analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://kcsoftwares.com/files/sumo_lite.exe

Full analysis: https://app.any.run/tasks/d9533783-9e1a-4c9f-bf1e-d65746a1aa4c
Verdict: Malicious activity
Analysis date: January 17, 2019, 20:22:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MD5:

E1A24CFD2C6FAB2DA60783D4841DF3A3

SHA1:

5E6276931D369BE311B13649494F6FBDA2787C6E

SHA256:

6A099BE79F603AACCD849B6C8600042529A36B1B2BFA277C2A0CAC3E55ADD182

SSDEEP:

3:N8DWY0EXGU0KYhAC:2KY0EWqC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • sumo_lite.exe (PID: 2680)
      • sumo_lite.exe (PID: 3508)
      • SUMo.exe (PID: 2684)

    • Changes settings of System certificates

      • explorer.exe (PID: 2028)

    • Loads dropped or rewritten executable

      • SUMo.exe (PID: 2684)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 2864)
      • sumo_lite.exe (PID: 3508)
      • sumo_lite.tmp (PID: 2320)
      • sumo_lite.exe (PID: 2680)

    • Creates files in the user directory

      • sumo_lite.tmp (PID: 2320)
      • SUMo.exe (PID: 2684)

    • Starts Internet Explorer

      • sumo_lite.tmp (PID: 2320)
      • SUMo.exe (PID: 2684)

    • Creates files in the program directory

      • iexplore.exe (PID: 3276)
      • SUMo.exe (PID: 2684)

    • Reads Internet Cache Settings

      • explorer.exe (PID: 2028)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 2864)

    • Reads CPU info

      • firefox.exe (PID: 2328)
      • firefox.exe (PID: 3188)
      • firefox.exe (PID: 2864)
      • firefox.exe (PID: 2448)

    • Creates files in the user directory

      • firefox.exe (PID: 2864)
      • iexplore.exe (PID: 3276)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 4084)
      • iexplore.exe (PID: 3956)
      • iexplore.exe (PID: 460)

    • Reads settings of System Certificates

      • firefox.exe (PID: 2864)
      • explorer.exe (PID: 2028)

    • Application was dropped or rewritten from another process

      • sumo_lite.tmp (PID: 2320)
      • sumo_lite.tmp (PID: 3988)

    • Loads dropped or rewritten executable

      • sumo_lite.tmp (PID: 2320)

    • Creates a software uninstall entry

      • sumo_lite.tmp (PID: 2320)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3276)

    • Changes internet zones settings

      • iexplore.exe (PID: 3956)
      • iexplore.exe (PID: 2816)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3276)

    • Creates files in the program directory

      • sumo_lite.tmp (PID: 2320)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3276)
      • iexplore.exe (PID: 460)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3956)
      • iexplore.exe (PID: 3276)
      • iexplore.exe (PID: 460)

    • Dropped object may contain Bitcoin addresses

      • firefox.exe (PID: 2864)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
15
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start firefox.exe firefox.exe firefox.exe firefox.exe explorer.exe sumo_lite.exe sumo_lite.tmp no specs sumo_lite.exe sumo_lite.tmp iexplore.exe iexplore.exe sumo.exe iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2864"C:\Program Files\Mozilla Firefox\firefox.exe" https://kcsoftwares.com/files/sumo_lite.exeC:\Program Files\Mozilla Firefox\firefox.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
61.0.2
2328"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2864.0.1912493366\281993157" -childID 1 -isForBrowser -prefsHandle 1436 -prefsLen 8310 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 1468 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
61.0.2
3188"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2864.6.1035454872\1876964700" -childID 2 -isForBrowser -prefsHandle 2484 -prefsLen 11442 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 2460 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
61.0.2
2448"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2864.12.1637329513\454577977" -childID 3 -isForBrowser -prefsHandle 3292 -prefsLen 12017 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 2908 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
61.0.2
2028C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2680"C:\Users\admin\Downloads\sumo_lite.exe" C:\Users\admin\Downloads\sumo_lite.exe
explorer.exe
User:
admin
Company:
KC Softwares
Integrity Level:
MEDIUM
Description:
KC Softwares SUMo Setup
Exit code:
0
Version:
5.8.11.414
3988"C:\Users\admin\AppData\Local\Temp\is-SLLNU.tmp\sumo_lite.tmp" /SL5="$40218,2106972,163328,C:\Users\admin\Downloads\sumo_lite.exe" C:\Users\admin\AppData\Local\Temp\is-SLLNU.tmp\sumo_lite.tmp—sumo_lite.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
3508"C:\Users\admin\Downloads\sumo_lite.exe" /SPAWNWND=$301F6 /NOTIFYWND=$40218 C:\Users\admin\Downloads\sumo_lite.exe
sumo_lite.tmp
User:
admin
Company:
KC Softwares
Integrity Level:
HIGH
Description:
KC Softwares SUMo Setup
Exit code:
0
Version:
5.8.11.414
2320"C:\Users\admin\AppData\Local\Temp\is-6FK2J.tmp\sumo_lite.tmp" /SL5="$401FC,2106972,163328,C:\Users\admin\Downloads\sumo_lite.exe" /SPAWNWND=$301F6 /NOTIFYWND=$40218 C:\Users\admin\AppData\Local\Temp\is-6FK2J.tmp\sumo_lite.tmp
sumo_lite.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
3956"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
sumo_lite.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
4 849
Read events
4 371
Write events
0
Delete events
0

Modification events

No data
Executable files
10
Suspicious files
122
Text files
134
Unknown types
47

Dropped files

PID
Process
Filename
Type
2864firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
2864firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
2864firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm —
MD5:—
SHA256:—
2864firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db-journal —
MD5:—
SHA256:—
2864firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\base-track-digest256.sbstorebinary
MD5:CD82F4495EAFE523B9B6B938C828611B
SHA256:576A0D2C3AD8D66BB202439B18F9FD563F92D9DDD9582A3C4CCE0ECAFD4F0908
2864firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:707C12070C52E55C2A996AC15E219B95
SHA256:6C5410C655C8EFC48D123ABE708C8940A4218072C0DAF85E03AB45DA6D2CE6B9
2864firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\entries\BBD167A1442C5043570BC75A1B6895C8885F0DA3der
MD5:C39A90A23D83E44F5A11086A00663784
SHA256:F60228600C2D47ED6C7ED42BA9EFEBB16E52C6E60E1BAE3D655BE01E3E370DF3
2864firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flash-digest256.sbstorebinary
MD5:0E8FE60CCD7E9B4C32589A5743A95302
SHA256:2B124D4026850A3CFFD28DBACB58AEC28F7DCD4D40BC14E52BBE96D60CE4E749
2864firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.dbsqlite
MD5:6E57E46010BFF4D41B47A104DE4B9348
SHA256:2364FC9E0385E8EDB85684F8672E53585421BD05E74DE3FF7B244B509769D7CD
2864firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\except-flash-digest256.sbstorebinary
MD5:C921D8E98FA01B4F303481E112202E92
SHA256:4EF1038730EC8BC7206713C29A936768831B922C5E6C83355FD62D7401D8C1DC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
49
TCP/UDP connections
64
DNS requests
62
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2864
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2864
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2864
firefox.exe
POST
200
2.16.186.11:80
http://ocsp.int-x3.letsencrypt.org/
unknown
der
527 b
whitelisted
460
iexplore.exe
GET
200
213.186.33.69:80
http://www.kcsoftwares.com/?page=dumo&showads
FR
html
5.80 Kb
malicious
2028
explorer.exe
GET
200
91.199.212.52:80
http://crt.comodoca.com/COMODORSAAddTrustCA.crt
GB
der
1.37 Kb
whitelisted
460
iexplore.exe
GET
200
213.186.33.69:80
http://www.kcsoftwares.com/images/kclogo.png
FR
image
1.15 Kb
malicious
2864
firefox.exe
POST
200
172.217.22.14:80
http://ocsp.pki.goog/GTSGIAG3
US
der
463 b
whitelisted
2864
firefox.exe
GET
200
2.16.186.50:80
http://detectportal.firefox.com/success.txt
unknown
text
8 b
whitelisted
460
iexplore.exe
GET
200
213.186.33.69:80
http://www.kcsoftwares.com/assets/js/jquery.js
FR
text
32.5 Kb
malicious
2864
firefox.exe
POST
200
172.217.22.14:80
http://ocsp.pki.goog/GTSGIAG3
US
der
463 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2864
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2864
firefox.exe
213.186.33.69:443
kcsoftwares.com
OVH SAS
FR
malicious
2864
firefox.exe
52.40.109.206:443
tiles.r53-2.services.mozilla.com
Amazon.com, Inc.
US
unknown
2864
firefox.exe
2.16.186.11:80
ocsp.int-x3.letsencrypt.org
Akamai International B.V.
—
whitelisted
2864
firefox.exe
2.16.186.50:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
2864
firefox.exe
34.216.89.123:443
search.r53-2.services.mozilla.com
Amazon.com, Inc.
US
unknown
2864
firefox.exe
172.217.22.14:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2028
explorer.exe
91.199.212.52:80
crt.comodoca.com
Comodo CA Ltd
GB
suspicious
3276
iexplore.exe
213.186.33.69:443
kcsoftwares.com
OVH SAS
FR
malicious
2864
firefox.exe
172.217.22.10:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
kcsoftwares.com
  • 213.186.33.69
whitelisted
detectportal.firefox.com
  • 2.16.186.50
  • 2.16.186.112
whitelisted
a1089.dscd.akamai.net
  • 2.16.186.112
  • 2.16.186.50
whitelisted
search.r53-2.services.mozilla.com
  • 52.89.32.107
  • 52.27.184.151
  • 34.216.89.123
whitelisted
search.services.mozilla.com
  • 34.216.89.123
  • 52.27.184.151
  • 52.89.32.107
whitelisted
ocsp.int-x3.letsencrypt.org
  • 2.16.186.11
  • 2.16.186.27
whitelisted
a771.dscq.akamai.net
  • 2.16.186.27
  • 2.16.186.11
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
cs9.wac.phicdn.net
  • 93.184.220.29
whitelisted
tiles.r53-2.services.mozilla.com
  • 34.216.156.21
  • 52.41.60.30
  • 52.34.107.172
  • 52.41.78.152
  • 52.39.131.77
  • 52.10.130.148
  • 52.25.70.97
  • 52.40.109.206
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://kcsoftwares.com/files/sumo_lite.exe