analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

British_Marine_FABRICATION_PARTS_AND_LIGHTS.doc

Full analysis: https://app.any.run/tasks/72ac23ac-b15a-4f44-b251-4df03f06adc0
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Analysis date: September 18, 2019, 18:13:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
exploit
CVE-2017-11882
keylogger
agenttesla
evasion
rat
Indicators:
MIME: text/rtf
File info: Rich Text Format data, unknown version
MD5:

9D190987EB597D3C71F6602B9BB12788

SHA1:

BB1CF422EDA915E014854E9029A980F57A9B0E65

SHA256:

FD11CCB53F6DD14FE719D1E3E84E8A42AFF8840C27F007F8B63C737C2B8654DF

SSDEEP:

96:b/GMrS8zlnA2UCtx32xBmmnpQMP+QChoWQL9zoou4CojzhDGwHtVk3duX/:DGh0LU2I8mnt+Plj4HvhqwNVB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • qsdfghjklkjhgfd.exe (PID: 2532)
      • qsdfghjklkjhgfd.exe (PID: 4036)
    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 1268)
    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 1268)
    • AGENTTESLA was detected

      • qsdfghjklkjhgfd.exe (PID: 4036)
    • Actions looks like stealing of personal data

      • qsdfghjklkjhgfd.exe (PID: 4036)
  • SUSPICIOUS

    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 1268)
    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 1268)
    • Executed via COM

      • EQNEDT32.EXE (PID: 1268)
    • Application launched itself

      • qsdfghjklkjhgfd.exe (PID: 2532)
    • Checks for external IP

      • qsdfghjklkjhgfd.exe (PID: 4036)
    • Connects to SMTP port

      • qsdfghjklkjhgfd.exe (PID: 4036)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2932)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2932)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs eqnedt32.exe qsdfghjklkjhgfd.exe no specs #AGENTTESLA qsdfghjklkjhgfd.exe

Process information

PID
CMD
Path
Indicators
Parent process
2932"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\British_Marine_FABRICATION_PARTS_AND_LIGHTS.doc.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
1268"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2532"C:\Users\admin\AppData\Roaming\qsdfghjklkjhgfd.exe"C:\Users\admin\AppData\Roaming\qsdfghjklkjhgfd.exeEQNEDT32.EXE
User:
admin
Company:
FEMURfauvisms
Integrity Level:
MEDIUM
Exit code:
0
Version:
2.04.0006
4036"C:\Users\admin\AppData\Roaming\qsdfghjklkjhgfd.exe"C:\Users\admin\AppData\Roaming\qsdfghjklkjhgfd.exe
qsdfghjklkjhgfd.exe
User:
admin
Company:
FEMURfauvisms
Integrity Level:
MEDIUM
Version:
2.04.0006
Total events
1 022
Read events
637
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
0
Text files
2
Unknown types
6

Dropped files

PID
Process
Filename
Type
2932WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR8D12.tmp.cvr
MD5:
SHA256:
2932WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:E84E2E34ED043AE3826AD565AB7516B3
SHA256:D9CC4ECE0D5AF596D4584F8C9829A9961BB2EB3E6D472C9C143BEB4B743CA842
2932WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:E797E2CB36257E66BF96BFD81A49612C
SHA256:B686904770984EFDB06A6AC1DCC197E6D2369A522CA0C65D0610DCA778786FFD
1268EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\prty[1].exeexecutable
MD5:DB341EC529891A44DD0BE96D3304491C
SHA256:2ABD73DFE70767A5A4E06E1CA7283B72364215D202F4A5F955A16B53FA92C696
1268EQNEDT32.EXEC:\Users\admin\AppData\Roaming\qsdfghjklkjhgfd.exeexecutable
MD5:DB341EC529891A44DD0BE96D3304491C
SHA256:2ABD73DFE70767A5A4E06E1CA7283B72364215D202F4A5F955A16B53FA92C696
2932WINWORD.EXEC:\Users\admin\Desktop\~$itish_Marine_FABRICATION_PARTS_AND_LIGHTS.doc.rtfpgc
MD5:B4B9E93D09632BEA7B118815F26520A6
SHA256:9D02C96E8C97B48C4F5A5F9A255562D5B5FD7E9686F9E3C3B44EB3BFAD579817
4036qsdfghjklkjhgfd.exeC:\Users\admin\AppData\Local\Temp\637044309107512500_9c31a7ce-eb46-4151-a3b9-b0102e16dbf3.dbsqlite
MD5:0B3C43342CE2A99318AA0FE9E531C57B
SHA256:0CCB4915E00390685621DA3D75EBFD5EDADC94155A79C66415A7F4E9763D71B8
2932WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\British_Marine_FABRICATION_PARTS_AND_LIGHTS.doc.rtf.LNKlnk
MD5:BA02AE506673F5750F96859E09B3B5EE
SHA256:F0765173FE0DDDBC23678A720CCB3A6540A53B9DA9A4AA85885628A2B4D99808
1268EQNEDT32.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.datdat
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862
SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4036
qsdfghjklkjhgfd.exe
GET
200
52.44.169.135:80
http://checkip.amazonaws.com/
US
text
15 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4036
qsdfghjklkjhgfd.exe
198.54.122.60:587
mail.privateemail.com
Namecheap, Inc.
US
suspicious
1268
EQNEDT32.EXE
112.213.89.40:443
tfvn.com.vn
SUPERDATA
VN
malicious
4036
qsdfghjklkjhgfd.exe
52.44.169.135:80
checkip.amazonaws.com
Amazon.com, Inc.
US
shared

DNS requests

Domain
IP
Reputation
tfvn.com.vn
  • 112.213.89.40
unknown
checkip.amazonaws.com
  • 52.44.169.135
  • 18.214.132.216
  • 52.55.255.113
  • 34.196.181.158
  • 18.205.71.63
  • 3.224.145.145
shared
mail.privateemail.com
  • 198.54.122.60
shared

Threats

PID
Process
Class
Message
4036
qsdfghjklkjhgfd.exe
A Network Trojan was detected
MALWARE [PTsecurity] AgentTesla IP Check
3 ETPRO signatures available at the full report
No debug info