File name:

sempalong.exe

Full analysis: https://app.any.run/tasks/2db064a2-7594-4d21-84c3-9cace7baa784
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: November 12, 2023, 21:15:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
brontok
trojan
Indicators:
MIME: application/x-dosexec
File info: MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

483FCF432217D71544246AA760D98CDC

SHA1:

591B0EC52AD2A306F1CF8AF2FC04125642B1A00B

SHA256:

70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7

SSDEEP:

768:J/n/s4NzTSD5IZfRrbjOmd2VZX+DNxEUKbO5/Pd4PV2g1Q3qv35BMCV:JsgToKHSmdkIDNxfdPy35B

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • sempalong.exe (PID: 3128)
      • smss.exe (PID: 2900)

    • Changes appearance of the Explorer extensions

      • sempalong.exe (PID: 3128)
      • winlogon.exe (PID: 3504)
      • services.exe (PID: 3404)
      • smss.exe (PID: 2900)
      • lsass.exe (PID: 3528)
      • inetinfo.exe (PID: 3688)

    • Changes the autorun value in the registry

      • smss.exe (PID: 2900)
      • winlogon.exe (PID: 3504)
      • services.exe (PID: 3404)
      • lsass.exe (PID: 3528)
      • inetinfo.exe (PID: 3688)

    • Create files in the Startup directory

      • smss.exe (PID: 2900)

    • BRONTOK has been detected (SURICATA)

      • inetinfo.exe (PID: 3688)

  • SUSPICIOUS

    • Creates executable files that already exist in Windows

      • sempalong.exe (PID: 3128)

    • The process creates files with name similar to system file names

      • sempalong.exe (PID: 3128)

    • Starts itself from another location

      • sempalong.exe (PID: 3128)
      • smss.exe (PID: 2900)

    • Reads the Internet Settings

      • inetinfo.exe (PID: 3688)

    • Reads security settings of Internet Explorer

      • inetinfo.exe (PID: 3688)

    • Checks Windows Trust Settings

      • inetinfo.exe (PID: 3688)

    • Reads settings of System Certificates

      • inetinfo.exe (PID: 3688)

  • INFO

    • Reads the computer name

      • sempalong.exe (PID: 3128)
      • smss.exe (PID: 2900)
      • winlogon.exe (PID: 3504)
      • services.exe (PID: 3404)
      • inetinfo.exe (PID: 3688)
      • lsass.exe (PID: 3528)
      • wmpnscfg.exe (PID: 1832)

    • Reads the machine GUID from the registry

      • sempalong.exe (PID: 3128)
      • smss.exe (PID: 2900)
      • services.exe (PID: 3404)
      • winlogon.exe (PID: 3504)
      • inetinfo.exe (PID: 3688)
      • lsass.exe (PID: 3528)
      • wmpnscfg.exe (PID: 1832)

    • Checks supported languages

      • sempalong.exe (PID: 3128)
      • smss.exe (PID: 2900)
      • services.exe (PID: 3404)
      • lsass.exe (PID: 3528)
      • winlogon.exe (PID: 3504)
      • inetinfo.exe (PID: 3688)
      • wmpnscfg.exe (PID: 1832)

    • Creates files or folders in the user directory

      • sempalong.exe (PID: 3128)
      • smss.exe (PID: 2900)
      • inetinfo.exe (PID: 3688)

    • Create files in a temporary directory

      • sempalong.exe (PID: 3128)
      • smss.exe (PID: 2900)
      • winlogon.exe (PID: 3504)
      • services.exe (PID: 3404)
      • inetinfo.exe (PID: 3688)
      • lsass.exe (PID: 3528)

    • Checks proxy server information

      • inetinfo.exe (PID: 3688)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Mew compressed Win32 Executable (88.8)
.exe | Win32 Executable (generic) (5.9)
.exe | Generic Win/DOS Executable (2.6)
.exe | DOS Executable Generic (2.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5.12
CodeSize: 512
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x2f4a6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
10
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sempalong.exe no specs explorer.exe no specs smss.exe winlogon.exe at.exe no specs services.exe at.exe no specs lsass.exe #BRONTOK inetinfo.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1832"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2424at /delete /yC:\Windows\System32\at.exe—smss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Schedule service command line interface
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\at.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\schedcli.dll
2900C:\Users\admin\AppData\Local\smss.exeC:\Users\admin\AppData\Local\smss.exe
sempalong.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\smss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3128"C:\Users\admin\AppData\Local\Temp\sempalong.exe" C:\Users\admin\AppData\Local\Temp\sempalong.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\sempalong.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3216explorer.exeC:\Windows\explorer.exe—sempalong.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3404C:\Users\admin\AppData\Local\services.exeC:\Users\admin\AppData\Local\services.exe
smss.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\services.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3412at 17:08 /every:M,T,W,Th,F,S,Su "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Brengkolang.com"C:\Windows\System32\at.exe—smss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Schedule service command line interface
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\at.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\schedcli.dll
3504C:\Users\admin\AppData\Local\winlogon.exeC:\Users\admin\AppData\Local\winlogon.exe
smss.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\winlogon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3528C:\Users\admin\AppData\Local\lsass.exeC:\Users\admin\AppData\Local\lsass.exe
smss.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\lsass.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3688C:\Users\admin\AppData\Local\inetinfo.exeC:\Users\admin\AppData\Local\inetinfo.exe
smss.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\inetinfo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
5 449
Read events
5 400
Write events
46
Delete events
3

Modification events

(PID) Process:(3128) sempalong.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:Hidden
Value:
1
(PID) Process:(3128) sempalong.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:HideFileExt
Value:
0
(PID) Process:(2900) smss.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Tok-Cirrhatus
Value:
"C:\Users\admin\AppData\Local\smss.exe"
(PID) Process:(2900) smss.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:Hidden
Value:
0
(PID) Process:(2900) smss.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:HideFileExt
Value:
1
(PID) Process:(2900) smss.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:ShowSuperHidden
Value:
0
(PID) Process:(3504) winlogon.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Tok-Cirrhatus
Value:
"C:\Users\admin\AppData\Local\smss.exe"
(PID) Process:(3504) winlogon.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:Hidden
Value:
0
(PID) Process:(3504) winlogon.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:HideFileExt
Value:
1
(PID) Process:(3504) winlogon.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:ShowSuperHidden
Value:
0
Executable files
8
Suspicious files
7
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3128sempalong.exeC:\Users\admin\AppData\Local\smss.exeexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
2900smss.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Brengkolang.comexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
3128sempalong.exeC:\Users\admin\AppData\Local\lsass.exeexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
2900smss.exeC:\Users\admin\AppData\Local\Temp\~DF9354286759EF8E6A.TMPbinary
MD5:891034AC9306EA21AA57C23D40ED64E2
SHA256:6AB40538EBA40362C25B0174189DB5C3C297B325C4116C229C105CF512ECF128
2900smss.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pifexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
2900smss.exeC:\Users\admin\AppData\Local\winlogon.exeexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
3688inetinfo.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:044A4E6B2AEC2428C32EACF778BB3DC9
SHA256:CDB4A20AABBABD728589F834927D3001148B37532A43EF70A84B18BDAD08D86D
3128sempalong.exeC:\Users\admin\AppData\Local\csrss.exeexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
3688inetinfo.exeC:\Users\admin\AppData\Local\Update.12.Bron.Tok.binhtml
MD5:487E8A47F453F31F6F7CEAB2C73B96F2
SHA256:35C5FCC6939FCAC15ADE7DC6581FA0CFCD6E18DC06EC68A1C58F819F5BF1CE8E
3688inetinfo.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABbinary
MD5:8B7E927525823246E00B9AFA15C7E2FD
SHA256:5E50ACBB2A28FD63A9C8B922A020A218636A44B29879EE16A948E6FB356B7814
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
11
DNS requests
6
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3688
inetinfo.exe
GET
301
106.10.248.150:80
http://www.geocities.com/sbltlu3/IN12VLMLOLPD.txt
unknown
html
4.30 Kb
unknown
3688
inetinfo.exe
GET
200
8.238.206.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d19af1718ae57980
unknown
compressed
4.66 Kb
unknown
3688
inetinfo.exe
GET
301
74.6.231.21:80
http://yahoo.com/
unknown
text
8 b
unknown
3688
inetinfo.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3688
inetinfo.exe
13.50.184.192:80
www.geocities.com
AMAZON-02
SE
unknown
3688
inetinfo.exe
106.10.248.150:80
www.geocities.com
internet content provider
SG
unknown
3688
inetinfo.exe
74.6.231.21:80
yahoo.com
YAHOO-NE1
US
unknown
3688
inetinfo.exe
74.6.231.21:443
yahoo.com
YAHOO-NE1
US
unknown
3688
inetinfo.exe
8.238.206.254:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
3688
inetinfo.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
www.geocities.com
  • 13.50.184.192
  • 106.10.248.150
  • 74.6.136.150
  • 44.228.206.170
  • 54.161.105.65
  • 13.49.212.207
  • 34.225.127.72
  • 18.136.37.69
  • 124.108.115.100
  • 34.213.101.254
  • 98.136.103.23
  • 212.82.100.150
  • 13.251.69.97
malicious
dns.msftncsi.com
  • 131.107.255.255
shared
yahoo.com
  • 74.6.231.21
  • 74.6.143.25
  • 98.137.11.164
  • 74.6.143.26
  • 74.6.231.20
  • 98.137.11.163
whitelisted
ctldl.windowsupdate.com
  • 8.238.206.254
  • 67.26.81.254
  • 67.26.139.254
  • 67.26.73.254
  • 8.248.145.254
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.yahoo.com
  • 87.248.119.252
  • 87.248.119.251
whitelisted

Threats

PID
Process
Class
Message
3688
inetinfo.exe
A Network Trojan was detected
ET MALWARE Brontok User-Agent Detected (Brontok.A3 Browser)
3688
inetinfo.exe
A Network Trojan was detected
ET MALWARE Brontok User-Agent Detected (Brontok.A3 Browser)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sempalong.exe