analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

New Purchase.zip

Full analysis: https://app.any.run/tasks/afdf53b1-c424-4847-b5c3-c98023750c9c
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Analysis date: May 24, 2019, 14:00:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
trojan
evasion
agenttesla
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

E6BC30B452AEE17C094A32E529337F39

SHA1:

124E5384C4826DC7F02B9C96AC8D5D30B9295041

SHA256:

DC9D583E9362D42682E5753A3D701918694669AF41A73C3AAF0C009D566F90FD

SSDEEP:

24576:0t+TbYfl0H2GEma8AubOcCwBT1jGRLdudCC0tqzsMZuj:ioboGEibqcCwN1SdCDRC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Latest-server.exe (PID: 1232)
      • New Purchase.exe (PID: 2812)
      • RegSvcs.exe (PID: 2628)
    • Changes the autorun value in the registry

      • RegSvcs.exe (PID: 2628)
      • Latest-server.exe (PID: 1232)
    • NanoCore was detected

      • Latest-server.exe (PID: 1232)
    • Writes to a start menu file

      • New Purchase.exe (PID: 2812)
    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 2628)
    • AGENTTESLA was detected

      • RegSvcs.exe (PID: 2628)
    • Connects to CnC server

      • Latest-server.exe (PID: 1232)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3276)
      • RegSvcs.exe (PID: 2628)
      • New Purchase.exe (PID: 2812)
      • Latest-server.exe (PID: 1232)
    • Creates files in the user directory

      • New Purchase.exe (PID: 2812)
      • RegSvcs.exe (PID: 2628)
      • Latest-server.exe (PID: 1232)
    • Checks for external IP

      • RegSvcs.exe (PID: 2628)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: New Purchase.exe
ZipUncompressedSize: 1397760
ZipCompressedSize: 964036
ZipCRC: 0x6cc4de52
ZipModifyDate: 2019:05:24 17:12:28
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start winrar.exe new purchase.exe #AGENTTESLA regsvcs.exe #NANOCORE latest-server.exe

Process information

PID
CMD
Path
Indicators
Parent process
3276"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\New Purchase.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2812"C:\Users\admin\AppData\Local\Temp\Rar$EXa3276.45948\New Purchase.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3276.45948\New Purchase.exe
WinRAR.exe
User:
admin
Company:
PrintBrmEngine
Integrity Level:
MEDIUM
Description:
conhost
Version:
753.254.685.736
2628"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
New Purchase.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
1232"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Latest-server.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Latest-server.exe
RegSvcs.exe
User:
admin
Integrity Level:
MEDIUM
Total events
904
Read events
864
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
3
Text files
3
Unknown types
2

Dropped files

PID
Process
Filename
Type
1232Latest-server.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.bak
MD5:
SHA256:
2628RegSvcs.exeC:\Users\admin\AppData\Local\Temp\dude\dude.exeexecutable
MD5:D79F070423FDD3F01CE8C2BA3FBBC8ED
SHA256:97BD627EBFC4D40B21EBAAED916A1BA53859520EDC99537B37D042A0D5425A5A
2628RegSvcs.exeC:\Users\admin\AppData\Local\Temp\636943068799691250_8983642e-48e1-425d-8829-263e8643ba8a.dbsqlite
MD5:0B3C43342CE2A99318AA0FE9E531C57B
SHA256:0CCB4915E00390685621DA3D75EBFD5EDADC94155A79C66415A7F4E9763D71B8
1232Latest-server.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exeexecutable
MD5:532360FE39CEF5FC7F69857AC0612DEB
SHA256:D8F09CDAF2631F0146D792E8C89D95CEC248300CA031D660F4AE35DF2D93689B
2812New Purchase.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\avicap32.urltext
MD5:F273DBE76E2E6A1C418B4C9A37F8827D
SHA256:D4A1EB7360C48631C30D079B85081AA2E63F4CBAC5272C5C9BE0CA7D4E215DFC
2812New Purchase.exeC:\Users\admin\AppData\Local\Temp\DsmUserTask\aeevts.exeexecutable
MD5:378BBE25EDAA306507CF53B48ADE2993
SHA256:FD588CCAB91297A0EF25BCFAF178F647ACC52A94410C3C6AF2F415EA7FD28BA5
2812New Purchase.exeC:\Users\admin\AppData\Local\Temp\DsmUserTask\avicap32.vbstext
MD5:628D4B3BF3E44858F6AB0B06FF58C797
SHA256:7B57E4E9932B6103269D7769B8F7F4FBE87762FA8958D385814FD01167BB254B
1232Latest-server.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:E8C0206EE033B64F024E45B8F365C37F
SHA256:63A66E20B232F3782F218124CDAA22ECBA6EFA62F31C807339ED7B237E9C9388
3276WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3276.45948\New Purchase.exeexecutable
MD5:43B237AB35BDDE756A168BAE156C0208
SHA256:5CC4D01BCC5D47F6FFD6159651E61C31F48D9FA2F0E16683912E83C8D53DC575
2628RegSvcs.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Latest-server.exeexecutable
MD5:532360FE39CEF5FC7F69857AC0612DEB
SHA256:D8F09CDAF2631F0146D792E8C89D95CEC248300CA031D660F4AE35DF2D93689B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
4
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2628
RegSvcs.exe
GET
200
18.211.215.84:80
http://checkip.amazonaws.com/
US
text
14 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1232
Latest-server.exe
8.8.8.8:53
Google Inc.
US
whitelisted
2628
RegSvcs.exe
18.211.215.84:80
checkip.amazonaws.com
US
shared
2628
RegSvcs.exe
87.250.250.38:587
smtp.yandex.com
YANDEX LLC
RU
whitelisted
1232
Latest-server.exe
188.72.95.39:1122
starlucky.dynu.net
Voxility S.R.L.
GB
malicious

DNS requests

Domain
IP
Reputation
starlucky.dynu.net
  • 188.72.95.39
unknown
smtp.yandex.com
  • 87.250.250.38
  • 77.88.21.38
  • 213.180.204.38
  • 213.180.193.38
  • 93.158.134.38
shared
checkip.amazonaws.com
  • 18.211.215.84
  • 52.202.139.131
  • 34.233.102.38
  • 52.206.161.133
  • 52.200.125.74
  • 52.6.79.229
shared

Threats

PID
Process
Class
Message
1232
Latest-server.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
1232
Latest-server.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
1232
Latest-server.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
1232
Latest-server.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
1232
Latest-server.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
1232
Latest-server.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
1232
Latest-server.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
1232
Latest-server.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
1232
Latest-server.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
1232
Latest-server.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
40 ETPRO signatures available at the full report
No debug info