URL:

http://cmsmith.in/update_output93C0EBF.exe

Full analysis: https://app.any.run/tasks/999572a2-1f04-4f29-b833-45007f9d764f
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Analysis date: September 19, 2019, 11:06:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
keylogger
stealer
agenttesla
evasion
trojan
rat
Indicators:
MD5:

3FA2815F38849768A9EF9C399B284CD5

SHA1:

8A5176143D40F58DD04B62D782DA4E505EFFF407

SHA256:

1E034D75A8C3EDF4FAF8C225B1949ECF3232A65563E0994AA4DA467FC1136679

SSDEEP:

3:N1KdIHhD6KQ5WmVi34A:CKBmUiid

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 3236)
    • Application was dropped or rewritten from another process

      • update_output93C0EBF[1].exe (PID: 3680)
      • update_output93C0EBF[1].exe (PID: 2328)
      • update_output93C0EBF[1].exe (PID: 3640)
    • Changes the autorun value in the registry

      • update_output93C0EBF[1].exe (PID: 3640)
    • AGENTTESLA was detected

      • update_output93C0EBF[1].exe (PID: 3640)
    • Actions looks like stealing of personal data

      • update_output93C0EBF[1].exe (PID: 3640)
    • Changes settings of System certificates

      • update_output93C0EBF[1].exe (PID: 3640)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3236)
      • iexplore.exe (PID: 2760)
      • update_output93C0EBF[1].exe (PID: 3640)
    • Cleans NTFS data-stream (Zone Identifier)

      • update_output93C0EBF[1].exe (PID: 3640)
    • Creates files in the user directory

      • update_output93C0EBF[1].exe (PID: 3640)
    • Application launched itself

      • update_output93C0EBF[1].exe (PID: 2328)
    • Checks for external IP

      • update_output93C0EBF[1].exe (PID: 3640)
    • Reads the cookies of Mozilla Firefox

      • update_output93C0EBF[1].exe (PID: 3640)
    • Reads the cookies of Google Chrome

      • update_output93C0EBF[1].exe (PID: 3640)
    • Adds / modifies Windows certificates

      • update_output93C0EBF[1].exe (PID: 3640)
    • Connects to SMTP port

      • update_output93C0EBF[1].exe (PID: 3640)
  • INFO

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 2760)
      • iexplore.exe (PID: 3236)
      • update_output93C0EBF[1].exe (PID: 3640)
    • Creates files in the user directory

      • iexplore.exe (PID: 3236)
      • iexplore.exe (PID: 2760)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3236)
    • Changes internet zones settings

      • iexplore.exe (PID: 2760)
    • Application launched itself

      • iexplore.exe (PID: 2760)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start iexplore.exe iexplore.exe update_output93c0ebf[1].exe no specs update_output93c0ebf[1].exe #AGENTTESLA update_output93c0ebf[1].exe

Process information

PID
CMD
Path
Indicators
Parent process
2328"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\update_output93C0EBF[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\update_output93C0EBF[1].exe
iexplore.exe
User:
admin
Company:
Devastates7Foristell6
Integrity Level:
HIGH
Exit code:
0
Version:
6.03.0003
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\lh043oam\update_output93c0ebf[1].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2760"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3236"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2760 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3640"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\update_output93C0EBF[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\update_output93C0EBF[1].exe
update_output93C0EBF[1].exe
User:
admin
Company:
Devastates7Foristell6
Integrity Level:
HIGH
Exit code:
0
Version:
6.03.0003
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\lh043oam\update_output93c0ebf[1].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3680"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\update_output93C0EBF[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\update_output93C0EBF[1].exeiexplore.exe
User:
admin
Company:
Devastates7Foristell6
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
6.03.0003
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\lh043oam\update_output93c0ebf[1].exe
c:\systemroot\system32\ntdll.dll
Total events
697
Read events
617
Write events
77
Delete events
3

Modification events

(PID) Process:(2760) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2760) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2760) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2760) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2760) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2760) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2760) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{8E36BD79-DACD-11E9-B86F-5254004A04AF}
Value:
0
(PID) Process:(2760) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(2760) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
2
(PID) Process:(2760) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E3070900040013000B0006002900E301
Executable files
4
Suspicious files
2
Text files
8
Unknown types
7

Dropped files

PID
Process
Filename
Type
2760iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico
MD5:
SHA256:
2760iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
2760iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF8DA15ABD5530D87B.TMP
MD5:
SHA256:
2760iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF4B0E34ED15D06641.TMP
MD5:
SHA256:
2760iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{8E36BD79-DACD-11E9-B86F-5254004A04AF}.dat
MD5:
SHA256:
3640update_output93C0EBF[1].exeC:\Users\admin\AppData\Roaming\MyApp\MyApp.exe\:Zone.Identifier:$DATA
MD5:
SHA256:
3236iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WKF6ITU7\update_output93C0EBF[1].exeexecutable
MD5:
SHA256:
3640update_output93C0EBF[1].exeC:\Users\admin\AppData\Roaming\0023cuei.wjz\Chrome\Default\Cookies
MD5:
SHA256:
3640update_output93C0EBF[1].exeC:\Users\admin\AppData\Roaming\0023cuei.wjz\Firefox\Profiles\qldyz51w.default\cookies.sqlite
MD5:
SHA256:
3236iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
5
DNS requests
4
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3236
iexplore.exe
GET
200
192.185.117.234:80
http://cmsmith.in/update_output93C0EBF.exe
US
executable
936 Kb
malicious
2760
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3640
update_output93C0EBF[1].exe
GET
200
18.214.132.216:80
http://checkip.amazonaws.com/
US
text
15 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2760
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3236
iexplore.exe
192.185.117.234:80
cmsmith.in
CyrusOne LLC
US
malicious
3640
update_output93C0EBF[1].exe
18.214.132.216:80
checkip.amazonaws.com
US
shared
3640
update_output93C0EBF[1].exe
77.88.21.158:587
smtp.yandex.com
YANDEX LLC
RU
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
cmsmith.in
  • 192.185.117.234
malicious
checkip.amazonaws.com
  • 18.214.132.216
  • 18.205.71.63
  • 3.224.145.145
  • 34.196.181.158
  • 52.44.169.135
  • 52.55.255.113
malicious
smtp.yandex.com
  • 77.88.21.158
malicious

Threats

PID
Process
Class
Message
3236
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3640
update_output93C0EBF[1].exe
A Network Trojan was detected
MALWARE [PTsecurity] AgentTesla IP Check
3 ETPRO signatures available at the full report
No debug info