analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

tulickfav.exe

Full analysis: https://app.any.run/tasks/20475f91-c44f-488f-956e-2633e5125108
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Analysis date: April 25, 2019, 08:13:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
stealer
agenttesla
evasion
rat
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

AB2ECE7F84F660CD385FE86A1038105A

SHA1:

268DAFA656517EC5E2190FBE67154F597F0D761D

SHA256:

A93C54319FD83C578CCB2F3F5F75D3F5120F459CF9C93CA8151AD0C2E7CDFF8A

SSDEEP:

12288:kzF293tGu01JuSKBaeJqpplb1TclfBjkA4wtb+cYERTgOgl:kzw9WJXZjbYfBC80Og

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes the autorun value in the registry

      • tulickfav.exe (PID: 3900)
    • Detected AgentTesla Keylogger

      • tulickfav.exe (PID: 3900)
    • Actions looks like stealing of personal data

      • tulickfav.exe (PID: 3900)
  • SUSPICIOUS

    • Reads Windows Product ID

      • tulickfav.exe (PID: 3900)
    • Reads Environment values

      • tulickfav.exe (PID: 3900)
    • Checks for external IP

      • tulickfav.exe (PID: 3900)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (68.6)
.exe | Win32 Executable (generic) (11.2)
.exe | Win16/32 Executable Delphi generic (5.1)
.exe | Clipper DOS Executable (5)
.exe | Generic Win/DOS Executable (4.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:04:24 00:37:12+02:00
PEType: PE32
LinkerVersion: 14
CodeSize: 216064
InitializedDataSize: 502272
UninitializedDataSize: -
EntryPoint: 0x11686
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 8.5.2.8
ProductVersionNumber: 8.5.2.8
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
OriginalFileName: Humble.exe
LegalTrademarks: (C)PassMark (TM) Software - www.passmark.com 2007-2015
PrivateBuild: 8.5.2.8
FileVersion: 8.5.2.8
CompanyName: PassMark (TM) Software - www.passmark.com
Comments: Delacrte Bertrand Digitizer Stopwith Seahorse Underscores
FileDescription: Delacrte Bertrand Digitizer Stopwith Seahorse Underscores
LegalCopyright: (C)PassMark (TM) Software - www.passmark.com 2007-2015
Languages: English
InternalName: Humble
ProductName: Humble
ProductVersion: 8.5.2.8

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 23-Apr-2019 22:37:12
Detected languages:
  • English - United States
OriginalFilename: Humble.exe
LegalTrademarks: (C)PassMark (TM) Software - www.passmark.com 2007-2015
PrivateBuild: 8.5.2.8
FileVersion: 8.5.2.8
CompanyName: PassMark (TM) Software - www.passmark.com
Comments: Delacrte Bertrand Digitizer Stopwith Seahorse Underscores
FileDescription: Delacrte Bertrand Digitizer Stopwith Seahorse Underscores
LegalCopyright: (C)PassMark (TM) Software - www.passmark.com 2007-2015
Languages: English
InternalName: Humble
ProductName: Humble
ProductVersion: 8.5.2.8

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 8
Time date stamp: 23-Apr-2019 22:37:12
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00088000
0x0000F9B2
0x0000FA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.99415
.rdata
0x00036000
0x0001345C
0x00013600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.6392
.data
0x0004A000
0x0003DD80
0x0003C200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.97522
.gfids
0x00098000
0x00000230
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.79903
.tls
0x00099000
0x00000009
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.0203931
.rsrc
0x0009A000
0x0001837C
0x00018400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.98394
.reloc
0x000B3000
0x00002D4C
0x00002E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.62614

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.29118
1123
Latin 1 / Western European
English - United States
RT_MANIFEST
2
4.05583
1128
Latin 1 / Western European
English - United States
RT_ICON
3
3.13302
9640
Latin 1 / Western European
English - United States
RT_ICON
4
3.56872
4264
Latin 1 / Western European
English - United States
RT_ICON
5
1.85241
10344
Latin 1 / Western European
English - United States
RT_ICON
6
3.1811
16936
Latin 1 / Western European
English - United States
RT_ICON
101
2.80883
90
Latin 1 / Western European
English - United States
RT_GROUP_ICON
249
3.36989
1570
Latin 1 / Western European
English - United States
RT_DIALOG
467
7.64591
804
Latin 1 / Western European
English - United States
UNKNOWN
1017
3.25053
358
Latin 1 / Western European
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
AVIFIL32.dll
COMDLG32.dll
KERNEL32.dll
NETAPI32.dll
ODBC32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
UxTheme.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
32
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #AGENTTESLA tulickfav.exe

Process information

PID
CMD
Path
Indicators
Parent process
3900"C:\Users\admin\AppData\Local\Temp\tulickfav.exe" C:\Users\admin\AppData\Local\Temp\tulickfav.exe
explorer.exe
User:
admin
Company:
PassMark (TM) Software - www.passmark.com
Integrity Level:
MEDIUM
Description:
Delacrte Bertrand Digitizer Stopwith Seahorse Underscores
Version:
8.5.2.8
Total events
75
Read events
62
Write events
13
Delete events
0

Modification events

(PID) Process:(3900) tulickfav.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyApp
Value:
C:\Users\admin\AppData\Roaming\MyApp\MyApp.exe
(PID) Process:(3900) tulickfav.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tulickfav_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3900) tulickfav.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tulickfav_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3900) tulickfav.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tulickfav_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3900) tulickfav.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tulickfav_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3900) tulickfav.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tulickfav_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3900) tulickfav.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tulickfav_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3900) tulickfav.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tulickfav_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3900) tulickfav.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tulickfav_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3900) tulickfav.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tulickfav_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3900
tulickfav.exe
GET
200
52.202.139.131:80
http://checkip.amazonaws.com/
US
text
15 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3900
tulickfav.exe
52.202.139.131:80
checkip.amazonaws.com
Amazon.com, Inc.
US
shared
3900
tulickfav.exe
103.21.59.198:587
mail.indicaindustries.com
PDR
IN
malicious

DNS requests

Domain
IP
Reputation
mail.indicaindustries.com
  • 103.21.59.198
malicious
checkip.amazonaws.com
  • 52.202.139.131
  • 34.233.102.38
  • 52.200.125.74
  • 18.211.215.84
  • 52.6.79.229
  • 52.206.161.133
shared

Threats

PID
Process
Class
Message
3900
tulickfav.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
3900
tulickfav.exe
A Network Trojan was detected
MALWARE [PTsecurity] AgentTesla IP Check
2 ETPRO signatures available at the full report
No debug info