File name: | 9f7c34469ab0fbcd3a758d055109672cbed9a798eadcad054d0cc63179334b73 |
Full analysis: | https://app.any.run/tasks/c2d420aa-8768-479c-8ebf-ab066d6abbcf |
Verdict: | Malicious activity |
Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
Analysis date: | January 11, 2025, 01:22:44 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
MD5: | 92523788EB65970BF61B471DAF0972DF |
SHA1: | 2DC3CB43DFF6A8B3719E0C727973FDEE3D019E4F |
SHA256: | 9F7C34469AB0FBCD3A758D055109672CBED9A798EADCAD054D0CC63179334B73 |
SSDEEP: | 24576:azNDJm6B8KY1EykcNydZQrt5RcLkeS61fusLdLP:cNDM6B8KSEykcNydZQrt5RcLkeS61fu0 |
.exe | | | Win64 Executable (generic) (64.6) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (15.4) |
.exe | | | Win32 Executable (generic) (10.5) |
.exe | | | Generic Win/DOS Executable (4.6) |
.exe | | | DOS Executable Generic (4.6) |
AssemblyVersion: | 2.41.5.120 |
---|---|
ProductVersion: | 2.41.5.120 |
ProductName: | IpBusEnum |
OriginalFileName: | IpBusEnum.exe |
LegalCopyright: | Copyright © 2017 |
InternalName: | IpBusEnum.exe |
FileVersion: | 2.41.5.120 |
FileDescription: | IpBusEnum |
CompanyName: | Peakbrick |
Comments: | Genuine Software Integrity Service |
CharacterSet: | Unicode |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 2.41.5.120 |
FileVersionNumber: | 2.41.5.120 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x6d71e |
UninitializedDataSize: | - |
InitializedDataSize: | 61952 |
CodeSize: | 440320 |
LinkerVersion: | 8 |
PEType: | PE32 |
ImageFileCharacteristics: | Executable, 32-bit |
TimeStamp: | 2017:03:22 06:00:55+00:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
4328 | "C:\Users\admin\Desktop\9f7c34469ab0fbcd3a758d055109672cbed9a798eadcad054d0cc63179334b73.exe" | C:\Users\admin\Desktop\9f7c34469ab0fbcd3a758d055109672cbed9a798eadcad054d0cc63179334b73.exe | explorer.exe | ||||||||||||
User: admin Company: Peakbrick Integrity Level: MEDIUM Description: IpBusEnum Exit code: 4294967295 Version: 2.41.5.120 Modules
| |||||||||||||||
5640 | "C:\Users\admin\AppData\Roaming\app.exe" | C:\Users\admin\AppData\Roaming\app.exe | 9f7c34469ab0fbcd3a758d055109672cbed9a798eadcad054d0cc63179334b73.exe | ||||||||||||
User: admin Company: Peakbrick Integrity Level: MEDIUM Description: IpBusEnum Version: 2.41.5.120 Modules
| |||||||||||||||
3984 | "C:\Users\admin\AppData\Roaming\app.exe" | C:\Users\admin\AppData\Roaming\app.exe | — | app.exe | |||||||||||
User: admin Company: Peakbrick Integrity Level: MEDIUM Description: IpBusEnum Version: 2.41.5.120 Modules
| |||||||||||||||
2164 | "C:\Users\admin\AppData\Roaming\My.RawFile.exe" | C:\Users\admin\AppData\Roaming\My.RawFile.exe | app.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Version: 0.0.0.0 Modules
| |||||||||||||||
2092 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe | — | app.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: aspnet_compiler.exe Exit code: 0 Version: 2.0.50727.9149 (WinRelRS6.050727-9100) Modules
| |||||||||||||||
4052 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe | — | app.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: aspnet_compiler.exe Exit code: 0 Version: 2.0.50727.9149 (WinRelRS6.050727-9100) Modules
| |||||||||||||||
2192 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
|
(PID) Process: | (4328) 9f7c34469ab0fbcd3a758d055109672cbed9a798eadcad054d0cc63179334b73.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
Operation: | write | Name: | Application |
Value: C:\Users\admin\AppData\Roaming\app.exe | |||
(PID) Process: | (2164) My.RawFile.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (2164) My.RawFile.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (2164) My.RawFile.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (2164) My.RawFile.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\My_RASAPI32 |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (2164) My.RawFile.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\My_RASAPI32 |
Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
(PID) Process: | (2164) My.RawFile.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\My_RASAPI32 |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
(PID) Process: | (2164) My.RawFile.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\My_RASAPI32 |
Operation: | write | Name: | FileTracingMask |
Value: | |||
(PID) Process: | (2164) My.RawFile.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\My_RASAPI32 |
Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
(PID) Process: | (2164) My.RawFile.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\My_RASAPI32 |
Operation: | write | Name: | MaxFileSize |
Value: 1048576 |
PID | Process | Filename | Type | |
---|---|---|---|---|
5640 | app.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FE | binary | |
MD5:FA84E4BCC92AA5DB735AB50711040CDE | SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33 | |||
4328 | 9f7c34469ab0fbcd3a758d055109672cbed9a798eadcad054d0cc63179334b73.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7396C420A8E1BC1DA97F1AF0D10BAD21 | binary | |
MD5:77BD31C48D18DA002182AFC3A5347030 | SHA256:9D1742E33CB2CFBC0C2D9AC67A4BDB43DC888081E9D5F93483BF7983025936ED | |||
4328 | 9f7c34469ab0fbcd3a758d055109672cbed9a798eadcad054d0cc63179334b73.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD | binary | |
MD5:6872FAE8288DB34207D9E7EE350157F4 | SHA256:50795B027E2BC566D3B7ACB89913F8EFD23B70615C9DB9BF5B23323AD3132A7D | |||
5640 | app.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C0018BB1B5834735BFA60CD063B31956 | binary | |
MD5:30DBFBCB3436F667EDCB7384C21BBCC7 | SHA256:20B4B82E0D04962B350BD77B7F66A6FBCD2560AA52752018F8DF8125AC3DE9AD | |||
2164 | My.RawFile.exe | C:\Users\admin\AppData\Local\Temp\tmpG898.tmp | executable | |
MD5:5A733EF0DE5E31E2E4B4ABB016C0F251 | SHA256:A80C77CA694ECA3F6629C54572ABA811E64B61975C5DB2FF38C8D662D12B1CE7 | |||
4328 | 9f7c34469ab0fbcd3a758d055109672cbed9a798eadcad054d0cc63179334b73.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD | binary | |
MD5:2B715EB414877829F75940CE84CA8F3B | SHA256:94C867C98DE7B627AA2667C11D939BE702DD43F364252D6A9A225D64A894621B | |||
4328 | 9f7c34469ab0fbcd3a758d055109672cbed9a798eadcad054d0cc63179334b73.exe | C:\Users\admin\AppData\Roaming\app.exe | executable | |
MD5:92523788EB65970BF61B471DAF0972DF | SHA256:9F7C34469AB0FBCD3A758D055109672CBED9A798EADCAD054D0CC63179334B73 | |||
4328 | 9f7c34469ab0fbcd3a758d055109672cbed9a798eadcad054d0cc63179334b73.exe | C:\Users\admin\AppData\Roaming\app_signed.exe | executable | |
MD5:30461FA66A31AEE675F3F6D3C0F3A7A1 | SHA256:94A3025C213D9DFD68A6EE163D63D7392817828141522CA854538478EA232E2B | |||
4328 | 9f7c34469ab0fbcd3a758d055109672cbed9a798eadcad054d0cc63179334b73.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7396C420A8E1BC1DA97F1AF0D10BAD21 | binary | |
MD5:E07178901A4EAAC2816BB238EC3A80DB | SHA256:EEBD04C1272661E1091084108083CE44F7C961013791892D866B2F92EE3DEDA8 | |||
5640 | app.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C0018BB1B5834735BFA60CD063B31956 | binary | |
MD5:3E3AED1C0BA46C98A8EF6B3BEC083998 | SHA256:3FAB079F84B987B1A1E305228BD9D2C7DC9A4033B62D3715073C009391FC949F |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
5640 | app.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl | unknown | — | — | whitelisted |
4328 | 9f7c34469ab0fbcd3a758d055109672cbed9a798eadcad054d0cc63179334b73.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl | unknown | — | — | whitelisted |
4328 | 9f7c34469ab0fbcd3a758d055109672cbed9a798eadcad054d0cc63179334b73.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl | unknown | — | — | whitelisted |
5640 | app.exe | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
2164 | My.RawFile.exe | GET | 200 | 158.101.44.242:80 | http://checkip.dyndns.org/ | unknown | — | — | malicious |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 2.23.227.208:443 | www.bing.com | Ooredoo Q.S.C. | QA | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4328 | 9f7c34469ab0fbcd3a758d055109672cbed9a798eadcad054d0cc63179334b73.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
4712 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3976 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
checkip.dyndns.org |
| shared |
smtp.yandex.com |
| shared |
self.events.data.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Device Retrieving External IP Address Detected | ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org) |
— | — | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup - checkip.dyndns.org |