analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

TRACKSUIT QUOTATION.doc

Full analysis: https://app.any.run/tasks/0cf42c0c-aefe-4316-b31d-1e9512093636
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: May 20, 2019, 19:17:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
CVE-2017-11882
loader
rat
remcos
keylogger
Indicators:
MIME: text/rtf
File info: Rich Text Format data, unknown version
MD5:

DE877AD27004B5FBB27CAB691B3D8024

SHA1:

871A3863761BA7170EF7266D0EF90420F98A5862

SHA256:

CA1B9112AC550CD21ABDCD13E7EDC6BAAD8B6FC7AFC0B35F52868005CF2AA857

SSDEEP:

768:6xD7q8e8s2FbRqs14dwRy4BkBExekPUFJbgw8DDnF:6Z7q8e8J1edwQ4BkBExekPgJMw8DDnF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • X098765432198.scr (PID: 3516)
      • X098765432198.scr (PID: 2676)
    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3916)
    • Downloads executable files from IP

      • EQNEDT32.EXE (PID: 3916)
    • Downloads executable files from the Internet

      • EQNEDT32.EXE (PID: 3916)
    • Writes to a start menu file

      • X098765432198.scr (PID: 3516)
    • REMCOS RAT was detected

      • X098765432198.scr (PID: 2676)
    • Detected logs from REMCOS RAT

      • X098765432198.scr (PID: 2676)
  • SUSPICIOUS

    • Executed via COM

      • EQNEDT32.EXE (PID: 3916)
    • Starts application with an unusual extension

      • EQNEDT32.EXE (PID: 3916)
      • X098765432198.scr (PID: 3516)
    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 3916)
      • X098765432198.scr (PID: 3516)
      • X098765432198.scr (PID: 2676)
    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 3916)
      • X098765432198.scr (PID: 3516)
    • Application launched itself

      • X098765432198.scr (PID: 3516)
    • Writes files like Keylogger logs

      • X098765432198.scr (PID: 2676)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3052)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs eqnedt32.exe x098765432198.scr #REMCOS x098765432198.scr

Process information

PID
CMD
Path
Indicators
Parent process
3052"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\TRACKSUIT QUOTATION.doc.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
3916"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
3516C:\Users\admin\AppData\Local\X098765432198.scrC:\Users\admin\AppData\Local\X098765432198.scr
EQNEDT32.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
7.1.4.4
2676C:\Users\admin\AppData\Local\X098765432198.scrC:\Users\admin\AppData\Local\X098765432198.scr
X098765432198.scr
User:
admin
Integrity Level:
MEDIUM
Version:
7.1.4.4
Total events
557
Read events
496
Write events
50
Delete events
11

Modification events

(PID) Process:(3052) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:ay
Value:
61792000EC0B0000010000000000000000000000
(PID) Process:(3052) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3052) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3052) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1320419358
(PID) Process:(3052) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1320419480
(PID) Process:(3052) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1320419481
(PID) Process:(3052) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
EC0B0000B811EBBF400FD50100000000
(PID) Process:(3052) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:kz
Value:
6B7A2000EC0B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(3052) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:kz
Value:
6B7A2000EC0B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(3052) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
3
Suspicious files
1
Text files
6
Unknown types
4

Dropped files

PID
Process
Filename
Type
3052WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRE9E1.tmp.cvr
MD5:
SHA256:
3052WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E4B4FE9C-25D3-4F81-A06D-B718D28F3438}.tmp
MD5:
SHA256:
3052WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{F26BBDD6-644C-4DB8-AF83-F352B857D5C4}.tmp
MD5:
SHA256:
3052WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{7E24999A-0322-44A9-97FE-11E6AE1DE104}.tmp
MD5:
SHA256:
3052WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{9D1CDF81-6B00-41BD-9038-B2C2AAAD44D3}.tmpbinary
MD5:C0A309D337CAE5CB2D9ADE6A7A045CE4
SHA256:9FA43F6DE36E56738A9BE6B2CC050ABAD2A94071AB3FF713B990102A0F6653A2
3916EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\traaa[1]executable
MD5:4041E5BCCA90BC69BDA33DFF623185C3
SHA256:CB31A8C497878CAFD27DCE028934E9A7E50A43BE621EDD0E0DFF57A21923DF3A
3916EQNEDT32.EXEC:\Users\admin\AppData\Local\X098765432198.screxecutable
MD5:4041E5BCCA90BC69BDA33DFF623185C3
SHA256:CB31A8C497878CAFD27DCE028934E9A7E50A43BE621EDD0E0DFF57A21923DF3A
3052WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:2445A0A77396BDF54E13CF88D259E053
SHA256:3B6A15B0A7BBC2D301BCC38624170DDCAED04BC8E8166D1E5A9BD836C3D09E38
3052WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\TRACKSUIT QUOTATION.doc.rtf.LNKlnk
MD5:E5330CE328A7ACAE6AA891FF25F7D42F
SHA256:857A395AA63DE068C06D54ECF9E0CF31F4CF8FEACD8CBEB82411137F02CDBC49
3916EQNEDT32.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@bit[1].txttext
MD5:DB073107DF169D33826D38C5630D3DEE
SHA256:19407FAF93556E597BC7645011FC2881E1513B5916311000CBAE08399D4BB7FD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
60
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3916
EQNEDT32.EXE
GET
301
67.199.248.10:80
http://bit.ly/2VLRJ8J
US
html
114 b
shared
3916
EQNEDT32.EXE
GET
200
45.67.14.154:80
http://45.67.14.154/5/traaa
unknown
executable
262 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3916
EQNEDT32.EXE
45.67.14.154:80
suspicious
3916
EQNEDT32.EXE
67.199.248.10:80
bit.ly
Bitly Inc
US
shared
2676
X098765432198.scr
185.84.181.80:56477
Radore Veri Merkezi Hizmetleri A.S.
TR
malicious

DNS requests

Domain
IP
Reputation
bit.ly
  • 67.199.248.10
  • 67.199.248.11
shared

Threats

PID
Process
Class
Message
3916
EQNEDT32.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
3916
EQNEDT32.EXE
Misc activity
ET INFO Packed Executable Download
3916
EQNEDT32.EXE
Misc activity
SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7)
3916
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3916
EQNEDT32.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
3916
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
3916
EQNEDT32.EXE
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
Process
Message
X098765432198.scr
User32.dll
X098765432198.scr
User32.dll
X098765432198.scr
User32.dll
X098765432198.scr
User32.dll
X098765432198.scr
User32.dll
X098765432198.scr
User32.dll
X098765432198.scr
User32.dll
X098765432198.scr
User32.dll
X098765432198.scr
User32.dll
X098765432198.scr
User32.dll