download: | yrtr7746bc.exe |
Full analysis: | https://app.any.run/tasks/03f12144-5f4e-4cfa-aaf2-17a51996664d |
Verdict: | Malicious activity |
Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
Analysis date: | May 24, 2019, 08:04:10 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive |
MD5: | 5161420BFAF363D2F4D7C9111537FD17 |
SHA1: | D61B476A67CDB1AE13313C264E52B04EF2132A68 |
SHA256: | DCE9407BB0DB6C4AE1E2779FAB73FB8C01A77876C118D0855F54F0E475EF1C61 |
SSDEEP: | 24576:c2O/GlUKD4ghoCEvDxxgOiV/8zQomsVwAwmxhKbH3rUO46GBD:782oCz3WpIAwmxUT3iZ |
.exe | | | Win32 Executable MS Visual C++ (generic) (35.8) |
---|---|---|
.exe | | | Win64 Executable (generic) (31.7) |
.scr | | | Windows screen saver (15) |
.dll | | | Win32 Dynamic Link Library (generic) (7.5) |
.exe | | | Win32 Executable (generic) (5.1) |
Subsystem: | Windows GUI |
---|---|
SubsystemVersion: | 5 |
ImageVersion: | - |
OSVersion: | 5 |
EntryPoint: | 0xac87 |
UninitializedDataSize: | - |
InitializedDataSize: | 82944 |
CodeSize: | 74752 |
LinkerVersion: | 9 |
PEType: | PE32 |
TimeStamp: | 2012:06:09 15:19:49+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 09-Jun-2012 13:19:49 |
Detected languages: |
|
Debug artifacts: |
|
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000F0 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 09-Jun-2012 13:19:49 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0001231E | 0x00012400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.55555 |
.rdata | 0x00014000 | 0x00001D15 | 0x00001E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.99401 |
.data | 0x00016000 | 0x00017724 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.54914 |
.CRT | 0x0002E000 | 0x00000020 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.394141 |
.rsrc | 0x0002F000 | 0x000120F4 | 0x00012200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.76938 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.20816 | 1464 | Latin 1 / Western European | English - United States | RT_MANIFEST |
7 | 3.24143 | 556 | Latin 1 / Western European | English - United States | RT_STRING |
8 | 3.26996 | 974 | Latin 1 / Western European | English - United States | RT_STRING |
9 | 3.04375 | 530 | Latin 1 / Western European | English - United States | RT_STRING |
10 | 3.16254 | 776 | Latin 1 / Western European | English - United States | RT_STRING |
11 | 3.06352 | 380 | Latin 1 / Western European | English - United States | RT_STRING |
12 | 2.33959 | 102 | Latin 1 / Western European | English - United States | RT_STRING |
100 | 1.51664 | 20 | Latin 1 / Western European | Process Default Language | RT_GROUP_ICON |
101 | 4.19099 | 2998 | Latin 1 / Western European | English - United States | RT_BITMAP |
ASKNEXTVOL | 3.42597 | 646 | Latin 1 / Western European | English - United States | RT_DIALOG |
ADVAPI32.dll |
COMCTL32.dll |
COMDLG32.dll |
GDI32.dll |
KERNEL32.dll |
OLEAUT32.dll |
SHELL32.dll |
SHLWAPI.dll |
USER32.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2480 | "C:\Users\admin\AppData\Local\Temp\yrtr7746bc.exe" | C:\Users\admin\AppData\Local\Temp\yrtr7746bc.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3980 | C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503} | C:\Windows\system32\DllHost.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2880 | "C:\Users\admin\AppData\Local\Temp\55690970\gav.exe" tcv=qbi | C:\Users\admin\AppData\Local\Temp\55690970\gav.exe | — | yrtr7746bc.exe |
User: admin Company: AutoIt Team Integrity Level: MEDIUM Description: AutoIt v3 Script Exit code: 0 Version: 3, 3, 14, 5 | ||||
3004 | C:\Users\admin\AppData\Local\Temp\55690970\gav.exe C:\Users\admin\AppData\Local\Temp\55690970\VMWJK | C:\Users\admin\AppData\Local\Temp\55690970\gav.exe | gav.exe | |
User: admin Company: AutoIt Team Integrity Level: MEDIUM Description: AutoIt v3 Script Exit code: 0 Version: 3, 3, 14, 5 | ||||
2932 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | gav.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Services Installation Utility Version: 4.6.1055.0 built by: NETFXREL2 |
(PID) Process: | (2480) yrtr7746bc.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached |
Operation: | write | Name: | {FFE2A43C-56B9-4BF5-9A79-CC6D4285608A} {00000122-0000-0000-C000-000000000046} 0xFFFF |
Value: 0100000000000000E8BD96500712D501 | |||
(PID) Process: | (2480) yrtr7746bc.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
Operation: | write | Name: | Name |
Value: yrtr7746bc.exe | |||
(PID) Process: | (3980) DllHost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
Operation: | write | Name: | Name |
Value: DllHost.exe | |||
(PID) Process: | (2480) yrtr7746bc.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (2480) yrtr7746bc.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (3004) gav.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
Operation: | write | Name: | WindowsUpdate |
Value: C:\Users\admin\AppData\Local\Temp\55690970\gav.exe C:\Users\admin\AppData\Local\Temp\55690970\TCV_QB~1 | |||
(PID) Process: | (2932) RegSvcs.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RegSvcs_RASAPI32 |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (2932) RegSvcs.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RegSvcs_RASAPI32 |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
(PID) Process: | (2932) RegSvcs.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RegSvcs_RASAPI32 |
Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
(PID) Process: | (2932) RegSvcs.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RegSvcs_RASAPI32 |
Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2480 | yrtr7746bc.exe | C:\Users\admin\AppData\Local\Temp\55690970\ikp.pdf | text | |
MD5:68A6F80CA881C028F313A0C807A0727F | SHA256:06BF6DCC573FBDA821E78C30A7A9797E02C001C9B41D4093949E00AC06559666 | |||
2480 | yrtr7746bc.exe | C:\Users\admin\AppData\Local\Temp\55690970\ipx.dat | text | |
MD5:DA427191CFFB51F583B6D0B3B4F25BF9 | SHA256:1099207F7B0D9DA71414D2203C2B6324B4D0F558AAC7E8291408447B78D6A14A | |||
2480 | yrtr7746bc.exe | C:\Users\admin\AppData\Local\Temp\55690970\uuj.jpg | text | |
MD5:5DB58E29DDE806DE09C9E4E81BA84FEA | SHA256:5559BE6811F4B1087242BBFD39DC2AA8C9B5C4797328DBD0D76ADCFAAE6B50BA | |||
2480 | yrtr7746bc.exe | C:\Users\admin\AppData\Local\Temp\55690970\ToolbarConstants.icm | text | |
MD5:6E9BD873D7AACC562FB5312A25FC5EBC | SHA256:7EDDFB5889FED2BA9F15B058D5C1D8701D2D75DA1A0AD42A0E36260D76916C60 | |||
2480 | yrtr7746bc.exe | C:\Users\admin\AppData\Local\Temp\55690970\uug.dat | text | |
MD5:B4C74C7142B52004FF89442ADD27DEEA | SHA256:CB06883272FD531BD0726F5A04C39D6CFB559DD29BE3DD0BBC9E9935901EA7D5 | |||
2480 | yrtr7746bc.exe | C:\Users\admin\AppData\Local\Temp\55690970\buh.xl | text | |
MD5:820698AD994EEE0C05453D30BB2811AC | SHA256:0CEBEB78A12858C5AA0BF84229C246C76445BD8D835299991DEE2F7C8D70D442 | |||
2480 | yrtr7746bc.exe | C:\Users\admin\AppData\Local\Temp\55690970\rmh.icm | text | |
MD5:B2D9E4C03FEF3089B7F8AB371C2F32A9 | SHA256:650B44AE2CA1E7353C26CA54F043979F22E48F20036E8B7F6B8EDB446589E7E6 | |||
2480 | yrtr7746bc.exe | C:\Users\admin\AppData\Local\Temp\55690970\kfx.txt | text | |
MD5:4BDE41CA6FA309384A891C430821CE8A | SHA256:42495FD35D7BBB5A9E66194BCC81C9561B9DC46B5F0E3C91F11EBF20E9320973 | |||
2480 | yrtr7746bc.exe | C:\Users\admin\AppData\Local\Temp\55690970\xax.pdf | text | |
MD5:3405A5B87A5344BFEA54F47D77821EA7 | SHA256:C3E5C6926CBE84C9BB1F740D3AB45821F5D018C13B9D300B1339F9042C138163 | |||
2480 | yrtr7746bc.exe | C:\Users\admin\AppData\Local\Temp\55690970\ToolbarConstants.bmp | text | |
MD5:E2C2BFFB3F3D37DC583C18BC28EFE95A | SHA256:F011A518A99A1CB9E3AB2735DDB80117DAC707E16C8B91C5FBFB7D8A42879BFE |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2932 | RegSvcs.exe | GET | 200 | 52.206.161.133:80 | http://checkip.amazonaws.com/ | US | text | 16 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2932 | RegSvcs.exe | 52.206.161.133:80 | checkip.amazonaws.com | Amazon.com, Inc. | US | shared |
2932 | RegSvcs.exe | 68.65.122.52:26 | mail.globalfinancel.com | Namecheap, Inc. | US | malicious |
Domain | IP | Reputation |
---|---|---|
mail.globalfinancel.com |
| malicious |
checkip.amazonaws.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
2932 | RegSvcs.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
2932 | RegSvcs.exe | A Network Trojan was detected | MALWARE [PTsecurity] AgentTesla IP Check |