File name:

sempalong.exe

Full analysis: https://app.any.run/tasks/2db064a2-7594-4d21-84c3-9cace7baa784
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: November 12, 2023, 21:15:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
brontok
trojan
Indicators:
MIME: application/x-dosexec
File info: MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

483FCF432217D71544246AA760D98CDC

SHA1:

591B0EC52AD2A306F1CF8AF2FC04125642B1A00B

SHA256:

70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7

SSDEEP:

768:J/n/s4NzTSD5IZfRrbjOmd2VZX+DNxEUKbO5/Pd4PV2g1Q3qv35BMCV:JsgToKHSmdkIDNxfdPy35B

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • sempalong.exe (PID: 3128)
      • smss.exe (PID: 2900)

    • Changes appearance of the Explorer extensions

      • sempalong.exe (PID: 3128)
      • smss.exe (PID: 2900)
      • winlogon.exe (PID: 3504)
      • services.exe (PID: 3404)
      • lsass.exe (PID: 3528)
      • inetinfo.exe (PID: 3688)

    • Changes the autorun value in the registry

      • smss.exe (PID: 2900)
      • winlogon.exe (PID: 3504)
      • services.exe (PID: 3404)
      • lsass.exe (PID: 3528)
      • inetinfo.exe (PID: 3688)

    • Create files in the Startup directory

      • smss.exe (PID: 2900)

    • BRONTOK has been detected (SURICATA)

      • inetinfo.exe (PID: 3688)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • sempalong.exe (PID: 3128)

    • Creates executable files that already exist in Windows

      • sempalong.exe (PID: 3128)

    • Starts itself from another location

      • sempalong.exe (PID: 3128)
      • smss.exe (PID: 2900)

    • Reads the Internet Settings

      • inetinfo.exe (PID: 3688)

    • Checks Windows Trust Settings

      • inetinfo.exe (PID: 3688)

    • Reads security settings of Internet Explorer

      • inetinfo.exe (PID: 3688)

    • Reads settings of System Certificates

      • inetinfo.exe (PID: 3688)

  • INFO

    • Create files in a temporary directory

      • sempalong.exe (PID: 3128)
      • smss.exe (PID: 2900)
      • winlogon.exe (PID: 3504)
      • services.exe (PID: 3404)
      • lsass.exe (PID: 3528)
      • inetinfo.exe (PID: 3688)

    • Checks supported languages

      • sempalong.exe (PID: 3128)
      • smss.exe (PID: 2900)
      • winlogon.exe (PID: 3504)
      • services.exe (PID: 3404)
      • lsass.exe (PID: 3528)
      • inetinfo.exe (PID: 3688)
      • wmpnscfg.exe (PID: 1832)

    • Reads the computer name

      • sempalong.exe (PID: 3128)
      • smss.exe (PID: 2900)
      • winlogon.exe (PID: 3504)
      • services.exe (PID: 3404)
      • lsass.exe (PID: 3528)
      • inetinfo.exe (PID: 3688)
      • wmpnscfg.exe (PID: 1832)

    • Reads the machine GUID from the registry

      • sempalong.exe (PID: 3128)
      • smss.exe (PID: 2900)
      • winlogon.exe (PID: 3504)
      • services.exe (PID: 3404)
      • lsass.exe (PID: 3528)
      • inetinfo.exe (PID: 3688)
      • wmpnscfg.exe (PID: 1832)

    • Creates files or folders in the user directory

      • sempalong.exe (PID: 3128)
      • smss.exe (PID: 2900)
      • inetinfo.exe (PID: 3688)

    • Checks proxy server information

      • inetinfo.exe (PID: 3688)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Mew compressed Win32 Executable (88.8)
.exe | Win32 Executable (generic) (5.9)
.exe | Generic Win/DOS Executable (2.6)
.exe | DOS Executable Generic (2.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5.12
CodeSize: 512
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x2f4a6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
10
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sempalong.exe no specs explorer.exe no specs smss.exe winlogon.exe at.exe no specs services.exe at.exe no specs lsass.exe #BRONTOK inetinfo.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1832"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2424at /delete /yC:\Windows\System32\at.exe—smss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Schedule service command line interface
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\at.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\schedcli.dll
2900C:\Users\admin\AppData\Local\smss.exeC:\Users\admin\AppData\Local\smss.exe
sempalong.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\smss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3128"C:\Users\admin\AppData\Local\Temp\sempalong.exe" C:\Users\admin\AppData\Local\Temp\sempalong.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\sempalong.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3216explorer.exeC:\Windows\explorer.exe—sempalong.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3404C:\Users\admin\AppData\Local\services.exeC:\Users\admin\AppData\Local\services.exe
smss.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\services.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3412at 17:08 /every:M,T,W,Th,F,S,Su "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Brengkolang.com"C:\Windows\System32\at.exe—smss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Schedule service command line interface
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\at.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\schedcli.dll
3504C:\Users\admin\AppData\Local\winlogon.exeC:\Users\admin\AppData\Local\winlogon.exe
smss.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\winlogon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3528C:\Users\admin\AppData\Local\lsass.exeC:\Users\admin\AppData\Local\lsass.exe
smss.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\lsass.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3688C:\Users\admin\AppData\Local\inetinfo.exeC:\Users\admin\AppData\Local\inetinfo.exe
smss.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\inetinfo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
5 449
Read events
5 400
Write events
46
Delete events
3

Modification events

(PID) Process:(3128) sempalong.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:Hidden
Value:
1
(PID) Process:(3128) sempalong.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:HideFileExt
Value:
0
(PID) Process:(2900) smss.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Tok-Cirrhatus
Value:
"C:\Users\admin\AppData\Local\smss.exe"
(PID) Process:(2900) smss.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:Hidden
Value:
0
(PID) Process:(2900) smss.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:HideFileExt
Value:
1
(PID) Process:(2900) smss.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:ShowSuperHidden
Value:
0
(PID) Process:(3504) winlogon.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Tok-Cirrhatus
Value:
"C:\Users\admin\AppData\Local\smss.exe"
(PID) Process:(3504) winlogon.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:Hidden
Value:
0
(PID) Process:(3504) winlogon.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:HideFileExt
Value:
1
(PID) Process:(3504) winlogon.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:ShowSuperHidden
Value:
0
Executable files
8
Suspicious files
7
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2900smss.exeC:\Users\admin\AppData\Local\winlogon.exeexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
2900smss.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Brengkolang.comexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
2900smss.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pifexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
3128sempalong.exeC:\Users\admin\AppData\Local\lsass.exeexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
3128sempalong.exeC:\Users\admin\AppData\Local\smss.exeexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
2900smss.exeC:\Users\admin\AppData\Local\Temp\~DF9354286759EF8E6A.TMPbinary
MD5:891034AC9306EA21AA57C23D40ED64E2
SHA256:6AB40538EBA40362C25B0174189DB5C3C297B325C4116C229C105CF512ECF128
3128sempalong.exeC:\Users\admin\AppData\Local\services.exeexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
3128sempalong.exeC:\Users\admin\AppData\Local\csrss.exeexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
3688inetinfo.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3128sempalong.exeC:\Users\admin\AppData\Local\Temp\~DFEA21DA8DF8B1D15B.TMPbinary
MD5:891034AC9306EA21AA57C23D40ED64E2
SHA256:6AB40538EBA40362C25B0174189DB5C3C297B325C4116C229C105CF512ECF128
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
11
DNS requests
6
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3688
inetinfo.exe
GET
301
106.10.248.150:80
http://www.geocities.com/sbltlu3/IN12VLMLOLPD.txt
unknown
html
4.30 Kb
—
3688
inetinfo.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
unknown
binary
471 b
—
3688
inetinfo.exe
GET
200
8.238.206.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d19af1718ae57980
unknown
compressed
4.66 Kb
—
3688
inetinfo.exe
GET
301
74.6.231.21:80
http://yahoo.com/
unknown
text
8 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
unknown
3688
inetinfo.exe
13.50.184.192:80
www.geocities.com
AMAZON-02
SE
unknown
3688
inetinfo.exe
106.10.248.150:80
www.geocities.com
internet content provider
SG
unknown
3688
inetinfo.exe
74.6.231.21:80
yahoo.com
YAHOO-NE1
US
unknown
3688
inetinfo.exe
74.6.231.21:443
yahoo.com
YAHOO-NE1
US
unknown
3688
inetinfo.exe
8.238.206.254:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
3688
inetinfo.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
unknown

DNS requests

Domain
IP
Reputation
www.geocities.com
  • 13.50.184.192
  • 106.10.248.150
  • 74.6.136.150
  • 44.228.206.170
  • 54.161.105.65
  • 13.49.212.207
  • 34.225.127.72
  • 18.136.37.69
  • 124.108.115.100
  • 34.213.101.254
  • 98.136.103.23
  • 212.82.100.150
  • 13.251.69.97
unknown
dns.msftncsi.com
  • 131.107.255.255
unknown
yahoo.com
  • 74.6.231.21
  • 74.6.143.25
  • 98.137.11.164
  • 74.6.143.26
  • 74.6.231.20
  • 98.137.11.163
unknown
ctldl.windowsupdate.com
  • 8.238.206.254
  • 67.26.81.254
  • 67.26.139.254
  • 67.26.73.254
  • 8.248.145.254
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown
www.yahoo.com
  • 87.248.119.252
  • 87.248.119.251
unknown

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET MALWARE Brontok User-Agent Detected (Brontok.A3 Browser)
—
—
A Network Trojan was detected
ET MALWARE Brontok User-Agent Detected (Brontok.A3 Browser)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
sempalong.exe