analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

Doc_YUL_600796821_O200000035_SCAN_DOCS.img

Full analysis: https://app.any.run/tasks/363b9a6c-9fd1-4764-984b-cb276db0eaa1
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: August 08, 2020, 13:01:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
agenttesla
trojan
Indicators:
MIME: application/x-iso9660-image
File info: UDF filesystem data (version 1.5) 'DESKTOP'
MD5:

47466161DA174888A942B85E450D8251

SHA1:

1731F1F1B83A9D3CCBE03AB417DC082187E89385

SHA256:

BC8E5AB792B2768A08E9A0E605607AA2977EC614A7DD5891BD19A39A517CC984

SSDEEP:

6144:lkZWGYlDhZ//qtSMylCzLcYhRSSg478r61PPT2yEooUB1LR/XKITn5k:lkKjZASMyShG478o2yEor6I

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Doc_YUL_600796821_O200000035_SCAN_DOCS.exe (PID: 3116)
      • AddInProcess32.exe (PID: 2888)

    • AGENTTESLA was detected

      • AddInProcess32.exe (PID: 2888)

    • Actions looks like stealing of personal data

      • AddInProcess32.exe (PID: 2888)

  • SUSPICIOUS

    • Reads Environment values

      • AddInProcess32.exe (PID: 2888)

    • Reads the cookies of Google Chrome

      • AddInProcess32.exe (PID: 2888)

    • Reads the cookies of Mozilla Firefox

      • AddInProcess32.exe (PID: 2888)

    • Executable content was dropped or overwritten

      • Doc_YUL_600796821_O200000035_SCAN_DOCS.exe (PID: 3116)

    • Creates files in the user directory

      • AddInProcess32.exe (PID: 2888)

  • INFO

    • Manual execution by user

      • rundll32.exe (PID: 3624)
      • Rar.exe (PID: 2380)
      • WinRAR.exe (PID: 2116)
      • Doc_YUL_600796821_O200000035_SCAN_DOCS.exe (PID: 3116)
      • rundll32.exe (PID: 2412)

    • Modifies the open verb of a shell class

      • rundll32.exe (PID: 2412)
      • rundll32.exe (PID: 3624)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.iso | ISO 9660 CD image (27.6)
.atn | Photoshop Action (27.1)
.gmc | Game Music Creator Music (6.1)

EXIF

Composite

VolumeSize: 1198 kB

ISO

VolumeModifyDate: 2020:08:05 15:20:12.00-07:00
VolumeCreateDate: 2020:08:05 15:20:12.00-07:00
Software: IMGBURN V2.5.8.0 - THE ULTIMATE IMAGE BURNER!
VolumeSetName: UNDEFINED
RootDirectoryCreateDate: 2020:08:05 15:20:12-07:00
VolumeBlockSize: 2048
VolumeBlockCount: 599
VolumeName: DESKTOP
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start rundll32.exe no specs isoburn.exe no specs rundll32.exe no specs rar.exe no specs rar.exe no specs rundll32.exe no specs winrar.exe no specs winrar.exe no specs doc_yul_600796821_o200000035_scan_docs.exe #AGENTTESLA addinprocess32.exe

Process information

PID
CMD
Path
Indicators
Parent process
2280"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Doc_YUL_600796821_O200000035_SCAN_DOCS.imgC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1448"C:\Windows\System32\isoburn.exe" "C:\Users\admin\AppData\Local\Temp\Doc_YUL_600796821_O200000035_SCAN_DOCS.img"C:\Windows\System32\isoburn.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Disc Image Burning Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3624"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Doc_YUL_600796821_O200000035_SCAN_DOCS.imgC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2300"C:\Program Files\WinRAR\Rar.exe" "C:\Users\admin\AppData\Local\Temp\Doc_YUL_600796821_O200000035_SCAN_DOCS.img"C:\Program Files\WinRAR\Rar.exe—rundll32.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
Command line RAR
Exit code:
7
Version:
5.60.0
2380"C:\Program Files\WinRAR\Rar.exe" "C:\Users\admin\AppData\Local\Temp\Doc_YUL_600796821_O200000035_SCAN_DOCS.img"C:\Program Files\WinRAR\Rar.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
Command line RAR
Exit code:
7
Version:
5.60.0
2412"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Doc_YUL_600796821_O200000035_SCAN_DOCS.imgC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3124"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Doc_YUL_600796821_O200000035_SCAN_DOCS.img"C:\Program Files\WinRAR\WinRAR.exe—rundll32.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2116"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Doc_YUL_600796821_O200000035_SCAN_DOCS.img"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3116"C:\Users\admin\Desktop\Doc_YUL_600796821_O200000035_SCAN_DOCS.exe" C:\Users\admin\Desktop\Doc_YUL_600796821_O200000035_SCAN_DOCS.exe
explorer.exe
User:
admin
Company:
5b!Rt(N9*Q4cf8~A6
Integrity Level:
MEDIUM
Description:
Le8+@Fp5X2_s3!x
Exit code:
0
Version:
5.7.10.12
2888"C:\Users\admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\admin\AppData\Local\Temp\AddInProcess32.exe
Doc_YUL_600796821_O200000035_SCAN_DOCS.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AddInProcess.exe
Version:
4.7.3062.0 built by: NET472REL1
Total events
3 772
Read events
3 240
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
1
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
3124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3124.12409\Doc_YUL_600796821_O200000035_SCAN_DOCS.exe —
MD5:—
SHA256:—
3624rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.dbbinary
MD5:881DDAB2AA136BB9902552DFF7AC087A
SHA256:C9BEC2506D30312B2DC72F04C92ED04C3753D197746CCFD6BFD93223E407DFD9
2888AddInProcess32.exeC:\Users\admin\AppData\Roaming\vnpe5b0e.p1n\Firefox\Profiles\qldyz51w.default\cookies.sqlitesqlite
MD5:7C426E0FC19063A433349CE713DA84A0
SHA256:9925B2D80F8A85132EF4927979B25E0B9525E8317A71FFD844980B794B04234C
2888AddInProcess32.exeC:\Users\admin\AppData\Roaming\vnpe5b0e.p1n\Chrome\Default\Cookiessqlite
MD5:D93B1B100AD95D3B99082E51AB2743B5
SHA256:7BEECC65CF8C96E2D90F9D9E222AD9227057B26BD2AD0C81E417DD60C0B707C6
3116Doc_YUL_600796821_O200000035_SCAN_DOCS.exeC:\Users\admin\AppData\Local\Temp\AddInProcess32.exeexecutable
MD5:6A673BFC3B67AE9782CB31AF2F234C68
SHA256:978A4093058AA2EBF05DC353897D90D950324389879B57741B64160825B5EC0E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2888
AddInProcess32.exe
208.91.198.143:587
smtp.faithhopaendimages.com
PDR
US
shared

DNS requests

Domain
IP
Reputation
smtp.faithhopaendimages.com
  • 208.91.198.143
  • 208.91.199.223
  • 208.91.199.224
  • 208.91.199.225
malicious

Threats

PID
Process
Class
Message
2888
AddInProcess32.exe
A Network Trojan was detected
SPYWARE [PTsecurity] AgentTesla Exfiltration
2888
AddInProcess32.exe
A Network Trojan was detected
SPYWARE [PTsecurity] AgentTesla Exfiltration
2888
AddInProcess32.exe
A Network Trojan was detected
ET TROJAN AgentTesla Exfil Via SMTP
2888
AddInProcess32.exe
A Network Trojan was detected
AV TROJAN Win.Keylogger.AgentTesla SMTP Activity
2888
AddInProcess32.exe
A Network Trojan was detected
SPYWARE [PTsecurity] AgentTesla Exfiltration
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Doc_YUL_600796821_O200000035_SCAN_DOCS.img