File name:

272138ac60ea58d4b95bb5fad2e9574d73847e063b7a22a7be32b59b2b347445

Full analysis: https://app.any.run/tasks/998ccae8-fd69-4965-b42b-bc2fa352b65e
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Analysis date: January 10, 2025, 18:08:07
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
agenttesla
stealer
netreactor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

65ED14721B82072F5E937200CDF0778F

SHA1:

D6FFF1B262210EF4393F8631D7DF528DAF78723A

SHA256:

272138AC60EA58D4B95BB5FAD2E9574D73847E063B7A22A7BE32B59B2B347445

SSDEEP:

49152:kHlGAXWQkC2R/QORBt7QjFtmcaTH/vU4do9Pcjq1GvXB1sgPR8N32+Rr181vWDZG:VAGQX21RBt7QjTmcaTH/vU4do9Pcjq1K

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes the autorun value in the registry

      • RegSvcs.exe (PID: 6236)
    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 6236)
    • Steals credentials from Web Browsers

      • RegSvcs.exe (PID: 6236)
    • AGENTTESLA has been detected (YARA)

      • RegSvcs.exe (PID: 6236)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • RegSvcs.exe (PID: 6236)
    • Executable content was dropped or overwritten

      • RegSvcs.exe (PID: 6236)
    • Checks for external IP

      • svchost.exe (PID: 2192)
      • RegSvcs.exe (PID: 6236)
    • Connects to SMTP port

      • RegSvcs.exe (PID: 6236)
  • INFO

    • Disables trace logs

      • RegSvcs.exe (PID: 6236)
    • Reads mouse settings

      • 272138ac60ea58d4b95bb5fad2e9574d73847e063b7a22a7be32b59b2b347445.exe (PID: 6212)
    • Checks proxy server information

      • RegSvcs.exe (PID: 6236)
    • Checks supported languages

      • 272138ac60ea58d4b95bb5fad2e9574d73847e063b7a22a7be32b59b2b347445.exe (PID: 6212)
      • RegSvcs.exe (PID: 6236)
    • Reads the software policy settings

      • RegSvcs.exe (PID: 6236)
    • The sample compiled with english language support

      • 272138ac60ea58d4b95bb5fad2e9574d73847e063b7a22a7be32b59b2b347445.exe (PID: 6212)
      • RegSvcs.exe (PID: 6236)
    • The process uses the downloaded file

      • RegSvcs.exe (PID: 6236)
    • Creates files or folders in the user directory

      • RegSvcs.exe (PID: 6236)
    • Reads the machine GUID from the registry

      • RegSvcs.exe (PID: 6236)
    • .NET Reactor protector has been detected

      • RegSvcs.exe (PID: 6236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

CharacterSet: Unicode
LanguageCode: English (British)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 0.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x27dcd
UninitializedDataSize: -
InitializedDataSize: 609280
CodeSize: 581120
LinkerVersion: 12
PEType: PE32
ImageFileCharacteristics: Executable, Large address aware, 32-bit
TimeStamp: 2024:12:02 23:46:01+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
127
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start svchost.exe 272138ac60ea58d4b95bb5fad2e9574d73847e063b7a22a7be32b59b2b347445.exe no specs #AGENTTESLA regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6212"C:\Users\admin\AppData\Local\Temp\272138ac60ea58d4b95bb5fad2e9574d73847e063b7a22a7be32b59b2b347445.exe" C:\Users\admin\AppData\Local\Temp\272138ac60ea58d4b95bb5fad2e9574d73847e063b7a22a7be32b59b2b347445.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\272138ac60ea58d4b95bb5fad2e9574d73847e063b7a22a7be32b59b2b347445.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6236"C:\Users\admin\AppData\Local\Temp\272138ac60ea58d4b95bb5fad2e9574d73847e063b7a22a7be32b59b2b347445.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
272138ac60ea58d4b95bb5fad2e9574d73847e063b7a22a7be32b59b2b347445.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\syswow64\sspicli.dll
c:\windows\syswow64\rasapi32.dll
c:\windows\syswow64\rasman.dll
c:\windows\syswow64\rtutils.dll
c:\windows\syswow64\mswsock.dll
c:\windows\syswow64\winhttp.dll
c:\windows\syswow64\ondemandconnroutehelper.dll
c:\windows\syswow64\iphlpapi.dll
c:\windows\syswow64\nsi.dll
c:\windows\syswow64\dhcpcsvc6.dll
Total events
1 039
Read events
1 023
Write events
16
Delete events
0

Modification events

(PID) Process:(6236) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6236) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6236) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6236) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6236) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6236) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6236) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6236) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6236) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6236) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6212272138ac60ea58d4b95bb5fad2e9574d73847e063b7a22a7be32b59b2b347445.exeC:\Users\admin\AppData\Local\Temp\aut599D.tmpbinary
MD5:AC74178DA42F21166D5322C06278A6A8
SHA256:3CE4CDCD803C78E801CF7130176CD4F03670B56137D49061C629D5BD00B7706C
6212272138ac60ea58d4b95bb5fad2e9574d73847e063b7a22a7be32b59b2b347445.exeC:\Users\admin\AppData\Local\Temp\tilthsbinary
MD5:ABB56729299D1690A0D9A2E798A2779F
SHA256:3EFE9E79494E6CDE83562D2C463082504A23CA54BC4EF445B9329093B0D18266
6236RegSvcs.exeC:\Users\admin\AppData\Roaming\Ycdwx\Ycdwx.exeexecutable
MD5:6279D136310C22894F605938B4CB93D8
SHA256:FB7D514B3322810463655473D2D7C704D3405C1C9DD81F0D4D423518EF416987
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
37
DNS requests
20
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
900
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
900
svchost.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6092
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
6992
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
900
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
900
svchost.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
5064
SearchApp.exe
92.123.104.31:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.147
  • 23.48.23.146
  • 23.48.23.138
  • 23.48.23.141
  • 23.48.23.150
  • 23.48.23.137
  • 23.48.23.156
  • 23.48.23.140
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
www.bing.com
  • 92.123.104.31
  • 92.123.104.32
  • 92.123.104.34
  • 92.123.104.33
  • 92.123.104.62
  • 92.123.104.38
  • 92.123.104.63
whitelisted
login.live.com
  • 20.190.160.14
  • 40.126.32.74
  • 40.126.32.136
  • 40.126.32.134
  • 20.190.160.17
  • 40.126.32.133
  • 40.126.32.76
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 69.192.162.125
whitelisted
api.ipify.org
  • 104.26.12.205
  • 104.26.13.205
  • 172.67.74.152
shared
mail.elec-qatar.com
  • 50.87.139.143
malicious

Threats

PID
Process
Class
Message
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
No debug info