File name:	MALEDQ8810.09.24.doc.scr
Full analysis:	https://app.any.run/tasks/05ae493d-0c51-4faf-83ff-92f8f9ce2bce
Verdict:	Malicious activity
Threats:	Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. Agent Tesla ist eine Spyware, die Informationen über die Aktionen ihrer Opfer sammelt, indem sie Tastatureingaben und Benutzerinteraktionen aufzeichnet. Sie wird auf der speziellen Website, auf der diese Malware verkauft wird, fälschlicherweise als legitime Software vermarktet. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	September 10, 2024, 09:07:27
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	evasion stealer agenttesla ftp exfiltration
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	E8A23C4A95E80A26FB38725202496D67
SHA1:	801B5EFA7596DC040AC2610F7A4E597A8D286FDC
SHA256:	99E2FCC17330E0E1D8E31C814D659C4A00110A6DA389102E22A25EEDAE3933B2
SSDEEP:	24576:oJDPLT2fsf2A+UsS522hdFSdUUS4eceQaOMU3X8vEElfbBU7JOsVI4RreWzvYyMD:oJDPLT2fsf2A+UsS522hdFSdUUS4ecer

.exe	\|	Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe	\|	Win64 Executable (generic) (23.8)
.dll	\|	Win32 Dynamic Link Library (generic) (5.6)
.exe	\|	Win32 Executable (generic) (3.8)
.exe	\|	Generic Win/DOS Executable (1.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2024:09:10 03:05:23+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	48
CodeSize:	715776
InitializedDataSize:	10240
UninitializedDataSize:	-
EntryPoint:	0xb0a42
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	5.1.0.0
ProductVersionNumber:	5.1.0.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Unicode
Comments:	-
CompanyName:	Hyper V
FileDescription:	Presentacion V
FileVersion:	5.1.0.0
InternalName:	fPgX.exe
LegalCopyright:	© 2018 Hyper V
LegalTrademarks:	-
OriginalFileName:	fPgX.exe
ProductName:	Presentacion V
ProductVersion:	5.1.0.0
AssemblyVersion:	5.5.0.0


(PID) Process:	(6912) MALEDQ8810.09.24.doc.scr.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MALEDQ8810_RASAPI32
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(6912) MALEDQ8810.09.24.doc.scr.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MALEDQ8810_RASAPI32
Operation:	write	Name:	EnableAutoFileTracing
Value: 0
(PID) Process:	(6912) MALEDQ8810.09.24.doc.scr.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MALEDQ8810_RASAPI32
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(6912) MALEDQ8810.09.24.doc.scr.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MALEDQ8810_RASAPI32
Operation:	write	Name:	FileTracingMask
Value:
(PID) Process:	(6912) MALEDQ8810.09.24.doc.scr.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MALEDQ8810_RASAPI32
Operation:	write	Name:	ConsoleTracingMask
Value:
(PID) Process:	(6912) MALEDQ8810.09.24.doc.scr.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MALEDQ8810_RASAPI32
Operation:	write	Name:	MaxFileSize
Value: 1048576
(PID) Process:	(6912) MALEDQ8810.09.24.doc.scr.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MALEDQ8810_RASAPI32
Operation:	write	Name:	FileDirectory
Value: %windir%\tracing
(PID) Process:	(6912) MALEDQ8810.09.24.doc.scr.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MALEDQ8810_RASMANCS
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(6912) MALEDQ8810.09.24.doc.scr.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MALEDQ8810_RASMANCS
Operation:	write	Name:	EnableAutoFileTracing
Value: 0
(PID) Process:	(6912) MALEDQ8810.09.24.doc.scr.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MALEDQ8810_RASMANCS
Operation:	write	Name:	EnableConsoleTracing
Value: 0

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
6232	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
2120	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
6456	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	GET	200	172.67.74.152:443	https://api.ipify.org/	unknown	text	13 b	—

PID	Process	IP	Domain	ASN	CN	Reputation
2120	MoUsoCoreWorker.exe	51.124.78.146:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
6456	RUXIMICS.exe	51.124.78.146:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
6232	svchost.exe	51.124.78.146:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
6232	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
2120	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
6456	RUXIMICS.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
3888	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
6232	svchost.exe	13.71.55.58:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IN	whitelisted
2120	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

Domain	IP	Reputation
google.com	142.250.181.238	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
settings-win.data.microsoft.com	13.71.55.58 20.73.194.208 20.72.205.209	whitelisted
api.ipify.org	172.67.74.152 104.26.13.205 104.26.12.205	shared
beirutrest.com	50.87.144.157	unknown

PID	Process	Class	Message
2256	svchost.exe	Misc activity	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
6912	MALEDQ8810.09.24.doc.scr.exe	Potential Corporate Privacy Violation	ET POLICY Possible IP Check api.ipify.org
6912	MALEDQ8810.09.24.doc.scr.exe	Misc activity	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
—	—	Device Retrieving External IP Address Detected	ET POLICY External IP Lookup api.ipify.org
—	—	Device Retrieving External IP Address Detected	POLICY [ANY.RUN] External IP Lookup by HTTP (api .ipify .org)
6912	MALEDQ8810.09.24.doc.scr.exe	A Network Trojan was detected	ET MALWARE AgentTesla Exfil via FTP
6912	MALEDQ8810.09.24.doc.scr.exe	Misc activity	INFO [ANY.RUN] FTP protocol command for uploading a file
6912	MALEDQ8810.09.24.doc.scr.exe	A Network Trojan was detected	STEALER [ANY.RUN] AgentTesla Exfiltration (raw TCP)
6912	MALEDQ8810.09.24.doc.scr.exe	A Network Trojan was detected	STEALER [ANY.RUN] AgentTesla Exfiltration (raw TCP)
—	—	Device Retrieving External IP Address Detected	SUSPICIOUS [ANY.RUN] An IP address was received from the server as a result of an HTTP request

General Info

MALEDQ8810.09.24.doc.scr

E8A23C4A95E80A26FB38725202496D67

801B5EFA7596DC040AC2610F7A4E597A8D286FDC

99E2FCC17330E0E1D8E31C814D659C4A00110A6DA389102E22A25EEDAE3933B2

24576:oJDPLT2fsf2A+UsS522hdFSdUUS4eceQaOMU3X8vEElfbBU7JOsVI4RreWzvYyMD:oJDPLT2fsf2A+UsS522hdFSdUUS4ecer

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Actions looks like stealing of personal data

Steals credentials from Web Browsers

AGENTTESLA has been detected (SURICATA)

Stealers network behavior

Connects to the CnC server

AGENTTESLA has been detected (YARA)

SUSPICIOUS

Potential Corporate Privacy Violation

Checks for external IP

Application launched itself

Connects to FTP

Connects to unusual port

INFO

Checks supported languages

Reads the machine GUID from the registry

Disables trace logs

Checks proxy server information

Reads the computer name

Reads the software policy settings

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings