Malware analysis sid.exe Malicious activity | ANY.RUN

Add for printing

File name:	sid.exe
Full analysis:	https://app.any.run/tasks/48a58f13-289e-4a03-ba4b-2624fb1049a0
Verdict:	Malicious activity
Analysis date:	May 10, 2024, 09:42:38
OS:	Ubuntu 22.04.2
MIME:	application/x-dosexec
File info:	PE32+ executable (console) x86-64, for MS Windows
MD5:	F39A1A34A38D3A0FB33E6719EC58E839
SHA1:	46A6EAA974D21063014CC7476BD53193A36A731F
SHA256:	513121CD3469A9CDC676EEF1631FFAFCD37AA9BB9B04D10D707AA026CB06B9CD
SSDEEP:	49152:XrjscASyavjOHZUWQIAspGQrGtZtLMvsyvxApx734x+u0Lc4aQwgrldflmGG9Z8E:PqTTJaTxrOWc4aQwgrlCIZz2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Checks DMI information (probably VM detection)
  - systemd-hostnamed (PID: 9290)
- Executes commands using command-line interpreter
  - gnome-terminal-server (PID: 9304)
  - apt (PID: 9338)
- Reads information about logins, logouts, and login attempts
  - bash (PID: 9322)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win64 Executable (generic) (87.3)
.exe	\|	Generic Win/DOS Executable (6.3)
.exe	\|	DOS Executable Generic (6.3)

EXIF

EXE

MachineType:	AMD AMD64
TimeStamp:	2023:05:07 02:55:50+00:00
ImageFileCharacteristics:	Executable, Large address aware
PEType:	PE32+
LinkerVersion:	12
CodeSize:	1219584
InitializedDataSize:	1114112
UninitializedDataSize:	-
EntryPoint:	0x2c9c
OSVersion:	5.2
ImageVersion:	-
SubsystemVersion:	5.2
Subsystem:	Windows command line

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

256

Monitored processes

33

Malicious processes

0

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
9272	/bin/sh -c "DISPLAY=:0 sudo -iu user nautilus /tmp/sid\.exe "	/bin/sh	—	any-guest-agent
User: user Integrity Level: UNKNOWN
9273	sudo -iu user nautilus /tmp/sid.exe	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN
9274	nautilus /tmp/sid.exe	/usr/bin/nautilus	—	sudo
User: user Integrity Level: UNKNOWN
9275	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	nautilus
User: user Integrity Level: UNKNOWN Exit code: 0
9290	/lib/systemd/systemd-hostnamed	/lib/systemd/systemd-hostnamed	—	systemd
User: root Integrity Level: UNKNOWN Exit code: 620
9297	/usr/bin/python3 /usr/bin/gnome-terminal	/usr/bin/gnome-terminal	—	gnome-shell
User: user Integrity Level: UNKNOWN Exit code: 9274
9299	/usr/bin/gnome-terminal.real	/usr/bin/gnome-terminal.real	—	gnome-terminal
User: user Integrity Level: UNKNOWN Exit code: 9274
9304	/usr/libexec/gnome-terminal-server	/usr/libexec/gnome-terminal-server	—	systemd
User: user Integrity Level: UNKNOWN
9322	bash	/bin/bash	—	gnome-terminal-server
User: user Integrity Level: UNKNOWN
9323	/bin/sh /usr/bin/lesspipe	/usr/bin/lesspipe	—	bash
User: user Integrity Level: UNKNOWN Exit code: 9274

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
9274	nautilus	/home/user/.local/share/nautilus/tags/meta.db-wal		—
		MD5:—	SHA256:—
9274	nautilus	/home/user/.local/share/nautilus/tags/meta.db-shm		—
		MD5:—	SHA256:—
9274	nautilus	/home/user/.local/share/nautilus/tags/.meta.isrunning		—
		MD5:—	SHA256:—
9338	apt	/var/cache/apt/archives/partial/.apt-acquire-privs-test.7DMF4k		—
		MD5:—	SHA256:—
9338	apt	/var/cache/apt/archives/partial/.apt-acquire-privs-test.HRV9Sa		—
		MD5:—	SHA256:—
9338	apt	/var/cache/apt/archives/partial/.apt-acquire-privs-test.WKwWqR		—
		MD5:—	SHA256:—
9338	apt	/var/cache/apt/archives/partial/.apt-acquire-privs-test.rH8z3z		—
		MD5:—	SHA256:—
9338	apt	/var/cache/apt/archives/partial/.apt-acquire-privs-test.ucYNVo		—
		MD5:—	SHA256:—
9338	apt	/var/cache/apt/archives/partial/.apt-acquire-privs-test.N5cGfR		—
		MD5:—	SHA256:—
9338	apt	/var/cache/apt/archives/partial/.apt-acquire-privs-test.dn8rGD		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

249

TCP/UDP connections

18

DNS requests

18

Threats

247

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.48:80	http://connectivity-check.ubuntu.com/	unknown	—	—	unknown
—	—	GET	—	91.189.91.83:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/g/gcc-12/libgcc-s1_12.3.0-1ubuntu1%7e22.04_i386.deb	unknown	—	—	unknown
—	—	GET	200	91.189.91.83:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/g/gcc-12/gcc-12-base_12.3.0-1ubuntu1%7e22.04_i386.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.83:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/libx/libxcrypt/libcrypt1_4.4.27-1_i386.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.83:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/g/glibc/libc6_2.35-0ubuntu3.5_i386.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.83:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/libc/libcap2/libcap2_2.44-1ubuntu0.22.04.1_i386.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.83:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/libg/libgpg-error/libgpg-error0_1.43-3_i386.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.83:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/libg/libgcrypt20/libgcrypt20_1.9.4-3ubuntu3_i386.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.83:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/l/lz4/liblz4-1_1.9.3-2build2_i386.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.83:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/x/xz-utils/liblzma5_5.2.5-2ubuntu1_i386.deb	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	91.189.91.48:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	unknown
—	—	185.125.190.97:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	unknown
—	—	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	91.189.91.83:80	ie.archive.ubuntu.com	Canonical Group Limited	US	unknown
—	—	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	91.189.91.81:80	ie.archive.ubuntu.com	Canonical Group Limited	US	unknown
—	—	185.125.190.39:80	ie.archive.ubuntu.com	Canonical Group Limited	GB	unknown
—	—	91.189.91.82:80	ie.archive.ubuntu.com	Canonical Group Limited	US	unknown

DNS requests

Domain	IP	Reputation
api.snapcraft.io	185.125.188.59 185.125.188.58 185.125.188.54 185.125.188.55	unknown
197.100.168.192.in-addr.arpa	—	unknown
connectivity-check.ubuntu.com	2620:2d:4002:1::197 2620:2d:4000:1::98 2001:67c:1562::24 2620:2d:4000:1::2a 2620:2d:4000:1::96 2620:2d:4000:1::97 2001:67c:1562::23 2620:2d:4000:1::22 2620:2d:4000:1::23 2620:2d:4000:1::2b 2620:2d:4002:1::196 2620:2d:4002:1::198 91.189.91.49 91.189.91.48 185.125.190.48 91.189.91.98 185.125.190.17 185.125.190.97 91.189.91.96 185.125.190.18 185.125.190.96 91.189.91.97 185.125.190.98 185.125.190.49	unknown
_http._tcp.ie.archive.ubuntu.com	—	unknown
ie.archive.ubuntu.com	91.189.91.83 91.189.91.81 185.125.190.39 91.189.91.82 185.125.190.36 2620:2d:4000:1::19 2620:2d:4002:1::103 2620:2d:4002:1::101 2620:2d:4000:1::16 2620:2d:4002:1::102	unknown

Threats

PID	Process	Class	Message
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management

Add for printing

No debug info

General Info

sid.exe

F39A1A34A38D3A0FB33E6719EC58E839

46A6EAA974D21063014CC7476BD53193A36A731F

513121CD3469A9CDC676EEF1631FFAFCD37AA9BB9B04D10D707AA026CB06B9CD

49152:XrjscASyavjOHZUWQIAspGQrGtZtLMvsyvxApx734x+u0Lc4aQwgrldflmGG9Z8E:PqTTJaTxrOWc4aQwgrlCIZz2

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Checks DMI information (probably VM detection)

Executes commands using command-line interpreter

Reads information about logins, logouts, and login attempts

INFO

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings