top title background image
flash

42092859-4 SOA Docs.exe

Status: finished
Submission Time: 2021-09-27 21:11:04 +02:00
Malicious
Trojan
Adware
Spyware
Evader
AgentTesla

Comments

Tags

  • agenttesla
  • exe

Details

  • Analysis ID:
    491752
  • API (Web) ID:
    859322
  • Analysis Started:
    2021-09-27 21:15:07 +02:00
  • Analysis Finished:
    2021-09-27 21:28:42 +02:00
  • MD5:
    81b92680fb33ddfaccae09031e1888f2
  • SHA1:
    880a7e88ca219c5361ddfbad786bfeea9bb6b6fa
  • SHA256:
    ccfec983bc3c78598d2fed9861fde7a3c75ec512ab8642f132b30dbb9e516eac
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 11/28

Domains

Name IP Detection
mail.sautiyapwanifm.com
198.187.31.108

URLs

Name Detection
http://www.fonts.com
http://www.jiyu-kobo.co.jp/of
http://UJYCVD.com
Click to see the 97 hidden entries
https://twitter.com/hanalen_
http://DynDns.comDynDNS
http://www.fontbureau.com
http://www.apache.org/licenses/LICENSE-2.0
https://api.twitter.com/1.1/friends/list.json
http://www.jiyu-kobo.co.jp/phy/
http://www.sakkal.com
http://www.carterandcone.comI
http://www.jiyu-kobo.co.jp/ts
http://www.sandoll.co.kr
http://fontfabrik.com8e
https://api.ipify.org%GETMozilla/5.0
https://api.twitter.com/1.1/statuses/home_timeline.json
https://api.twitter.com/1.1/favorites/destroy.json
http://www.typography.net
https://api.twitter.com/oauth/access_token
http://fontfabrik.com
http://www.galapagosdesign.com/staff/dennis.htm
http://www.typography.netD
http://www.jiyu-kobo.co.jp/N1
http://www.carterandcone.com.
https://api.twitter.com/1.1/statuses/unretweet/whttps://api.twitter.com/1.1/statuses/mentions_timeli
http://www.zhongyicts.com.cnr-c21
https://api.twitter.com/oauth/request_token
https://api.twitter.com/1.1/statuses/home_timeline.jsonahttps://upload.twitter.com/1.1/media/upload.
https://api.twitter.com/1.1/favorites/list.json
https://api.twitter.com/1.1/friends/ids.json
https://api.twitter.com/1.1/direct_messages.json
https://api.twitter.com/oauth/authorize?oauth_token=
https://api.twitter.com/1.1/favorites/create.json
http://www.fontbureau.com/designers8
http://www.zhongyicts.com.cno.
http://www.fontbureau.como
http://www.jiyu-kobo.co.jp/jp/k1
http://www.jiyu-kobo.co.jp/
http://www.jiyu-kobo.co.jp/.com
http://www.jiyu-kobo.co.jp/%1
https://api.twitter.com/1.1/statuses/show.json
http://www.founder.com.cn/cn
http://www.fontbureau.com/designers/cabarga.htmlN
http://www.jiyu-kobo.co.jp/P1
http://www.jiyu-kobo.co.jp/jp/
http://www.jiyu-kobo.co.jp/Y0nl
http://www.jiyu-kobo.co.jp/71
http://fontfabrik.comzY6
https://twitter.com/
https://userstream.twitter.com/1.1/user.json
https://api.twitter.com/1.1/statuses/destroy/
https://twitter.com/Dalsae_info
https://api.twitter.com/1.1/statuses/mentions_timeline.json
http://mail.sautiyapwanifm.com
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
http://www.jiyu-kobo.co.jp/U
http://www.galapagosdesign.com/
https://api.twitter.com/1.1/direct_messages.jsonyhttps://api.twitter.com/1.1/friendships/no_retweets
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
https://api.ipify.org%
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://www.zhongyicts.com.cn
http://www.urwpp.deDPlease
http://www.sandoll.co.krYX
http://www.galapagosdesign.com/DPlease
https://api.twitter.com/1.1/statuses/retweet/
https://api.twitter.com/1.1/account/verify_credentials.json
http://www.founder.com.cn/cn/cThe
http://www.sajatypeworks.com
https://api.twitter.com/1.1/statuses/user_timeline.json
http://www.fontbureau.com/designers
https://api.twitter.com/1.1/blocks/create.json
http://kr.battle.net/heroes/ko/
https://pbs.twimg.com/media/
http://kr.battle.net/heroes/ko/?https://twitter.com/Dalsae_info9https://twitter.com/hanalen_
http://www.sajatypeworks.com2
https://upload.twitter.com/1.1/media/upload.json
http://www.carterandcone.com
http://www.goodfont.co.kr
https://api.twitter.com/1.1/statuses/unretweet/
https://api.twitter.com/1.1/blocks/ids.json
http://www.tiro.com
http://www.founder.com.cn/cna-d
https://api.twitter.com/1.1/friendships/update.json
http://www.fontbureau.com/designers?
https://api.twitter.com/1.1/friendships/no_retweets/ids.json
http://www.founder.com.cn/cn/bThe
http://www.fontbureau.com/designers/?
http://127.0.0.1:HTTP/1.1
http://www.fontbureau.com/designersG
http://www.fontbureau.com/designers/frere-jones.html
http://www.jiyu-kobo.co.jp/k1
https://G66GBSWH7MRa.net
http://www.jiyu-kobo.co.jp/jp/%1
https://api.twitter.com/1.1/users/lookup.json
http://www.carterandcone.coml
https://api.twitter.com/1.1/statuses/update.json
https://api.twitter.com/1.1/statuses/user_timeline.jsonwhttps://api.twitter.com/1.1/account/verify_c
http://www.carterandcone.comh
http://www.zhongyicts.com.cno.s1

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\42092859-4 SOA Docs.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\tmpB4F.tmp
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
Click to see the 6 hidden entries
C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe:Zone.Identifier
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\xlpVvRzhctudF.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Windows\System32\drivers\etc\hosts
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kprUEGC.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\tmpBBE3.tmp
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\xlpVvRzhctudF.exe:Zone.Identifier
ASCII text, with CRLF line terminators
#