desktop\Delivery Note - AWD 200038485852- 2349203968876.exeexecutable
MD5:A991005C3EB17F2B0463B1C5285F5C1C
SHA256:2E55B89E4004826564C10B8560E5860F5215390399F7461A53B7548124859C2A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
2
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2184
RegAsm.exe
GET
200
52.55.255.113:80
http://checkip.amazonaws.com/
US
text
15 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2184
RegAsm.exe
23.95.206.190:21
ftp.pehledinekam.com
ColoCrossing
US
malicious
2184
RegAsm.exe
52.55.255.113:80
checkip.amazonaws.com
Amazon.com, Inc.
US
shared
2184
RegAsm.exe
23.95.206.190:59903
ftp.pehledinekam.com
ColoCrossing
US
malicious

DNS requests

Domain
IP
Reputation
checkip.amazonaws.com
  • 52.55.255.113
  • 34.196.181.158
  • 3.224.145.145
  • 18.214.132.216
  • 52.44.169.135
  • 18.205.71.63
shared
ftp.pehledinekam.com
  • 23.95.206.190
malicious

Threats

PID
Process
Class
Message
A Network Trojan was detected
MALWARE [PTsecurity] AgentTesla IP Check
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
A Network Trojan was detected
MALWARE [PTsecurity] AgentTesla Exfiltration
A Network Trojan was detected
MALWARE [PTsecurity] AgentTesla Exfiltration
2 ETPRO signatures available at the full report
No debug info