analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | request for quotation.doc |
| Full analysis: | https://app.any.run/tasks/4cd5bf81-21c1-4077-a18d-7abfc5b88e26 |
| Verdict: | Malicious activity |
| Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
| Analysis date: | April 25, 2019, 11:07:17 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/rtf |
| File info: | Rich Text Format data, unknown version |
| MD5: | 893409D70E8324046C0DAC58CD41BD90 |
| SHA1: | E4E16990617B15FFCB41736CA858012E9481FD29 |
| SHA256: | A622F169FB03BF1D979A6BAD1303648B56BD93D1B9421D606A7939AC61BFAE60 |
| SSDEEP: | 96:Crp00Rv/EKMpjvF8xz4Z3gRP9MY43swBe+9:CLyppzZ3gmY48Ce+9 |
MALICIOUS
Equation Editor starts application (CVE-2017-11882)
- EQNEDT32.EXE (PID: 2852)
Application was dropped or rewritten from another process
- lojmnvdfghjk.com (PID: 2868)
- lojmnvdfghjk.com (PID: 3460)
Changes the autorun value in the registry
- lojmnvdfghjk.com (PID: 3460)
Detected AgentTesla Keylogger
- lojmnvdfghjk.com (PID: 3460)
Actions looks like stealing of personal data
- lojmnvdfghjk.com (PID: 3460)
SUSPICIOUS
Creates files in the user directory
- EQNEDT32.EXE (PID: 2852)
Executable content was dropped or overwritten
- EQNEDT32.EXE (PID: 2852)
Starts application with an unusual extension
- EQNEDT32.EXE (PID: 2852)
- lojmnvdfghjk.com (PID: 2868)
Application launched itself
- lojmnvdfghjk.com (PID: 2868)
Reads internet explorer settings
- CLVIEW.EXE (PID: 3564)
Starts Microsoft Office Application
- WINWORD.EXE (PID: 2828)
Reads Internet Cache Settings
- CLVIEW.EXE (PID: 3564)
INFO
Creates files in the user directory
- WINWORD.EXE (PID: 2828)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 2828)
- CLVIEW.EXE (PID: 3564)
Application was crashed
- WINWORD.EXE (PID: 2828)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rtf | | | Rich Text Format (100) |
|---|
Total processes
40
Monitored processes
6
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2828 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\request for quotation.doc.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
| 2852 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
| 2868 | "C:\Users\admin\AppData\Local\Temp\lojmnvdfghjk.com" | C:\Users\admin\AppData\Local\Temp\lojmnvdfghjk.com | — | EQNEDT32.EXE |
User: admin Company: noyading Integrity Level: MEDIUM Description: mermithogyne4 Exit code: 0 Version: 1.03.0008 | ||||
| 2712 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | — | svchost.exe |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Version: 00110900 | ||||
| 3460 | C:\Users\admin\AppData\Local\Temp\lojmnvdfghjk.com" | C:\Users\admin\AppData\Local\Temp\lojmnvdfghjk.com | lojmnvdfghjk.com | |
User: admin Company: noyading Integrity Level: MEDIUM Description: mermithogyne4 Version: 1.03.0008 | ||||
| 3564 | "C:\Program Files\Microsoft Office\Office14\CLVIEW.EXE" "WINWORD" "Microsoft Word" | C:\Program Files\Microsoft Office\Office14\CLVIEW.EXE | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Office Help Viewer Version: 14.0.6015.1000 | ||||
Total events
1 130
Read events
1 036
Write events
0
Delete events
0
Modification events
Executable files
2
Suspicious files
4
Text files
74
Unknown types
4
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2828 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRFDA2.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3564 | CLVIEW.EXE | C:\Users\admin\AppData\Local\Temp\IMTDAC4.tmp | — | |
MD5:— | SHA256:— | |||
| 3564 | CLVIEW.EXE | C:\Users\admin\AppData\Local\Temp\IMTDAD5.tmp | — | |
MD5:— | SHA256:— | |||
| 3564 | CLVIEW.EXE | C:\Users\admin\AppData\Local\Temp\IMTDAD6.tmp | — | |
MD5:— | SHA256:— | |||
| 3564 | CLVIEW.EXE | C:\Users\admin\AppData\Local\Temp\IMTDAE6.tmp | — | |
MD5:— | SHA256:— | |||
| 3564 | CLVIEW.EXE | C:\Users\admin\AppData\Local\Temp\IMTDAE7.tmp | — | |
MD5:— | SHA256:— | |||
| 3564 | CLVIEW.EXE | C:\Users\admin\AppData\Local\Temp\IMTDAF8.tmp | — | |
MD5:— | SHA256:— | |||
| 3564 | CLVIEW.EXE | C:\Users\admin\AppData\Local\Temp\IMTDAF9.tmp | — | |
MD5:— | SHA256:— | |||
| 3564 | CLVIEW.EXE | C:\Users\admin\AppData\Local\Temp\IMTDB0A.tmp | — | |
MD5:— | SHA256:— | |||
| 3564 | CLVIEW.EXE | C:\Users\admin\AppData\Local\Temp\IMTDB2B.tmp | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
2
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3460 | lojmnvdfghjk.com | 198.54.122.60:587 | mail.privateemail.com | Namecheap, Inc. | US | suspicious |
2852 | EQNEDT32.EXE | 112.213.89.40:443 | tfvn.com.vn | SUPERDATA | VN | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
tfvn.com.vn |
| unknown |
mail.privateemail.com |
| shared |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3460 | lojmnvdfghjk.com | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
1 ETPRO signatures available at the full report