analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://cmsmith.in/update_output93C0EBF.exe

Full analysis: https://app.any.run/tasks/999572a2-1f04-4f29-b833-45007f9d764f
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Analysis date: September 19, 2019, 11:06:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
keylogger
stealer
agenttesla
evasion
trojan
rat
Indicators:
MD5:

3FA2815F38849768A9EF9C399B284CD5

SHA1:

8A5176143D40F58DD04B62D782DA4E505EFFF407

SHA256:

1E034D75A8C3EDF4FAF8C225B1949ECF3232A65563E0994AA4DA467FC1136679

SSDEEP:

3:N1KdIHhD6KQ5WmVi34A:CKBmUiid

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • update_output93C0EBF[1].exe (PID: 2328)
      • update_output93C0EBF[1].exe (PID: 3680)
      • update_output93C0EBF[1].exe (PID: 3640)
    • Downloads executable files from the Internet

      • iexplore.exe (PID: 3236)
    • Changes the autorun value in the registry

      • update_output93C0EBF[1].exe (PID: 3640)
    • AGENTTESLA was detected

      • update_output93C0EBF[1].exe (PID: 3640)
    • Actions looks like stealing of personal data

      • update_output93C0EBF[1].exe (PID: 3640)
    • Changes settings of System certificates

      • update_output93C0EBF[1].exe (PID: 3640)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2760)
      • iexplore.exe (PID: 3236)
      • update_output93C0EBF[1].exe (PID: 3640)
    • Cleans NTFS data-stream (Zone Identifier)

      • update_output93C0EBF[1].exe (PID: 3640)
    • Application launched itself

      • update_output93C0EBF[1].exe (PID: 2328)
    • Creates files in the user directory

      • update_output93C0EBF[1].exe (PID: 3640)
    • Reads the cookies of Google Chrome

      • update_output93C0EBF[1].exe (PID: 3640)
    • Checks for external IP

      • update_output93C0EBF[1].exe (PID: 3640)
    • Reads the cookies of Mozilla Firefox

      • update_output93C0EBF[1].exe (PID: 3640)
    • Adds / modifies Windows certificates

      • update_output93C0EBF[1].exe (PID: 3640)
    • Connects to SMTP port

      • update_output93C0EBF[1].exe (PID: 3640)
  • INFO

    • Creates files in the user directory

      • iexplore.exe (PID: 3236)
      • iexplore.exe (PID: 2760)
    • Application launched itself

      • iexplore.exe (PID: 2760)
    • Changes internet zones settings

      • iexplore.exe (PID: 2760)
    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3236)
      • iexplore.exe (PID: 2760)
      • update_output93C0EBF[1].exe (PID: 3640)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start iexplore.exe iexplore.exe update_output93c0ebf[1].exe no specs update_output93c0ebf[1].exe #AGENTTESLA update_output93c0ebf[1].exe

Process information

PID
CMD
Path
Indicators
Parent process
2760"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3236"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2760 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3680"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\update_output93C0EBF[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\update_output93C0EBF[1].exeiexplore.exe
User:
admin
Company:
Devastates7Foristell6
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
6.03.0003
2328"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\update_output93C0EBF[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\update_output93C0EBF[1].exe
iexplore.exe
User:
admin
Company:
Devastates7Foristell6
Integrity Level:
HIGH
Exit code:
0
Version:
6.03.0003
3640"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\update_output93C0EBF[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\update_output93C0EBF[1].exe
update_output93C0EBF[1].exe
User:
admin
Company:
Devastates7Foristell6
Integrity Level:
HIGH
Version:
6.03.0003
Total events
697
Read events
617
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
2
Text files
8
Unknown types
7

Dropped files

PID
Process
Filename
Type
2760iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico
MD5:
SHA256:
2760iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
2760iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF8DA15ABD5530D87B.TMP
MD5:
SHA256:
2760iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF4B0E34ED15D06641.TMP
MD5:
SHA256:
2760iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{8E36BD79-DACD-11E9-B86F-5254004A04AF}.dat
MD5:
SHA256:
3640update_output93C0EBF[1].exeC:\Users\admin\AppData\Roaming\MyApp\MyApp.exe\:Zone.Identifier:$DATA
MD5:
SHA256:
3236iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:1A9F08F7E62A2556BE449724CDEEF5D0
SHA256:F28E6C5BAB7AB809107BAD91CBC0E798BC68724D5B7070DD44147E910C3DE20E
3236iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:2A4CD41216FBE2294F9086F6665C1B51
SHA256:F6BD7368D3C372A0E91BBA689EB5F6810AB1044D8D3CFB06C41D0C7E035F0D03
2760iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019091920190920\index.datdat
MD5:568E5202779D374D4218A940F4C5B0B0
SHA256:44F664EC3B24C7A437EE235CBE9D58C51DCCA1DD4F3A63258B42A6A055709784
3236iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WKF6ITU7\update_output93C0EBF[1].exeexecutable
MD5:6A35F77E03FFDBA0EDDCE35DAA3AFAF4
SHA256:BADC925E7F5AF0380D2D241E12BED66E8B4285A683F3A2A3EE46DB4DFA8E7597
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
5
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3236
iexplore.exe
GET
200
192.185.117.234:80
http://cmsmith.in/update_output93C0EBF.exe
US
executable
936 Kb
malicious
3640
update_output93C0EBF[1].exe
GET
200
18.214.132.216:80
http://checkip.amazonaws.com/
US
text
15 b
shared
2760
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2760
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3640
update_output93C0EBF[1].exe
18.214.132.216:80
checkip.amazonaws.com
US
shared
3640
update_output93C0EBF[1].exe
77.88.21.158:587
smtp.yandex.com
YANDEX LLC
RU
whitelisted
3236
iexplore.exe
192.185.117.234:80
cmsmith.in
CyrusOne LLC
US
malicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
cmsmith.in
  • 192.185.117.234
malicious
checkip.amazonaws.com
  • 18.214.132.216
  • 18.205.71.63
  • 3.224.145.145
  • 34.196.181.158
  • 52.44.169.135
  • 52.55.255.113
shared
smtp.yandex.com
  • 77.88.21.158
shared

Threats

PID
Process
Class
Message
3236
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3640
update_output93C0EBF[1].exe
A Network Trojan was detected
MALWARE [PTsecurity] AgentTesla IP Check
3 ETPRO signatures available at the full report
No debug info