File name:

Win32.AgentTesla.exe

Full analysis: https://app.any.run/tasks/efe56980-a092-4a61-83da-1abc69a5deaa
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: May 31, 2025, 01:32:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
agenttesla
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

2B294B3499D1CCE794BADFFC959B7618

SHA1:

9AA826795798948E8058E3FF1342D81D5D8EE4FA

SHA256:

699EC052ECC898BDBDAFEA0027C4AB44C3D01AE011C17745DD2B7FBDDAA077F3

SSDEEP:

12288:5qIrEFD09leQEA49darfr3/2AbitnVYE96ltRH:5AFD1A498H2Dm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Win32.AgentTesla.exe (PID: 2444)
      • xws.exe (PID: 568)

    • AGENTTESLA has been detected (YARA)

      • Win32.AgentTesla.exe (PID: 3500)

    • Actions looks like stealing of personal data

      • xws.exe (PID: 2228)

    • Steals credentials from Web Browsers

      • xws.exe (PID: 2228)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Win32.AgentTesla.exe (PID: 2444)
      • xws.exe (PID: 2228)

    • Application launched itself

      • Win32.AgentTesla.exe (PID: 2444)
      • xws.exe (PID: 568)

    • Checks for external IP

      • svchost.exe (PID: 1080)
      • Win32.AgentTesla.exe (PID: 3500)
      • svchost.exe (PID: 1116)
      • xws.exe (PID: 2228)

    • Reads the Internet Settings

      • Win32.AgentTesla.exe (PID: 3500)
      • eventvwr.exe (PID: 2772)
      • powershell.exe (PID: 3248)
      • sipnotify.exe (PID: 1816)
      • eventvwr.exe (PID: 2548)
      • powershell.exe (PID: 2580)
      • xws.exe (PID: 2228)

    • Reads security settings of Internet Explorer

      • Win32.AgentTesla.exe (PID: 3500)
      • xws.exe (PID: 2228)

    • Starts POWERSHELL.EXE for commands execution

      • eventvwr.exe (PID: 2772)
      • eventvwr.exe (PID: 2548)

    • Starts process via Powershell

      • powershell.exe (PID: 3248)
      • powershell.exe (PID: 2580)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 1816)
      • ctfmon.exe (PID: 1700)

    • The system shut down or reboot

      • Win32.AgentTesla.exe (PID: 3500)
      • xws.exe (PID: 2228)

    • Loads DLL from Mozilla Firefox

      • xws.exe (PID: 2228)

    • Accesses Microsoft Outlook profiles

      • xws.exe (PID: 2228)

  • INFO

    • Reads the computer name

      • Win32.AgentTesla.exe (PID: 2444)
      • Win32.AgentTesla.exe (PID: 3500)
      • Win32.AgentTesla.exe (PID: 3628)
      • IMEKLMG.EXE (PID: 1508)
      • xws.exe (PID: 568)
      • xws.exe (PID: 2228)
      • IMEKLMG.EXE (PID: 568)
      • xws.exe (PID: 2792)
      • Z09.exe (PID: 2952)

    • Create files in a temporary directory

      • Win32.AgentTesla.exe (PID: 2444)
      • xws.exe (PID: 2228)

    • Checks supported languages

      • Win32.AgentTesla.exe (PID: 2444)
      • Win32.AgentTesla.exe (PID: 3500)
      • Win32.AgentTesla.exe (PID: 3628)
      • IMEKLMG.EXE (PID: 1508)
      • xws.exe (PID: 568)
      • xws.exe (PID: 2228)
      • IMEKLMG.EXE (PID: 568)
      • xws.exe (PID: 2792)
      • Z09.exe (PID: 2952)

    • Reads the machine GUID from the registry

      • Win32.AgentTesla.exe (PID: 2444)
      • Win32.AgentTesla.exe (PID: 3500)
      • Win32.AgentTesla.exe (PID: 3628)
      • xws.exe (PID: 2228)
      • xws.exe (PID: 568)
      • xws.exe (PID: 2792)
      • Z09.exe (PID: 2952)

    • Launch of the file from Registry key

      • Win32.AgentTesla.exe (PID: 2444)
      • xws.exe (PID: 568)

    • Reads Environment values

      • Win32.AgentTesla.exe (PID: 3500)
      • xws.exe (PID: 2228)

    • Disables trace logs

      • Win32.AgentTesla.exe (PID: 3500)
      • xws.exe (PID: 2228)

    • Reads Windows Product ID

      • Win32.AgentTesla.exe (PID: 3500)
      • xws.exe (PID: 2228)

    • Process checks whether UAC notifications are on

      • Win32.AgentTesla.exe (PID: 3500)
      • IMEKLMG.EXE (PID: 1508)
      • IMEKLMG.EXE (PID: 568)
      • xws.exe (PID: 2228)

    • Reads security settings of Internet Explorer

      • eventvwr.exe (PID: 2772)
      • eventvwr.exe (PID: 2548)

    • The executable file from the user directory is run by the Powershell process

      • Win32.AgentTesla.exe (PID: 3628)
      • xws.exe (PID: 2792)

    • Manual execution by a user

      • IMEKLMG.EXE (PID: 1508)
      • IMEKLMG.EXE (PID: 568)
      • xws.exe (PID: 568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:01:16 08:15:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 435200
InitializedDataSize: 25088
UninitializedDataSize: -
EntryPoint: 0x6c2ce
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.9.1.5
ProductVersionNumber: 6.9.1.5
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Comverse Technology Kopl
CompanyName: Comverse Technology
FileDescription: Comverse Technology
FileVersion: 6.9.1.5
InternalName: Po160118.exe
LegalCopyright: (c) 2015Comverse Technology
OriginalFileName: Po160118.exe
ProductName: Comverse Technology Cemp Kopl
ProductVersion: 6.9.1.5
AssemblyVersion: 17.18.7.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
106
Monitored processes
21
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start win32.agenttesla.exe #AGENTTESLA win32.agenttesla.exe svchost.exe eventvwr.exe no specs eventvwr.exe powershell.exe no specs win32.agenttesla.exe no specs shutdown.exe no specs ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs xws.exe xws.exe eventvwr.exe no specs svchost.exe eventvwr.exe powershell.exe no specs xws.exe no specs shutdown.exe no specs z09.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
568"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
568"C:\Users\admin\AppData\Local\Temp\xws\xws.exe" C:\Users\admin\AppData\Local\Temp\xws\xws.exe
explorer.exe
User:
admin
Company:
Comverse Technology
Integrity Level:
MEDIUM
Description:
Comverse Technology
Exit code:
0
Version:
6.9.1.5
Modules
Images
c:\users\admin\appdata\local\temp\xws\xws.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1080C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1116C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1508"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
1700C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1816C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2228"C:\Users\admin\AppData\Local\Temp\xws\xws.exe"C:\Users\admin\AppData\Local\Temp\xws\xws.exe
xws.exe
User:
admin
Company:
Comverse Technology
Integrity Level:
MEDIUM
Description:
Comverse Technology
Version:
6.9.1.5
Modules
Images
c:\users\admin\appdata\local\temp\xws\xws.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2380"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exe—xws.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Event Viewer Snapin Launcher
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\eventvwr.exe
c:\windows\system32\ntdll.dll
2444"C:\Users\admin\AppData\Local\Temp\Win32.AgentTesla.exe" C:\Users\admin\AppData\Local\Temp\Win32.AgentTesla.exe
explorer.exe
User:
admin
Company:
Comverse Technology
Integrity Level:
MEDIUM
Description:
Comverse Technology
Exit code:
0
Version:
6.9.1.5
Modules
Images
c:\users\admin\appdata\local\temp\win32.agenttesla.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
9 319
Read events
9 218
Write events
92
Delete events
9

Modification events

(PID) Process:(2444) Win32.AgentTesla.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:xws
Value:
C:\Users\admin\AppData\Local\Temp\xws\xws.exe
(PID) Process:(1080) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet
Operation:writeName:{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
Value:
D4DA6DA8B86C
(PID) Process:(3500) Win32.AgentTesla.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Win32_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3500) Win32.AgentTesla.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Win32_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3500) Win32.AgentTesla.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Win32_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3500) Win32.AgentTesla.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Win32_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3500) Win32.AgentTesla.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Win32_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3500) Win32.AgentTesla.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Win32_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3500) Win32.AgentTesla.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Win32_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3500) Win32.AgentTesla.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Win32_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
2
Suspicious files
8
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
1116svchost.exeC:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb —
MD5:—
SHA256:—
2444Win32.AgentTesla.exeC:\Users\admin\AppData\Local\Temp\xws\xws.exeexecutable
MD5:2B294B3499D1CCE794BADFFC959B7618
SHA256:699EC052ECC898BDBDAFEA0027C4AB44C3D01AE011C17745DD2B7FBDDAA077F3
3248powershell.exeC:\Users\admin\AppData\Local\Temp\xwjslwug.kk5.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
3248powershell.exeC:\Users\admin\AppData\Local\Temp\oslptgmc.w1i.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1816sipnotify.exeC:\Users\admin\AppData\Local\Microsoft\Windows\SipNotify\eoscontent\styles.csstext
MD5:3383EEF350240253D7C2C2564381B3CB
SHA256:85443493D86D6D7FB0E07BC9705DFC9C858086FBA1B0E508092AB328D5F145E8
2580powershell.exeC:\Users\admin\AppData\Local\Temp\rrlyufzf.xar.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1116svchost.exeC:\Windows\System32\catroot2\edb.logbinary
MD5:ABCFF206506FFE07C82C5CFFB140F8A0
SHA256:E315EEC159A24C13B398046AB339605B59390CC1AC9A941797E15AA91D8E171F
1116svchost.exeC:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdbbinary
MD5:CA32B6956B652CB068FF62606C316EEB
SHA256:C1FBC51E06CB0C196B4E96F83A80D7D0D26B587B6979D6414AB16A4A70D405AB
2228xws.exeC:\Users\admin\AppData\Local\Temp\Z09.exeexecutable
MD5:AA5E9AF3F263B96805F14058605F21E9
SHA256:19FED10083A7B48930E5A4CAAB964B445A58FFE14D98B206FA96CCD7D928AE61
2580powershell.exeC:\Users\admin\AppData\Local\Temp\tcb1xe0u.3qp.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
14
DNS requests
4
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3500
Win32.AgentTesla.exe
GET
200
193.122.130.0:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
1816
sipnotify.exe
HEAD
503
104.102.43.250:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133931323739840000
unknown
—
—
whitelisted
2228
xws.exe
GET
200
193.122.130.0:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3500
Win32.AgentTesla.exe
193.122.130.0:80
checkip.dyndns.org
ORACLE-BMC-31898
US
whitelisted
1116
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1816
sipnotify.exe
104.102.43.250:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
DE
whitelisted
2228
xws.exe
193.122.130.0:80
checkip.dyndns.org
ORACLE-BMC-31898
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
checkip.dyndns.org
  • 193.122.130.0
  • 193.122.6.168
  • 132.226.8.169
  • 132.226.247.73
  • 158.101.44.242
whitelisted
query.prod.cms.rt.microsoft.com
  • 104.102.43.250
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
3500
Win32.AgentTesla.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
1116
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
2228
xws.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
—
—
Misc activity
INFO [ANY.RUN] SMTP email client opens transfer with server (EHLO)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Win32.AgentTesla.exe