Malware analysis 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30 Malicious activity

Add for printing

File name:	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30
Full analysis:	https://app.any.run/tasks/4b795fd4-28b6-42e7-9e39-e89fddcdff85
Verdict:	Malicious activity
Threats:	Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. Agent Tesla ist eine Spyware, die Informationen über die Aktionen ihrer Opfer sammelt, indem sie Tastatureingaben und Benutzerinteraktionen aufzeichnet. Sie wird auf der speziellen Website, auf der diese Malware verkauft wird, fälschlicherweise als legitime Software vermarktet. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	May 10, 2025, 03:06:08
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	stealer evasion smtp exfiltration agenttesla
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:	30833F0632F3EE8531CEDDC3A8992342
SHA1:	A834D486A6BD89B229EFC44D7A13F0E04D8FC287
SHA256:	94504751F5C82674DEE1B25F9729AB7E94646376ADFE98CC7F1C1508A75E0A30
SSDEEP:	49152:gV31g5xcYlY/tdTazlXwBtWwTXf3on/KwVFjcn21QQDzvX8HGz7Cb51mG:gHgStMtwHLTXfYSwVF11rUi7CWG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Executing a file with an untrusted certificate
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7344)
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7456)
- Steals credentials from Web Browsers
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7456)
- Actions looks like stealing of personal data
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7456)
- AGENTTESLA has been detected (YARA)
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7456)
- AGENTTESLA has been detected (SURICATA)
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7456)
SUSPICIOUS
- Connects to the server without a host name
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7456)
- Reads security settings of Internet Explorer
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7456)
- Executable content was dropped or overwritten
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7344)
- The process creates files with name similar to system file names
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7344)
- Malware-specific behavior (creating "System.dll" in Temp)
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7344)
- There is functionality for taking screenshot (YARA)
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7344)
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7456)
- Checks for external IP
  - svchost.exe (PID: 2196)
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7456)
- Contacting a server suspected of hosting an CnC
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7456)
- Connects to SMTP port
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7456)
- Application launched itself
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7344)
INFO
- Creates files or folders in the user directory
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7344)
- Reads the computer name
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7344)
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7456)
- The sample compiled with english language support
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7344)
- Reads the machine GUID from the registry
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7456)
- Disables trace logs
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7456)
- Checks supported languages
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7344)
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7456)
- Checks proxy server information
  - slui.exe (PID: 7852)
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7456)
- Reads the software policy settings
  - slui.exe (PID: 7852)
- Create files in a temporary directory
  - 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe (PID: 7344)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

AgentTesla

(PID) Process(7456) 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe

Protocolsmtp

Hostmail.rvoccte.com

Port587

Usernamenewfile@rvoccte.com

PasswordPJtiky;+*ayY

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2016:12:11 21:50:48+00:00
ImageFileCharacteristics:	No relocs, Executable, No line numbers, No symbols, 32-bit
PEType:	PE32
LinkerVersion:	6
CodeSize:	25088
InitializedDataSize:	141824
UninitializedDataSize:	2048
EntryPoint:	0x344a
OSVersion:	4
ImageVersion:	6
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	3.5.0.0
ProductVersionNumber:	3.5.0.0
FileFlagsMask:	0x0000
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Windows, Latin1
Comments:	betlerne forargelsers
FileDescription:	underprikningen sceniske
InternalName:	kavalkades.exe
LegalCopyright:	tidsskriftsamlingens
ProductName:	uskadeliggjorte folkepartier
ProductVersion:	3.5.0.0

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

125

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

2196

C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

services.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Host Process for Windows Services

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll

7344

"C:\Users\admin\AppData\Local\Temp\94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe"

C:\Users\admin\AppData\Local\Temp\94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Description:

underprikningen sceniske

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

7456

"C:\Users\admin\AppData\Local\Temp\94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe"

C:\Users\admin\AppData\Local\Temp\94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe

94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe

User:

admin

Integrity Level:

MEDIUM

Description:

underprikningen sceniske

Modules

Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll

AgentTesla

(PID) Process(7456) 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe

Protocolsmtp

Hostmail.rvoccte.com

Port587

Usernamenewfile@rvoccte.com

PasswordPJtiky;+*ayY

7852

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

Add for printing

Total events

2 446

Read events

1 980

Write events

466

Delete events

Modification events


(PID) Process:	(7344) 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Locales Approx
Operation:	write	Name:	C Langs
Value: u
(PID) Process:	(7344) 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	Key:	HKEY_CURRENT_USER\bolette\rabbitries\Nonreduction
Operation:	write	Name:	sammensnrer
Value: 8155
(PID) Process:	(7344) 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Locales Approx
Operation:	write	Name:	C Langs
Value: us
(PID) Process:	(7344) 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Locales Approx
Operation:	write	Name:	C Langs
Value: use
(PID) Process:	(7344) 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Locales Approx
Operation:	write	Name:	C Langs
Value: user
(PID) Process:	(7344) 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Locales Approx
Operation:	write	Name:	C Langs
Value: user3
(PID) Process:	(7344) 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Locales Approx
Operation:	write	Name:	C Langs
Value: user32
(PID) Process:	(7344) 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Locales Approx
Operation:	write	Name:	C Langs
Value: user32:
(PID) Process:	(7344) 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Locales Approx
Operation:	write	Name:	C Langs
Value: user32::
(PID) Process:	(7344) 94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Locales Approx
Operation:	write	Name:	C Langs
Value: user32::S

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
7344	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	C:\Users\admin\AppData\Local\Temp\Floatability234\Maltfabrikkens\Girted\Audient.Uni		binary
		MD5:F6E4FE4FA1D2894C1CB86A703C281016	SHA256:63A74CF7362DAC4A5A464A71E00BB39F4C36C6439EF879537B944CDEA45AE489
7344	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	C:\Users\admin\AppData\Local\Temp\nsoDA55.tmp		—
		MD5:—	SHA256:—
7344	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	C:\Users\admin\AppData\Local\Temp\Floatability234\Maltfabrikkens\Girted\Cafeteriaejerne163.udg		binary
		MD5:3CBA4D64B2824C589FC5F582F927CEA6	SHA256:8FEF897764629FCFED511E1728A52BBD21F4CE1CB42E5D2F840F0E1CE23B64BC
7344	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	C:\Users\admin\AppData\Local\Temp\Floatability234\Maltfabrikkens\Girted\Obliquenesses.ini		text
		MD5:385993D3A40ABD1835C34168E4CE5697	SHA256:876B36A02E99994C314C68481A53A4315C2DC35825452804FF928D71627DFE9E
7344	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	C:\Users\admin\AppData\Local\Temp\Floatability234\Maltfabrikkens\Girted\Adscendent.ini		text
		MD5:2CF1568F10CD21277118CFB796F4A53A	SHA256:0748DF31FCF357CE84A88DA30708DBCBC4F5D60846BD9422C4BD772C19547188
7344	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	C:\Users\admin\AppData\Local\Temp\Floatability234\Maltfabrikkens\Maltreatment\slagvolumeners\aakirkebyboen.ini		text
		MD5:3CD2895E391C9512F262364428DCA749	SHA256:F87F5C7937F3D8591A5B4DE2348AEE3C6A9E894C0D34A233F30B2E3658D56F43
7344	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	C:\Users\admin\AppData\Local\Temp\Floatability234\Maltfabrikkens\Girted\Hamburgerryg140.ini		text
		MD5:31ADB5B51F043396F300C551162610DE	SHA256:58DDF806A779D025EE5536D04031A4B54B1D38DB207B90822B1AD9A6CEBE6025
7344	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	C:\Users\admin\AppData\Local\Temp\Floatability234\Maltfabrikkens\Maltreatment\Rosvrdigst69.txt		text
		MD5:1DCB756BC971269FC0636CADF4BEEC90	SHA256:545BDCDA80DA5CAF14B2454448C4E9657A427D0313B600AA9DC3D1DBE5F8C942
7344	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	C:\Users\admin\AppData\Local\Temp\Floatability234\Maltfabrikkens\Girted\Nonhistoricalness49.jpg		image
		MD5:14BE28BB5C554627B928D87A10767E52	SHA256:D27084ADA390FF9057ACCADAFB0DA002A9634684A58A1C3CC600CCA4F39E192F
7344	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	C:\Users\admin\AppData\Local\Temp\Floatability234\Maltfabrikkens\Girted\Presumedly147.fly		binary
		MD5:6B6917A293B806150C17787C1E718FE6	SHA256:74BBBF0D4DE1D445A2F4A099DB217E245E2A6997DBBE3F8FA7468E63BE64D86C

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	200	2.16.2.24:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
7456	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	GET	200	208.95.112.1:80	http://ip-api.com/line/?fields=hosting	unknown	—	—	whitelisted
7592	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
7456	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	GET	200	192.3.176.134:80	http://192.3.176.134/zZhMVUfbRgMs102.bin	unknown	—	—	unknown
6544	svchost.exe	GET	200	2.17.190.73:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
—	—	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
7592	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
—	—	2.16.2.24:80	crl.microsoft.com	Akamai International B.V.	CZ	whitelisted
—	—	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
—	—	172.211.123.249:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
7592	SIHClient.exe	4.175.87.197:443	slscr.update.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
7592	SIHClient.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
7456	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	192.3.176.134:80	—	AS-COLOCROSSING	US	unknown
7592	SIHClient.exe	52.165.164.15:443	fe3cr.delivery.mp.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2	whitelisted
crl.microsoft.com	2.16.2.24 2.16.2.82	whitelisted
www.microsoft.com	184.30.21.171	whitelisted
google.com	142.250.186.174	whitelisted
client.wns.windows.com	172.211.123.249	whitelisted
slscr.update.microsoft.com	4.175.87.197	whitelisted
fe3cr.delivery.mp.microsoft.com	52.165.164.15	whitelisted
ip-api.com	208.95.112.1	whitelisted
mail.rvoccte.com	67.18.65.183	malicious
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted

Threats

PID	Process	Class	Message
7456	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	Potentially Bad Traffic	ET HUNTING Generic .bin download from Dotted Quad
2196	svchost.exe	Device Retrieving External IP Address Detected	INFO [ANY.RUN] External IP Check (ip-api .com)
7456	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	Device Retrieving External IP Address Detected	POLICY [ANY.RUN] External Hosting Lookup by ip-api
7456	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	Device Retrieving External IP Address Detected	ET INFO External IP Lookup ip-api.com
2196	svchost.exe	Device Retrieving External IP Address Detected	ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
7456	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	Misc activity	INFO [ANY.RUN] SMTP email client opens transfer with server (EHLO)
7456	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	Malware Command and Control Activity Detected	ET MALWARE MSIL/Kryptik.XSY Data Exfil via SMTP
7456	94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30.exe	A Network Trojan was detected	STEALER [ANY.RUN] AgentTesla Exfiltration SMTP (Base64 encoded)

Add for printing

No debug info

General Info

94504751f5c82674dee1b25f9729ab7e94646376adfe98cc7f1c1508a75e0a30

30833F0632F3EE8531CEDDC3A8992342

A834D486A6BD89B229EFC44D7A13F0E04D8FC287

94504751F5C82674DEE1B25F9729AB7E94646376ADFE98CC7F1C1508A75E0A30

49152:gV31g5xcYlY/tdTazlXwBtWwTXf3on/KwVFjcn21QQDzvX8HGz7Cb51mG:gHgStMtwHLTXfYSwVF11rUi7CWG

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Executing a file with an untrusted certificate

Steals credentials from Web Browsers

Actions looks like stealing of personal data

AGENTTESLA has been detected (YARA)

AGENTTESLA has been detected (SURICATA)

SUSPICIOUS

Connects to the server without a host name

Reads security settings of Internet Explorer

Executable content was dropped or overwritten

The process creates files with name similar to system file names

Malware-specific behavior (creating "System.dll" in Temp)

There is functionality for taking screenshot (YARA)

Checks for external IP

Contacting a server suspected of hosting an CnC

Connects to SMTP port

Application launched itself

INFO

Creates files or folders in the user directory

Reads the computer name

The sample compiled with english language support

Reads the machine GUID from the registry

Disables trace logs

Checks supported languages

Checks proxy server information

Reads the software policy settings

Create files in a temporary directory

Malware configuration

AgentTesla

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Malware configuration

AgentTesla

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings