File name:

81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b

Full analysis: https://app.any.run/tasks/7c3fa461-e56e-4cc2-afff-e6a7c53ed82a
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Analysis date: January 10, 2025, 20:18:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
stealer
agenttesla
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

C63D82258F1FF64D0F21B6BC5C2BE1E5

SHA1:

1F270B930F58DACF5F18B2658191CA300283ADA0

SHA256:

81313224EE12F9A06F36E6F47F95F01B1BC30E94BF9C576F3C476B3633A0302B

SSDEEP:

49152:65pGmMAzeR8SnUtZKV2kfikbsEC/fzWREf402I:65JMAzediKV2kdbsECH6bY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 6408)
    • Executing a file with an untrusted certificate

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 5316)
      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 6408)
      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 2076)
    • Steals credentials from Web Browsers

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 5316)
    • Actions looks like stealing of personal data

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 5316)
    • AGENTTESLA has been detected (YARA)

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 5316)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 6408)
    • Executable content was dropped or overwritten

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 6408)
    • Application launched itself

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 6408)
    • Checks for external IP

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 5316)
      • svchost.exe (PID: 2192)
    • Connects to SMTP port

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 5316)
  • INFO

    • Creates files or folders in the user directory

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 6408)
    • Process checks computer location settings

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 6408)
    • Reads the machine GUID from the registry

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 6408)
      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 5316)
    • Create files in a temporary directory

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 6408)
    • Checks supported languages

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 6408)
      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 5316)
    • Reads the computer name

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 6408)
    • Disables trace logs

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 5316)
    • Checks proxy server information

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 5316)
    • Reads the software policy settings

      • 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe (PID: 5316)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

AssemblyVersion: 1.3.36.0
ProductVersion: 1.3.36.0
ProductName: Google Update
OriginalFileName: ChromeSetup.exe
LegalCopyright: Copyright 2018 Google LLC
InternalName: ChromeSetup.exe
FileVersion: 1.3.36.0
FileDescription: Google Update Setup
CompanyName: Google LLC
Comments: Google Update Setup
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.3.36.0
FileVersionNumber: 1.3.36.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0xe0bba
UninitializedDataSize: -
InitializedDataSize: 178688
CodeSize: 912384
LinkerVersion: 48
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2045:10:15 09:16:36+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
6
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe schtasks.exe no specs conhost.exe no specs 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe no specs #AGENTTESLA 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6408"C:\Users\admin\AppData\Local\Temp\81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe" C:\Users\admin\AppData\Local\Temp\81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Update Setup
Exit code:
0
Version:
1.3.36.0
Modules
Images
c:\users\admin\appdata\local\temp\81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7160"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\admin\AppData\Local\Temp\tmpB588.tmp"C:\Windows\SysWOW64\schtasks.exe81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
524\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeschtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2076"C:\Users\admin\AppData\Local\Temp\81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe"C:\Users\admin\AppData\Local\Temp\81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Update Setup
Exit code:
4294967295
Version:
1.3.36.0
Modules
Images
c:\users\admin\appdata\local\temp\81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5316"C:\Users\admin\AppData\Local\Temp\81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe"C:\Users\admin\AppData\Local\Temp\81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe
81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Update Setup
Version:
1.3.36.0
Modules
Images
c:\users\admin\appdata\local\temp\81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
1 585
Read events
1 571
Write events
14
Delete events
0

Modification events

(PID) Process:(5316) 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5316) 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5316) 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5316) 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5316) 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5316) 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5316) 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5316) 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5316) 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5316) 81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
640881313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exeC:\Users\admin\AppData\Local\Temp\tmpB588.tmpxml
MD5:2B9822ACD628466D2C9290CE5A27A7C1
SHA256:E6B840B92853C5F6ABC09F8147CBFB4CFA79B50683DD24D5F1CDC7D09C9B2A7B
640881313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exeC:\Users\admin\AppData\Roaming\qIQACwuR.exeexecutable
MD5:C63D82258F1FF64D0F21B6BC5C2BE1E5
SHA256:81313224EE12F9A06F36E6F47F95F01B1BC30E94BF9C576F3C476B3633A0302B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
32
DNS requests
21
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
4972
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
4972
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
6196
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
1176
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
2.23.227.208:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
login.live.com
  • 40.126.32.138
  • 40.126.32.72
  • 40.126.32.134
  • 20.190.160.20
  • 40.126.32.76
  • 40.126.32.140
  • 40.126.32.68
  • 20.190.160.14
whitelisted
www.bing.com
  • 2.23.227.208
  • 2.23.227.215
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

PID
Process
Class
Message
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
No debug info