File name:

d9364e2fb7ce18950dd9ca2e1de5a66a23cafa3d8c37d309d98ef4419bd700d8

Full analysis: https://app.any.run/tasks/d512063e-9076-41ed-b3e2-a039c643d42c
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: December 08, 2024, 22:50:24
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
evasion
stealer
agenttesla
ftp
exfiltration
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

B5387756A13C498BFD5D263E2F18FF25

SHA1:

6B77966AF7A38E3E617FA15EA5AFD0A09D8BA2FE

SHA256:

D9364E2FB7CE18950DD9CA2E1DE5A66A23CAFA3D8C37D309D98EF4419BD700D8

SSDEEP:

12288:cJlSoEFckTHWluwu87+3a5P+6BMPxbpxOzL0XVU:cJlSoEFckTHWlubQ+3ag6BMP1iLCU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6460)

    • Steals credentials from Web Browsers

      • Statement Of Account USD 26,162.21.exe (PID: 6728)

    • Changes the autorun value in the registry

      • Statement Of Account USD 26,162.21.exe (PID: 6728)

    • Actions looks like stealing of personal data

      • Statement Of Account USD 26,162.21.exe (PID: 6728)

    • Connects to the CnC server

      • Statement Of Account USD 26,162.21.exe (PID: 6728)

    • AGENTTESLA has been detected (SURICATA)

      • Statement Of Account USD 26,162.21.exe (PID: 6728)

    • Stealers network behavior

      • Statement Of Account USD 26,162.21.exe (PID: 6728)

    • Antivirus name has been found in the command line (generic signature)

      • MpCmdRun.exe (PID: 7156)
      • MpCmdRun.exe (PID: 6268)

    • AGENTTESLA has been detected (YARA)

      • Statement Of Account USD 26,162.21.exe (PID: 6728)

  • SUSPICIOUS

    • Application launched itself

      • Statement Of Account USD 26,162.21.exe (PID: 6628)

    • Potential Corporate Privacy Violation

      • Statement Of Account USD 26,162.21.exe (PID: 6728)

    • Executable content was dropped or overwritten

      • Statement Of Account USD 26,162.21.exe (PID: 6728)

    • Checks for external IP

      • Statement Of Account USD 26,162.21.exe (PID: 6728)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 6460)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6460)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 6460)

    • Connects to FTP

      • Statement Of Account USD 26,162.21.exe (PID: 6728)

    • Connects to unusual port

      • Statement Of Account USD 26,162.21.exe (PID: 6728)

  • INFO

    • Manual execution by a user

      • Statement Of Account USD 26,162.21.exe (PID: 6628)

    • Reads the computer name

      • Statement Of Account USD 26,162.21.exe (PID: 6628)
      • Statement Of Account USD 26,162.21.exe (PID: 6728)
      • MpCmdRun.exe (PID: 7156)
      • MpCmdRun.exe (PID: 6268)

    • Checks supported languages

      • Statement Of Account USD 26,162.21.exe (PID: 6628)
      • Statement Of Account USD 26,162.21.exe (PID: 6728)
      • MpCmdRun.exe (PID: 7156)
      • MpCmdRun.exe (PID: 6268)

    • Reads the machine GUID from the registry

      • Statement Of Account USD 26,162.21.exe (PID: 6628)
      • Statement Of Account USD 26,162.21.exe (PID: 6728)

    • Reads the software policy settings

      • Statement Of Account USD 26,162.21.exe (PID: 6728)

    • Disables trace logs

      • Statement Of Account USD 26,162.21.exe (PID: 6728)

    • Creates files or folders in the user directory

      • Statement Of Account USD 26,162.21.exe (PID: 6728)

    • Checks proxy server information

      • Statement Of Account USD 26,162.21.exe (PID: 6728)

    • The process uses the downloaded file

      • Statement Of Account USD 26,162.21.exe (PID: 6728)
      • WinRAR.exe (PID: 6460)

    • Create files in a temporary directory

      • MpCmdRun.exe (PID: 7156)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6460)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:12:08 09:23:42
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Statement Of Account USD 26,162.21/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
126
Monitored processes
9
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe statement of account usd 26,162.21.exe no specs #AGENTTESLA statement of account usd 26,162.21.exe cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2396\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5792C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR6460.8432\Rar$Scan42584.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
6268"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR6460.8432"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
6460"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\d9364e2fb7ce18950dd9ca2e1de5a66a23cafa3d8c37d309d98ef4419bd700d8.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6628"C:\Users\admin\Desktop\Statement Of Account USD 26,162.21.exe" C:\Users\admin\Desktop\Statement Of Account USD 26,162.21.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Fanto
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\statement of account usd 26,162.21.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6728"C:\Users\admin\Desktop\Statement Of Account USD 26,162.21.exe"C:\Users\admin\Desktop\Statement Of Account USD 26,162.21.exe
Statement Of Account USD 26,162.21.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Fanto
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\statement of account usd 26,162.21.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7092C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR6460.5018\Rar$Scan8602.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
7100\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7156"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR6460.5018"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
Total events
5 615
Read events
5 589
Write events
26
Delete events
0

Modification events

(PID) Process:(6460) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6460) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6460) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6460) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\d9364e2fb7ce18950dd9ca2e1de5a66a23cafa3d8c37d309d98ef4419bd700d8.zip
(PID) Process:(6460) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6460) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6460) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6460) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6728) Statement Of Account USD 26,162.21.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Statement Of Account USD 26,162_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6728) Statement Of Account USD 26,162.21.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Statement Of Account USD 26,162_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
3
Suspicious files
0
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6728Statement Of Account USD 26,162.21.exeC:\Users\admin\AppData\Roaming\Adobe\adobe.exeexecutable
MD5:74421477FAFAF6BEB9D8E3806E1F6643
SHA256:EDB50E85473329F205F9CDE2FCA57605B2DCAFCA75C12C9DA52632BFC4249F26
6460WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR6460.5018\Rar$Scan8602.battext
MD5:21443CAF97F0DE9BC889D3F4C8034403
SHA256:647357C74E74375566B52D3797F99A276DD8F90A8F5F306A37F4CFDC1001458F
7156MpCmdRun.exeC:\Users\admin\AppData\Local\Temp\MpCmdRun.logtext
MD5:8F4EFD46F07663F8860D550DF14C5A79
SHA256:2DF75D1A2E7EA51E139DDA9F360620380DA476DED78950C03604C68168BDD94C
6460WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR6460.5018\d9364e2fb7ce18950dd9ca2e1de5a66a23cafa3d8c37d309d98ef4419bd700d8.zip\Statement Of Account USD 26,162.21\Statement Of Account USD 26,162.21.exeexecutable
MD5:74421477FAFAF6BEB9D8E3806E1F6643
SHA256:EDB50E85473329F205F9CDE2FCA57605B2DCAFCA75C12C9DA52632BFC4249F26
6460WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR6460.8432\Rar$Scan42584.battext
MD5:3B356E26AE9E273607DDAE90A9396C3E
SHA256:5163E031B19BEE8EA6799C4FEF07BC1A6B2F92883FF18B99631204E43AA4A8DF
6460WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR6460.8432\d9364e2fb7ce18950dd9ca2e1de5a66a23cafa3d8c37d309d98ef4419bd700d8.zip\Statement Of Account USD 26,162.21\Statement Of Account USD 26,162.21.exeexecutable
MD5:74421477FAFAF6BEB9D8E3806E1F6643
SHA256:EDB50E85473329F205F9CDE2FCA57605B2DCAFCA75C12C9DA52632BFC4249F26
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
23
DNS requests
9
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
104.26.12.205:443
https://api.ipify.org/
unknown
text
14 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3040
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.23.209.149:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3976
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6728
Statement Of Account USD 26,162.21.exe
104.26.12.205:443
api.ipify.org
CLOUDFLARENET
US
shared

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
www.bing.com
  • 2.23.209.149
  • 2.23.209.187
  • 2.23.209.133
  • 2.23.209.182
  • 2.23.209.140
  • 2.23.209.130
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.9
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
api.ipify.org
  • 104.26.12.205
  • 104.26.13.205
  • 172.67.74.152
shared
s4.serv00.com
  • 213.189.52.181
unknown
self.events.data.microsoft.com
  • 20.50.201.201
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
6728
Statement Of Account USD 26,162.21.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
6728
Statement Of Account USD 26,162.21.exe
Potential Corporate Privacy Violation
ET POLICY Possible IP Check api.ipify.org
6728
Statement Of Account USD 26,162.21.exe
A Network Trojan was detected
STEALER [ANY.RUN] AgentTesla Exfiltration (raw TCP)
6728
Statement Of Account USD 26,162.21.exe
A Network Trojan was detected
STEALER [ANY.RUN] AgentTesla Exfiltration (raw TCP)
6728
Statement Of Account USD 26,162.21.exe
A Network Trojan was detected
ET MALWARE AgentTesla Exfil via FTP
—
—
Misc activity
INFO [ANY.RUN] FTP protocol command for uploading a file
6728
Statement Of Account USD 26,162.21.exe
Misc activity
INFO [ANY.RUN] FTP server is ready for the new user
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
d9364e2fb7ce18950dd9ca2e1de5a66a23cafa3d8c37d309d98ef4419bd700d8