File name: | dhl_doc897654657687.zip |
Full analysis: | https://app.any.run/tasks/de0c2035-de5b-4017-b322-b5697c34f725 |
Verdict: | Malicious activity |
Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
Analysis date: | December 06, 2019, 13:42:19 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 256A44C226AAF9A90C3DCCF0FBE992F9 |
SHA1: | F97F855E5D2D739D2C82FEA95BEB30246EF6FCBD |
SHA256: | 9E5E957C144299E1316833A02E4176DEAEEABCCEC7D05C4C884A3F3C8629D33D |
SSDEEP: | 12288:MJO72HKicPNmZH5DCAqhRyENFBf0s8oX0x1Z1uB/c32SZl7YoO9nOk1JEZdHNpPD:MJOwKXPUwAcNFesbKz32M7Yo9GEnNjB |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | dhl_doc897654657687.exe |
---|---|
ZipUncompressedSize: | 1539584 |
ZipCompressedSize: | 846003 |
ZipCRC: | 0xbe74871c |
ZipModifyDate: | 2019:12:03 09:06:00 |
ZipCompression: | Deflated |
ZipBitFlag: | - |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2240 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\dhl_doc897654657687.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3900 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2240.26563\dhl_doc897654657687.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2240.26563\dhl_doc897654657687.exe | WinRAR.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2060 | "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1 | C:\Windows\system32\rundll32.exe | — | dhl_doc897654657687.exe |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
4056 | "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | dhl_doc897654657687.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 4294967295 Version: 2.0.50727.5420 (Win7SP1.050727-5400) | ||||
1908 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2240.28576\dhl_doc897654657687.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2240.28576\dhl_doc897654657687.exe | WinRAR.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1520 | "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1 | C:\Windows\system32\rundll32.exe | — | dhl_doc897654657687.exe |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2184 | "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | dhl_doc897654657687.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Version: 2.0.50727.5420 (Win7SP1.050727-5400) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2060 | rundll32.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:5CD84BF9959DC1F341B5A377F41458B0 | SHA256:7221F7003191345554757E563CBDC7CAE69373F880AFDE8E3D9128D69BAE809D | |||
2240 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2240.28576\dhl_doc897654657687.exe | executable | |
MD5:110B1F529C200B59C6BC8C73FB9882BD | SHA256:6D2D78F7F16452B751D4A88DCC855275B8838FBA6ECAA282557462EF5D9C10B3 | |||
2060 | rundll32.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1UBFIJ8P\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 | |||
2184 | RegAsm.exe | C:\Users\admin\AppData\Roaming\NewApp\NewApp.exe | executable | |
MD5:278EDBD499374BF73621F8C1F969D894 | SHA256:C6999B9F79932C3B4F1C461A69D9DC8DC301D6A155ABC33EFE1B6E9E4A038391 | |||
4056 | RegAsm.exe | C:\Users\admin\AppData\Local\Temp\1248c86a-67ca-40b0-bc90-842e9c5f5969 | sqlite | |
MD5:0B3C43342CE2A99318AA0FE9E531C57B | SHA256:0CCB4915E00390685621DA3D75EBFD5EDADC94155A79C66415A7F4E9763D71B8 | |||
2240 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2240.26563\dhl_doc897654657687.exe | executable | |
MD5:110B1F529C200B59C6BC8C73FB9882BD | SHA256:6D2D78F7F16452B751D4A88DCC855275B8838FBA6ECAA282557462EF5D9C10B3 | |||
2060 | rundll32.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O5EG7CV1\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 | |||
4056 | RegAsm.exe | C:\Users\admin\AppData\Roaming\NewApp\NewApp.exe | executable | |
MD5:278EDBD499374BF73621F8C1F969D894 | SHA256:C6999B9F79932C3B4F1C461A69D9DC8DC301D6A155ABC33EFE1B6E9E4A038391 | |||
2184 | RegAsm.exe | C:\Users\admin\AppData\Local\Temp\f84b3c21-f03a-4727-8dad-2153fb60be17 | sqlite | |
MD5:0B3C43342CE2A99318AA0FE9E531C57B | SHA256:0CCB4915E00390685621DA3D75EBFD5EDADC94155A79C66415A7F4E9763D71B8 | |||
2060 | rundll32.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\K2NLTDG8\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2184 | RegAsm.exe | 130.185.87.19:587 | mail.artecimel.pt | Almouroltec Servicos De Informatica E Internet Lda | PT | unknown |
4056 | RegAsm.exe | 130.185.87.19:587 | mail.artecimel.pt | Almouroltec Servicos De Informatica E Internet Lda | PT | unknown |
Domain | IP | Reputation |
---|---|---|
www.timeapi.org |
| unknown |
mail.artecimel.pt |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
4056 | RegAsm.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
2184 | RegAsm.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |