analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ORDER_IMAGES_20108.doc

Full analysis: https://app.any.run/tasks/f3f8f236-2b64-47c5-8d5f-a202bca27449
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: December 03, 2019, 01:55:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
CVE-2017-11882
loader
stealer
agenttesla
Indicators:
MIME: text/rtf
File info: Rich Text Format data, unknown version
MD5:

44281B04DCF54D55A03B06122C84B213

SHA1:

3C9F42FA50771FA809EF71500000C3EEC449CAA4

SHA256:

AB418C1C6A61C01716F83FF7A2B042442DC12F04721E2787ABE7AF198EEE2803

SSDEEP:

12288:oiEUeRxtMFuzqgU1lR89w9Ki3fLMjrLZ9yt6hzIkJ1Be04mFRep77V6Z2xtyR:oFUAMF63qD8yU0fLMu8JIkJ+iF4V6Uf6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • endyoj4729.com (PID: 2812)
      • endyiop.exe (PID: 3636)
      • endyiop.exe (PID: 1596)

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 2988)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2988)

    • Changes the autorun value in the registry

      • endyiop.exe (PID: 1596)

    • Downloads executable files from the Internet

      • EQNEDT32.EXE (PID: 2988)

    • AGENTTESLA detected

      • endyiop.exe (PID: 1596)

    • Actions looks like stealing of personal data

      • endyiop.exe (PID: 1596)

  • SUSPICIOUS

    • Starts itself from another location

      • endyoj4729.com (PID: 2812)

    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 2988)
      • endyoj4729.com (PID: 2812)
      • endyiop.exe (PID: 1596)

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 2988)
      • endyiop.exe (PID: 1596)
      • endyoj4729.com (PID: 2812)

    • Executed via COM

      • EQNEDT32.EXE (PID: 2988)

    • Starts application with an unusual extension

      • EQNEDT32.EXE (PID: 2988)

    • Application launched itself

      • endyiop.exe (PID: 3636)

    • Connects to SMTP port

      • endyiop.exe (PID: 1596)

    • Reads the cookies of Google Chrome

      • endyiop.exe (PID: 1596)

    • Reads the cookies of Mozilla Firefox

      • endyiop.exe (PID: 1596)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 640)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
5
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs eqnedt32.exe endyoj4729.com endyiop.exe no specs #AGENTTESLA endyiop.exe

Process information

PID
CMD
Path
Indicators
Parent process
640"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\ORDER_IMAGES_20108.doc.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2988"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2812"C:\Users\admin\AppData\Roaming\endyoj4729.com"C:\Users\admin\AppData\Roaming\endyoj4729.com
EQNEDT32.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3636"C:\Users\admin\AppData\Roaming\endyuis\endyiop.exe"C:\Users\admin\AppData\Roaming\endyuis\endyiop.exe—endyoj4729.com
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1596"C:\Users\admin\AppData\Roaming\endyuis\endyiop.exe"C:\Users\admin\AppData\Roaming\endyuis\endyiop.exe
endyiop.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 638
Read events
944
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
1
Text files
0
Unknown types
5

Dropped files

PID
Process
Filename
Type
640WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRA94A.tmp.cvr —
MD5:—
SHA256:—
2812endyoj4729.comC:\Users\admin\AppData\Roaming\endyuis\endyiop.exe:ZoneIdentifier —
MD5:—
SHA256:—
1596endyiop.exeC:\Users\admin\AppData\Roaming\ckd2xaiy.jtf\Firefox\Profiles\qldyz51w.default\cookies.sqlitesqlite
MD5:7C426E0FC19063A433349CE713DA84A0
SHA256:9925B2D80F8A85132EF4927979B25E0B9525E8317A71FFD844980B794B04234C
640WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:45822EE62FC571A3151895E367644231
SHA256:EB3C643FA978D554A4FC475FB2EC2D439467CBEED53546B5218462C2B3EC2CB5
2988EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\endyz[1].exeexecutable
MD5:8A2271057733C2CE2D577FC3963F62DE
SHA256:15BAEE0A13E03BA70452AEC42E3001A8395256F5233B6B18E372A8ACD4D03F7D
1596endyiop.exeC:\Users\admin\AppData\Roaming\ckd2xaiy.jtf\Chrome\Default\Cookiessqlite
MD5:DD9640AF5F03807CF2E3921CBA16AF0D
SHA256:ECF72C454FEF08C5948A565464839A554567E499F995483D6C8B54B32EA2C5F0
2988EQNEDT32.EXEC:\Users\admin\AppData\Roaming\endyoj4729.comexecutable
MD5:8A2271057733C2CE2D577FC3963F62DE
SHA256:15BAEE0A13E03BA70452AEC42E3001A8395256F5233B6B18E372A8ACD4D03F7D
1596endyiop.exeC:\Users\admin\AppData\Local\Temp\567e3dc4-f0e5-4f19-981b-ac091f262424sqlite
MD5:0B3C43342CE2A99318AA0FE9E531C57B
SHA256:0CCB4915E00390685621DA3D75EBFD5EDADC94155A79C66415A7F4E9763D71B8
1596endyiop.exeC:\Users\admin\AppData\Local\Temp\endy\endy.exeexecutable
MD5:8A2271057733C2CE2D577FC3963F62DE
SHA256:15BAEE0A13E03BA70452AEC42E3001A8395256F5233B6B18E372A8ACD4D03F7D
640WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$DER_IMAGES_20108.doc.rtfpgc
MD5:74946385809409FD4CBB9305E8B946B2
SHA256:73AF0F7EB354FEC0D60518963EA5CB6DD53E081BC72CA07399B0E1A019E2FACD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2988
EQNEDT32.EXE
GET
200
162.144.128.116:80
http://dubem.top/endyz/endyz.exe
US
executable
1.22 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1596
endyiop.exe
199.79.63.218:587
us3.smtp.mailhostbox.com
PDR
US
malicious
2988
EQNEDT32.EXE
162.144.128.116:80
dubem.top
Unified Layer
US
malicious

DNS requests

Domain
IP
Reputation
dubem.top
  • 162.144.128.116
unknown
us3.smtp.mailhostbox.com
  • 199.79.63.218
  • 199.79.63.211
malicious

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2988
EQNEDT32.EXE
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
2988
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
2988
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2988
EQNEDT32.EXE
Misc activity
ET INFO Possible EXE Download From Suspicious TLD
1596
endyiop.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ORDER_IMAGES_20108.doc