File name:

Sample1.zip

Full analysis: https://app.any.run/tasks/ca32f04c-9d6b-4927-9056-2e836b0a7c1b
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Analysis date: July 18, 2019, 14:39:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
cve-2017-11882
evasion
trojan
rat
agenttesla
keylogger
opendir
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

249A3CA445648A31AFD863DBB77268B2

SHA1:

7067ACD776956883CB6EBAE7613131DB001B99BA

SHA256:

B2E23269DCA9A5CF211A2B295E18BDD89ACAAF85776A1689DEE89164E92A5720

SSDEEP:

48:Zv3UIT3O5s9fzkwMrfBNmtsgfxwj6ggHaSCSGN4rWDau1aURvAPF:JBT3K6DmBNSsgejXg6pJaUBAPF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2904)
    • Application was dropped or rewritten from another process

      • rectorfile.exe (PID: 3420)
      • rectorfile.exe (PID: 3524)
      • rector.exe (PID: 3492)
      • rector.exe (PID: 3988)
      • rector.exe (PID: 2928)
      • rector.exe (PID: 2936)
    • AGENTTESLA was detected

      • rectorfile.exe (PID: 3420)
      • rector.exe (PID: 3988)
      • rector.exe (PID: 2928)
    • Actions looks like stealing of personal data

      • rectorfile.exe (PID: 3420)
      • rector.exe (PID: 3988)
      • rector.exe (PID: 2928)
    • Downloads executable files from the Internet

      • opera.exe (PID: 3940)
  • SUSPICIOUS

    • Application launched itself

      • rectorfile.exe (PID: 3524)
      • rector.exe (PID: 3492)
      • rector.exe (PID: 2936)
    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 2904)
      • rectorfile.exe (PID: 3420)
    • Executed via COM

      • EQNEDT32.EXE (PID: 2904)
    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 2904)
      • opera.exe (PID: 3940)
    • Reads the cookies of Google Chrome

      • rectorfile.exe (PID: 3420)
    • Checks for external IP

      • rectorfile.exe (PID: 3420)
      • rector.exe (PID: 3988)
      • rector.exe (PID: 2928)
    • Reads the cookies of Mozilla Firefox

      • rectorfile.exe (PID: 3420)
    • Reads Internet Cache Settings

      • rector.exe (PID: 3988)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 1952)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 1952)
      • opera.exe (PID: 3940)
    • Manual execution by user

      • WINWORD.EXE (PID: 1952)
      • opera.exe (PID: 3940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 788
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2019:07:18 14:39:03
ZipCRC: 0x40283ec3
ZipCompressedSize: 2079
ZipUncompressedSize: 3906
ZipFileName: baacfbe10e93fed1185e616701bab39f036755f2e4bf5f5c54dea62415d6b156.bin
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
10
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe no specs winword.exe no specs eqnedt32.exe rectorfile.exe no specs #AGENTTESLA rectorfile.exe opera.exe rector.exe no specs #AGENTTESLA rector.exe rector.exe no specs #AGENTTESLA rector.exe

Process information

PID
CMD
Path
Indicators
Parent process
1952"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\ayyy.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
2848"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Sample1.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2904"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2928"C:\Users\admin\AppData\Local\Opera\Opera\temporary_downloads\rector.exe" C:\Users\admin\AppData\Local\Opera\Opera\temporary_downloads\rector.exe
rector.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\opera\opera\temporary_downloads\rector.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
2936"C:\Users\admin\AppData\Local\Opera\Opera\temporary_downloads\rector.exe" C:\Users\admin\AppData\Local\Opera\Opera\temporary_downloads\rector.exeopera.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\opera\opera\temporary_downloads\rector.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3420"C:\Users\admin\AppData\Roaming\rectorfile.exe"C:\Users\admin\AppData\Roaming\rectorfile.exe
rectorfile.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\rectorfile.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\psapi.dll
3492"C:\Users\admin\AppData\Local\Opera\Opera\temporary_downloads\rector.exe" C:\Users\admin\AppData\Local\Opera\Opera\temporary_downloads\rector.exeopera.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\opera\opera\temporary_downloads\rector.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3524"C:\Users\admin\AppData\Roaming\rectorfile.exe"C:\Users\admin\AppData\Roaming\rectorfile.exeEQNEDT32.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\rectorfile.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3940"C:\Program Files\Opera\opera.exe" C:\Program Files\Opera\opera.exe
explorer.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Internet Browser
Exit code:
0
Version:
1748
Modules
Images
c:\program files\opera\opera.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
3988"C:\Users\admin\AppData\Local\Opera\Opera\temporary_downloads\rector.exe" C:\Users\admin\AppData\Local\Opera\Opera\temporary_downloads\rector.exe
rector.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\opera\opera\temporary_downloads\rector.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
Total events
2 030
Read events
1 550
Write events
473
Delete events
7

Modification events

(PID) Process:(2848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2848) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Sample1.zip
(PID) Process:(2848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
5
Suspicious files
9
Text files
26
Unknown types
7

Dropped files

PID
Process
Filename
Type
2848WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2848.29998\baacfbe10e93fed1185e616701bab39f036755f2e4bf5f5c54dea62415d6b156.bin
MD5:
SHA256:
1952WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR79D0.tmp.cvr
MD5:
SHA256:
3940opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr17A.tmp
MD5:
SHA256:
3940opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr1AA.tmp
MD5:
SHA256:
3940opera.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4QHWN6TLFPF4YIFL75WU.temp
MD5:
SHA256:
3940opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\opr9485.tmp
MD5:
SHA256:
3940opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\oprA05D.tmp
MD5:
SHA256:
2904EQNEDT32.EXEC:\Users\admin\AppData\Roaming\rectorfile.exeexecutable
MD5:
SHA256:
1952WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\ayyy.doc.LNKlnk
MD5:
SHA256:
1952WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
18
DNS requests
9
Threats
23

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3940
opera.exe
GET
164.160.128.117:80
http://mrjbiz.top/ugpounds/
NG
malicious
3940
opera.exe
GET
200
93.184.220.29:80
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
528 b
whitelisted
3420
rectorfile.exe
GET
200
34.233.102.38:80
http://checkip.amazonaws.com/
US
text
16 b
malicious
3940
opera.exe
GET
200
172.217.16.142:80
http://clients1.google.com/complete/search?q=mrj&client=opera-suggest-omnibox&hl=de
US
text
96 b
whitelisted
3940
opera.exe
GET
200
164.160.128.117:80
http://mrjbiz.top/rector/rector.exe
NG
executable
1.04 Mb
malicious
3940
opera.exe
GET
200
164.160.128.117:80
http://mrjbiz.top/rector/
NG
html
780 b
malicious
3940
opera.exe
GET
200
172.217.16.142:80
http://clients1.google.com/complete/search?q=mrjbiz&client=opera-suggest-omnibox&hl=de
US
text
33 b
whitelisted
3940
opera.exe
GET
200
164.160.128.117:80
http://mrjbiz.top/sunshine/
NG
html
786 b
malicious
3940
opera.exe
GET
200
164.160.128.117:80
http://mrjbiz.top/ugpounds/
NG
html
786 b
malicious
3940
opera.exe
GET
200
164.160.128.117:80
http://mrjbiz.top/peterz/
NG
html
780 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2904
EQNEDT32.EXE
164.160.128.117:80
mrjbiz.top
Garanntor-Hosting-AS
NG
malicious
3420
rectorfile.exe
34.233.102.38:80
checkip.amazonaws.com
Amazon.com, Inc.
US
shared
3940
opera.exe
185.26.182.93:443
certs.opera.com
Opera Software AS
whitelisted
3940
opera.exe
93.184.220.29:80
crl4.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3940
opera.exe
172.217.16.142:80
clients1.google.com
Google Inc.
US
whitelisted
3420
rectorfile.exe
164.160.128.117:587
mrjbiz.top
Garanntor-Hosting-AS
NG
malicious
3940
opera.exe
164.160.128.117:80
mrjbiz.top
Garanntor-Hosting-AS
NG
malicious
3940
opera.exe
185.26.182.93:80
certs.opera.com
Opera Software AS
whitelisted
3988
rector.exe
164.160.128.117:587
mrjbiz.top
Garanntor-Hosting-AS
NG
malicious
3988
rector.exe
52.6.79.229:80
checkip.amazonaws.com
Amazon.com, Inc.
US
shared

DNS requests

Domain
IP
Reputation
mrjbiz.top
  • 164.160.128.117
malicious
checkip.amazonaws.com
  • 34.233.102.38
  • 18.211.215.84
  • 34.197.157.64
  • 52.6.79.229
  • 52.206.161.133
  • 52.202.139.131
malicious
certs.opera.com
  • 185.26.182.93
  • 185.26.182.94
whitelisted
crl4.digicert.com
  • 93.184.220.29
whitelisted
gh-ws-rhl01.garanntor.net
  • 164.160.128.117
malicious
clients1.google.com
  • 172.217.16.142
whitelisted
sitecheck2.opera.com
  • 185.26.182.93
  • 185.26.182.94
  • 185.26.182.111
  • 185.26.182.112
whitelisted

Threats

PID
Process
Class
Message
1044
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2904
EQNEDT32.EXE
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
2904
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
2904
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2904
EQNEDT32.EXE
Misc activity
ET INFO Possible EXE Download From Suspicious TLD
3420
rectorfile.exe
A Network Trojan was detected
MALWARE [PTsecurity] AgentTesla IP Check
3420
rectorfile.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
3940
opera.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
3940
opera.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3940
opera.exe
Misc activity
ET INFO Possible EXE Download From Suspicious TLD
6 ETPRO signatures available at the full report
No debug info