URL:

https://adminkit.net/files/smtp_diag_tool/SMTP_Diag_Tool.zip

Full analysis: https://app.any.run/tasks/21ffe48a-4579-408d-b960-267f305b7a8b
Verdict: Malicious activity
Analysis date: October 11, 2021, 07:56:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

469629F0B6CEBE3DB8BACC155E78D937

SHA1:

CBA0504FEB8FF48C32CDB957032CC8557F9C5AA9

SHA256:

0C801DB8529DECC14EC73A6FE32F025257FF79ACC250BB97ED6B7B2B9B952873

SSDEEP:

3:N8jMLtEKpV6ahKs/n:2EQax/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3232)
      • SMTP Diag Tool.exe (PID: 3052)

    • Application was dropped or rewritten from another process

      • SMTP Diag Tool.exe (PID: 3052)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 1860)
      • SMTP Diag Tool.exe (PID: 3052)

    • Reads the computer name

      • WinRAR.exe (PID: 1860)
      • SMTP Diag Tool.exe (PID: 3052)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2076)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1860)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 1860)

    • Reads internet explorer settings

      • SMTP Diag Tool.exe (PID: 3052)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 2572)
      • iexplore.exe (PID: 2076)

    • Checks supported languages

      • iexplore.exe (PID: 2076)
      • iexplore.exe (PID: 2572)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2572)
      • iexplore.exe (PID: 2076)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 2572)

    • Application launched itself

      • iexplore.exe (PID: 2572)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2076)
      • iexplore.exe (PID: 2572)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2572)

    • Changes internet zones settings

      • iexplore.exe (PID: 2572)

    • Manual execution by user

      • SMTP Diag Tool.exe (PID: 3052)

    • Creates files in the user directory

      • iexplore.exe (PID: 2572)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2572)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2572)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe searchprotocolhost.exe no specs smtp diag tool.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1860"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\SMTP_Diag_Tool.zip"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2076"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2572 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2572"C:\Program Files\Internet Explorer\iexplore.exe" "https://adminkit.net/files/smtp_diag_tool/SMTP_Diag_Tool.zip"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3052"C:\Users\admin\Desktop\SMTP_Diag_Tool\SMTP Diag Tool.exe" C:\Users\admin\Desktop\SMTP_Diag_Tool\SMTP Diag Tool.exe—Explorer.EXE
User:
admin
Company:
http://www.spam10.com
Integrity Level:
MEDIUM
Description:
SMTP Diag Tool
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\smtp_diag_tool\smtp diag tool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3232"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
12 250
Read events
12 121
Write events
127
Delete events
2

Modification events

(PID) Process:(2572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30916213
(PID) Process:(2572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30916213
(PID) Process:(2572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
3
Suspicious files
20
Text files
18
Unknown types
10

Dropped files

PID
Process
Filename
Type
2076iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
2076iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:—
SHA256:—
2076iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:—
SHA256:—
2076iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar26C5.tmpcat
MD5:—
SHA256:—
2076iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab26C4.tmpcompressed
MD5:—
SHA256:—
2076iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B346EC9699A7032B5605F2E8E52CADABbinary
MD5:—
SHA256:—
2076iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4der
MD5:—
SHA256:—
2076iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4binary
MD5:—
SHA256:—
2076iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B346EC9699A7032B5605F2E8E52CADABder
MD5:—
SHA256:—
2076iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8408FE5CA4467EE4DA84A76EF238FE3binary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
31
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2076
iexplore.exe
GET
200
23.32.238.208:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?a34c29e24764bbe9
US
compressed
59.7 Kb
whitelisted
2076
iexplore.exe
GET
200
195.138.255.9:80
http://crl.identrust.com/DSTROOTCAX3CRL.crl
DE
der
1.16 Kb
whitelisted
2076
iexplore.exe
GET
200
195.138.255.16:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgRldScFjNMs3Z%2BNXaTLKu4r5w%3D%3D
DE
der
503 b
shared
2572
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
2572
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2572
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2572
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
US
der
471 b
whitelisted
2076
iexplore.exe
GET
200
23.45.105.185:80
http://x1.c.lencr.org/
NL
der
717 b
whitelisted
2076
iexplore.exe
GET
200
23.45.105.185:80
http://r3.i.lencr.org/
NL
der
1.28 Kb
whitelisted
2076
iexplore.exe
GET
200
23.45.105.185:80
http://r3.i.lencr.org/
NL
der
1.28 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2076
iexplore.exe
144.91.89.110:443
adminkit.net
Mills College
US
unknown
2076
iexplore.exe
23.32.238.208:80
ctldl.windowsupdate.com
XO Communications
US
unknown
2076
iexplore.exe
195.138.255.9:80
crl.identrust.com
AS33891 Netzbetrieb GmbH
DE
suspicious
2076
iexplore.exe
195.138.255.16:80
r3.o.lencr.org
AS33891 Netzbetrieb GmbH
DE
suspicious
2572
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2572
iexplore.exe
13.92.246.37:443
query.prod.cms.msn.com
Microsoft Corporation
US
whitelisted
2572
iexplore.exe
104.111.242.51:443
go.microsoft.com
Akamai International B.V.
NL
unknown
2572
iexplore.exe
204.79.197.203:443
www.msn.com
Microsoft Corporation
US
malicious
2076
iexplore.exe
23.45.105.185:80
r3.i.lencr.org
Akamai International B.V.
NL
unknown
2572
iexplore.exe
23.32.238.208:80
ctldl.windowsupdate.com
XO Communications
US
unknown

DNS requests

Domain
IP
Reputation
adminkit.net
  • 144.91.89.110
unknown
ctldl.windowsupdate.com
  • 23.32.238.208
  • 23.32.238.226
  • 23.32.238.178
whitelisted
crl.identrust.com
  • 195.138.255.9
  • 195.138.255.11
whitelisted
api.bing.com
  • 13.107.13.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
r3.o.lencr.org
  • 195.138.255.16
  • 195.138.255.18
shared
r3.i.lencr.org
  • 23.45.105.185
whitelisted
x1.c.lencr.org
  • 23.45.105.185
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://adminkit.net/files/smtp_diag_tool/SMTP_Diag_Tool.zip