File name:

Request for Quotation AGP Global Group LLC No._219007290.rar

Full analysis: https://app.any.run/tasks/e109f8de-309d-47bb-b65b-61c733a2c7f3
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Analysis date: September 18, 2019, 17:37:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
stealer
agenttesla
evasion
trojan
rat
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

EE435AE603E686373CD0ED990359A1C5

SHA1:

F293CEB8D75E38839E8D87E49860FE23951F8D64

SHA256:

DD46E00B91F5105FB8A296A41D7129A7742D9FF04EE1990FA3E9DA30EC6C96DB

SSDEEP:

24576:niF4t+1z4vkm70pwwh6F0/PbPrmspxiIPL2x7:iF4Ymvkm7AwAzLCIx76F

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes the autorun value in the registry

      • Request for Quotation AGP Global Group LLC No. 219007290.exe (PID: 3476)
      • RegAsm.exe (PID: 2660)
    • Application was dropped or rewritten from another process

      • Request for Quotation AGP Global Group LLC No. 219007290.exe (PID: 3476)
      • RegAsm.exe (PID: 2660)
    • AGENTTESLA was detected

      • RegAsm.exe (PID: 2660)
    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 2660)
  • SUSPICIOUS

    • Suspicious files were dropped or overwritten

      • Request for Quotation AGP Global Group LLC No. 219007290.exe (PID: 3476)
    • Executable content was dropped or overwritten

      • Request for Quotation AGP Global Group LLC No. 219007290.exe (PID: 3476)
      • WinRAR.exe (PID: 3500)
      • RegAsm.exe (PID: 2660)
    • Reads Windows Product ID

      • RegAsm.exe (PID: 2660)
    • Creates files in the user directory

      • RegAsm.exe (PID: 2660)
    • Reads the cookies of Google Chrome

      • RegAsm.exe (PID: 2660)
    • Checks for external IP

      • RegAsm.exe (PID: 2660)
    • Reads Environment values

      • RegAsm.exe (PID: 2660)
    • Reads the cookies of Mozilla Firefox

      • RegAsm.exe (PID: 2660)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe request for quotation agp global group llc no. 219007290.exe #AGENTTESLA regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
2660"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Request for Quotation AGP Global Group LLC No. 219007290.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
3476"C:\Users\admin\AppData\Local\Temp\Rar$EXa3500.29430\Request for Quotation AGP Global Group LLC No. 219007290.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3500.29430\Request for Quotation AGP Global Group LLC No. 219007290.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3500.29430\request for quotation agp global group llc no. 219007290.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
3500"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Request for Quotation AGP Global Group LLC No._219007290.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
528
Read events
492
Write events
36
Delete events
0

Modification events

(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3500) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Request for Quotation AGP Global Group LLC No._219007290.rar
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
3
Suspicious files
0
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
2660RegAsm.exeC:\Users\admin\AppData\Roaming\vperriut.mcg.zip
MD5:
SHA256:
3500WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3500.29430\Request for Quotation AGP Global Group LLC No. 219007290.exeexecutable
MD5:
SHA256:
2660RegAsm.exeC:\Users\admin\AppData\Local\Temp\637044287153026250_a4edbdb8-2c7d-41e4-bb03-87afd8fc0fef.dbsqlite
MD5:
SHA256:
3476Request for Quotation AGP Global Group LLC No. 219007290.exeC:\Users\Public\njohrcjqxifqrgrajtlj.vbstext
MD5:
SHA256:
2660RegAsm.exeC:\Users\admin\AppData\Roaming\vperriut.mcg\Firefox\Profiles\qldyz51w.default\cookies.sqlitesqlite
MD5:
SHA256:
3476Request for Quotation AGP Global Group LLC No. 219007290.exeC:\AppData\poqexec\igfxHK.batexecutable
MD5:
SHA256:
2660RegAsm.exeC:\Users\admin\AppData\Roaming\vperriut.mcg\Chrome\Default\Cookiessqlite
MD5:
SHA256:
2660RegAsm.exeC:\Users\admin\AppData\Roaming\MyApp\MyApp.exeexecutable
MD5:B58B926C3574D28D5B7FDD2CA3EC30D5
SHA256:6E70B56D748C4CCAB13CC8A055D3795EA0DD95FE3B70568D7D3AC0C6621140A3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2660
RegAsm.exe
GET
200
18.214.132.216:80
http://checkip.amazonaws.com/
US
text
13 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2660
RegAsm.exe
170.249.254.103:443
www.goldenfuturepower5.com
Dallas Infrastructure Services, LLC
US
unknown
2660
RegAsm.exe
18.214.132.216:80
checkip.amazonaws.com
US
shared

DNS requests

Domain
IP
Reputation
www.goldenfuturepower5.com
  • 170.249.254.103
suspicious
checkip.amazonaws.com
  • 18.214.132.216
  • 18.205.71.63
  • 34.196.181.158
  • 3.224.145.145
  • 52.55.255.113
  • 52.44.169.135
malicious

Threats

PID
Process
Class
Message
2660
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] AgentTesla IP Check
2 ETPRO signatures available at the full report
No debug info