| File name: | ftp.exe |
| Full analysis: | https://app.any.run/tasks/ab90117c-e832-4619-88d5-14fd45281182 |
| Verdict: | Malicious activity |
| Analysis date: | November 14, 2024, 22:48:38 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (console) x86-64, for MS Windows, 7 sections |
| MD5: | 6DDE597B7AB3C5E0F49839B28EBCF61F |
| SHA1: | C3701EFD2BCBA54D0D4A8F9C8F554B8418D0F4D1 |
| SHA256: | 6C2BE822B20CEEEE4A3146E18E36109CB2FD61D9C3C5FFBBCE8BEFABB19960F4 |
| SSDEEP: | 98304:ySuZFhwtg3RfOFOp3ZyUuYA3w3Vc7E8coKSTdB9kUp5JUVXOhrAe/RMv9vs77Gxp:tbztwGWR5GCwY |
MALICIOUS
No malicious indicators.SUSPICIOUS
The process drops C-runtime libraries
- ftp.exe (PID: 6300)
Connects to FTP
- ftp.exe (PID: 6884)
Connects to unusual port
- ftp.exe (PID: 6884)
Process drops python dynamic module
- ftp.exe (PID: 6300)
Application launched itself
- ftp.exe (PID: 6300)
Process drops legitimate windows executable
- ftp.exe (PID: 6300)
Executable content was dropped or overwritten
- ftp.exe (PID: 6300)
INFO
Reads the computer name
- ftp.exe (PID: 6300)
- ftp.exe (PID: 6884)
Checks supported languages
- ftp.exe (PID: 6300)
- ftp.exe (PID: 6884)
Reads the machine GUID from the registry
- ftp.exe (PID: 6884)
Create files in a temporary directory
- ftp.exe (PID: 6300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2023:11:15 02:18:28+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.37 |
| CodeSize: | 171520 |
| InitializedDataSize: | 153088 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb680 |
| OSVersion: | 5.2 |
| ImageVersion: | - |
| SubsystemVersion: | 5.2 |
| Subsystem: | Windows command line |
Total processes
125
Monitored processes
4
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2888 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6236 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | ftp.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6300 | "C:\Users\admin\AppData\Local\Temp\ftp.exe" | C:\Users\admin\AppData\Local\Temp\ftp.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 6884 | "C:\Users\admin\AppData\Local\Temp\ftp.exe" | C:\Users\admin\AppData\Local\Temp\ftp.exe | ftp.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
Total events
371
Read events
371
Write events
0
Delete events
0
Modification events
Executable files
51
Suspicious files
1
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6300 | ftp.exe | C:\Users\admin\AppData\Local\Temp\_MEI63002\VCRUNTIME140.dll | executable | |
MD5:11D9AC94E8CB17BD23DEA89F8E757F18 | SHA256:E1D6F78A72836EA120BD27A33AE89CBDC3F3CA7D9D0231AAA3AAC91996D2FA4E | |||
| 6300 | ftp.exe | C:\Users\admin\AppData\Local\Temp\_MEI63002\_socket.pyd | executable | |
MD5:5DD51579FA9B6A06336854889562BEC0 | SHA256:3669E56E99AE3A944FBE7845F0BE05AEA96A603717E883D56A27DC356F8C2F2C | |||
| 6300 | ftp.exe | C:\Users\admin\AppData\Local\Temp\_MEI63002\api-ms-win-core-console-l1-1-0.dll | executable | |
MD5:A5D19084230A0A3CC3D8B28DD9105C30 | SHA256:6439C3B78EE318397BB2EE2729A914826F9E58C8DEC456CE74BC8CEA1C41D060 | |||
| 6300 | ftp.exe | C:\Users\admin\AppData\Local\Temp\_MEI63002\_ssl.pyd | executable | |
MD5:11C5008E0BA2CAA8ADF7452F0AAAFD1E | SHA256:BF63F44951F14C9D0C890415D013276498D6D59E53811BBE2FA16825710BEA14 | |||
| 6300 | ftp.exe | C:\Users\admin\AppData\Local\Temp\_MEI63002\api-ms-win-core-debug-l1-1-0.dll | executable | |
MD5:F57813D3B4B2669EE379C8D63D068507 | SHA256:7009A34534C64708F00117345BF577611747351F723969B50DB761DEFC9360F2 | |||
| 6300 | ftp.exe | C:\Users\admin\AppData\Local\Temp\_MEI63002\_hashlib.pyd | executable | |
MD5:CFB9E0A73A6C9D6D35C2594E52E15234 | SHA256:50DAEB3985302A8D85CE8167B0BF08B9DA43E7D51CEAE50E8E1CDFB0EDF218C6 | |||
| 6300 | ftp.exe | C:\Users\admin\AppData\Local\Temp\_MEI63002\api-ms-win-core-datetime-l1-1-0.dll | executable | |
MD5:88870D5E29A3C5297F3B7E69B7ECD74D | SHA256:9608C021164094322899E5799A86188891FA571A4E31B36888E256324C7D76BD | |||
| 6300 | ftp.exe | C:\Users\admin\AppData\Local\Temp\_MEI63002\api-ms-win-core-errorhandling-l1-1-0.dll | executable | |
MD5:EB8D19BE72B2B895F6C87A2E22E53F5C | SHA256:1B7F8ADD572D9CC81C2F5975230442240454DFA4CA047BA2B5B2B3FFB83A222D | |||
| 6300 | ftp.exe | C:\Users\admin\AppData\Local\Temp\_MEI63002\api-ms-win-core-file-l1-2-0.dll | executable | |
MD5:E0645FDDEF558DFDF2D89A2312D62CE5 | SHA256:55565231AAEFB87E36E20E8BC9E5F57A6CE60A91FFE2CC29711FB2DF70F17560 | |||
| 6300 | ftp.exe | C:\Users\admin\AppData\Local\Temp\_MEI63002\api-ms-win-core-file-l2-1-0.dll | executable | |
MD5:77493CA3FD4015B3900D4694715A92AD | SHA256:69D2E82663EC1BE7CEC2D20B82B353A7A4AC2B71474AA549B5308464273285CA | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
43
DNS requests
20
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5488 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5488 | MoUsoCoreWorker.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4004 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4956 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6860 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
4956 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5488 | MoUsoCoreWorker.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5488 | MoUsoCoreWorker.exe | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
— | — | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
— | — | 92.123.104.38:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
— | — | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
4020 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
ftp.us.debian.org |
| whitelisted |
login.live.com |
| whitelisted |
th.bing.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
6884 | ftp.exe | Misc activity | INFO [ANY.RUN] FTP server is ready for the new user |