File name: | 4350041907_docx.gz |
Full analysis: | https://app.any.run/tasks/3c7d440f-e429-4972-bc93-06cae29b1d62 |
Verdict: | Malicious activity |
Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
Analysis date: | July 17, 2019, 18:14:04 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/gzip |
File info: | gzip compressed data, was "4350041907_docx.exe", last modified: Tue Jul 16 10:13:55 2019, max speed, from FAT filesystem (MS-DOS, OS/2, NT) |
MD5: | 5B420F71AFE117BD95E62A540DA9F9C7 |
SHA1: | 4408695BD97C99A5D394CAEFC049571877E8428C |
SHA256: | C6E1D906594F8F2F1390F0D134158639731DAA4692169E2952F71259119241B7 |
SSDEEP: | 6144:ntNHRmknL/a4SyTcelOogMzHMjvKRYt6Q8xEyvstFHlrz6BQ1JTwPYabS7MEL:rrvwbAzHiKet6Q8uyktFB+BQ1uPYabSp |
.z/gz/gzip | | | GZipped data (100) |
---|
ArchivedFileName: | 4350041907_docx.exe |
---|---|
OperatingSystem: | FAT filesystem (MS-DOS, OS/2, NT/Win32) |
ExtraFlags: | Fastest Algorithm |
ModifyDate: | 2019:07:16 12:13:55+02:00 |
Flags: | FileName |
Compression: | Deflated |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3528 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\4350041907_docx.gz" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3080 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.27064\4350041907_docx.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.27064\4350041907_docx.exe | — | WinRAR.exe |
User: admin Company: INTERLAPS10 Integrity Level: MEDIUM Description: percomorphous3 Exit code: 0 Version: 1.06.0005 | ||||
3640 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.27097\4350041907_docx.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.27097\4350041907_docx.exe | — | WinRAR.exe |
User: admin Company: INTERLAPS10 Integrity Level: MEDIUM Description: percomorphous3 Exit code: 0 Version: 1.06.0005 | ||||
1000 | C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.27097\4350041907_docx.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.27097\4350041907_docx.exe | — | 4350041907_docx.exe |
User: admin Company: INTERLAPS10 Integrity Level: MEDIUM Description: percomorphous3 Exit code: 4294967295 Version: 1.06.0005 | ||||
1944 | C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.27064\4350041907_docx.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.27064\4350041907_docx.exe | 4350041907_docx.exe | |
User: admin Company: INTERLAPS10 Integrity Level: MEDIUM Description: percomorphous3 Version: 1.06.0005 | ||||
3824 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.28495\4350041907_docx.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.28495\4350041907_docx.exe | — | WinRAR.exe |
User: admin Company: INTERLAPS10 Integrity Level: MEDIUM Description: percomorphous3 Exit code: 0 Version: 1.06.0005 | ||||
1516 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.28514\4350041907_docx.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.28514\4350041907_docx.exe | — | WinRAR.exe |
User: admin Company: INTERLAPS10 Integrity Level: MEDIUM Description: percomorphous3 Exit code: 0 Version: 1.06.0005 | ||||
3240 | C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.28514\4350041907_docx.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.28514\4350041907_docx.exe | — | 4350041907_docx.exe |
User: admin Company: INTERLAPS10 Integrity Level: MEDIUM Description: percomorphous3 Exit code: 4294967295 Version: 1.06.0005 | ||||
3236 | C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.28495\4350041907_docx.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.28495\4350041907_docx.exe | — | 4350041907_docx.exe |
User: admin Company: INTERLAPS10 Integrity Level: MEDIUM Description: percomorphous3 Exit code: 4294967295 Version: 1.06.0005 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3528 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.27064\4350041907_docx.exe | executable | |
MD5:1F619BCFD7AB85CDCB7ECD25721F8B47 | SHA256:C27A0687C2779D27A404A294306B96FFD4022766027240D0E1DF7A94E33637DF | |||
3528 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.27097\4350041907_docx.exe | executable | |
MD5:1F619BCFD7AB85CDCB7ECD25721F8B47 | SHA256:C27A0687C2779D27A404A294306B96FFD4022766027240D0E1DF7A94E33637DF | |||
1944 | 4350041907_docx.exe | C:\Users\admin\AppData\Local\Temp\636989877019910000_36c1bc50-5744-4907-ac7e-c7b873176753.db | sqlite | |
MD5:0B3C43342CE2A99318AA0FE9E531C57B | SHA256:0CCB4915E00390685621DA3D75EBFD5EDADC94155A79C66415A7F4E9763D71B8 | |||
3528 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.28514\4350041907_docx.exe | executable | |
MD5:1F619BCFD7AB85CDCB7ECD25721F8B47 | SHA256:C27A0687C2779D27A404A294306B96FFD4022766027240D0E1DF7A94E33637DF | |||
3528 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.28495\4350041907_docx.exe | executable | |
MD5:1F619BCFD7AB85CDCB7ECD25721F8B47 | SHA256:C27A0687C2779D27A404A294306B96FFD4022766027240D0E1DF7A94E33637DF |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1944 | 4350041907_docx.exe | 46.21.144.100:587 | server1.monovm.com | Swiftway Sp. z o.o. | NL | malicious |
Domain | IP | Reputation |
---|---|---|
server1.monovm.com |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
1944 | 4350041907_docx.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |