analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

hesaphareket.doc

Full analysis: https://app.any.run/tasks/4af77b8b-017d-4783-8de9-286c20ca379a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: July 17, 2019, 06:40:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
loader
rat
nanocore
trojan
maldoc-13
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

BE615129803A0FD3173D54A60102219B

SHA1:

06777DF2687205676BE072E1E9C526079FB8D917

SHA256:

F61F16E30457AC58B233B223AF61A131FBAA7B63160E4EF8F4603D69AF84E931

SSDEEP:

1536:mr/kUe1ehegeqfD3oZ1OkHFRIxPILSQWns3R:mr/eZmxgLSQWno

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • uuuuuu.exe (PID: 2824)
      • RegAsm.exe (PID: 3900)
    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3468)
    • Requests a remote executable file from MS Office

      • WINWORD.EXE (PID: 3468)
    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 3468)
    • Changes the autorun value in the registry

      • RegAsm.exe (PID: 3900)
      • uuuuuu.exe (PID: 2824)
    • NanoCore was detected

      • RegAsm.exe (PID: 3900)
    • Actions looks like stealing of personal data

      • vbc.exe (PID: 2504)
    • Connects to CnC server

      • RegAsm.exe (PID: 3900)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • uuuuuu.exe (PID: 2824)
      • RegAsm.exe (PID: 3900)
    • Creates files in the user directory

      • uuuuuu.exe (PID: 2824)
      • RegAsm.exe (PID: 3900)
    • Suspicious files were dropped or overwritten

      • uuuuuu.exe (PID: 2824)
    • Executes scripts

      • RegAsm.exe (PID: 3900)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3468)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 3468)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winword.exe uuuuuu.exe #NANOCORE regasm.exe vbc.exe

Process information

PID
CMD
Path
Indicators
Parent process
3468"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\hesaphareket.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2824C:\Users\admin\AppData\Roaming\uuuuuu.exeC:\Users\admin\AppData\Roaming\uuuuuu.exe
WINWORD.EXE
User:
admin
Company:
capauthz
Integrity Level:
MEDIUM
Description:
changepk
Exit code:
0
Version:
74.173.822.752
3900"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
uuuuuu.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
2504"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\admin\AppData\Local\Temp\zx1mndfp.jtz"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
RegAsm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Version:
8.0.50727.5420
Total events
1 301
Read events
961
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
4
Text files
3
Unknown types
3

Dropped files

PID
Process
Filename
Type
3468WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRE91A.tmp.cvr
MD5:
SHA256:
3468WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3A6F3405.png
MD5:
SHA256:
3900RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:9F6320CF3B4BAFAB49F0DCFF72A4D5CF
SHA256:037C5F33DEC0FB458A1EFB6E7C5B7B15A2DDC93B6E414D3EC51DE7B1FF4F186D
3468WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:1A7510C8EFCAFC695BBED85779C1D720
SHA256:7ED19829FBD183C339C395F1D4D5A0651BD0EEC9717640A21F0D1969D0D141A9
3468WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$saphareket.docpgc
MD5:BE447412E604EB087657D3FE7F591C7B
SHA256:3BD5C26E50DB6EFFA8633143D9BB22D81E1FB758006A4F96F69FA5EAD2E56038
3468WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Abctfhghghghghg.sctbinary
MD5:71A46AF5EA4C875CB3C4F98581B9AE65
SHA256:24942D7FC436E41DCF04E38917B9152F0EF0D5D32B7B81D3F32BB65A712BCC2F
2824uuuuuu.exeC:\Users\Public\XUTWzOxyTH.vbstext
MD5:7C57DC04E8A123C75EA7AA3B1BE8B7E9
SHA256:7C26F6446029CB2EE1E5F93594F6937518AFEFFD42804E4FC8EAE8B75D7D2886
2824uuuuuu.exeC:\Users\admin\AppData\Roaming\SndVol\mstsc.batexecutable
MD5:16801CF033ACA1E5F06007664FF63D7A
SHA256:6F83555AAF63A7705829F2A784498DFD8C5E6D94EF1805D40A369914C92B51B2
3468WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\MSO1045.aclbinary
MD5:0A6AFAD51F9597B91ADFE4FC68BAB556
SHA256:071F4A97E4608A659CA69324B911C74270EA48DAA3861FA50FD886CA3E197D0D
3468WINWORD.EXEC:\Users\admin\AppData\Roaming\uuuuuu.exeexecutable
MD5:4574D0FDF063576FD573C01663339EA3
SHA256:F9C6B9EEF6C972A357E865B9E9513C877E8A3D2166D3175A3FA9B2DFE3C2B095
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3468
WINWORD.EXE
GET
200
46.148.26.109:80
http://spinagruop.com/uuuuuu.exe
UA
executable
1.07 Mb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3900
RegAsm.exe
8.8.8.8:53
Google Inc.
US
whitelisted
3468
WINWORD.EXE
46.148.26.109:80
spinagruop.com
Infium, UAB
UA
suspicious
3900
RegAsm.exe
185.247.228.237:5781
ify.duckdns.org
malicious

DNS requests

Domain
IP
Reputation
spinagruop.com
  • 46.148.26.109
suspicious
ify.duckdns.org
  • 185.247.228.237
malicious

Threats

PID
Process
Class
Message
3468
WINWORD.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3900
RegAsm.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3900
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3900
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3900
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3900
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3900
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3900
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3900
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3900
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
12 ETPRO signatures available at the full report
No debug info