File name:

c.exe

Full analysis: https://app.any.run/tasks/a4864707-6b6b-4ce2-ab1d-3da22dd4c75b
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: December 13, 2023, 18:33:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
emotet
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

37A03C2F59C3571D2ED75A2E7E5EF0E2

SHA1:

CF6C767894D7DB51264B4106ADCB9AF7201D3394

SHA256:

BA91B4DB126869AB3FD3CEBA7E3D3B70791BE8D933E84667C355B518F0FC4535

SSDEEP:

6144:+gO3t9pMiy/RyJSsOjxaevfzRM1pOll7JQ+cj5ExQDygiRpbeeg7EG:+gu92/RyJSjxXjRsOltJQ+U0Jeeg7EG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • c.exe (PID: 1864)

    • EMOTET has been detected (YARA)

      • KBDSMSFI.exe (PID: 3028)

  • SUSPICIOUS

    • Starts itself from another location

      • c.exe (PID: 1864)

    • Reads the Internet Settings

      • KBDSMSFI.exe (PID: 3028)

    • Connects to unusual port

      • KBDSMSFI.exe (PID: 3028)

  • INFO

    • Reads the machine GUID from the registry

      • c.exe (PID: 1864)
      • KBDSMSFI.exe (PID: 3028)

    • Reads the computer name

      • c.exe (PID: 1864)
      • KBDSMSFI.exe (PID: 3028)
      • wmpnscfg.exe (PID: 3344)

    • Checks supported languages

      • c.exe (PID: 1864)
      • KBDSMSFI.exe (PID: 3028)
      • wmpnscfg.exe (PID: 3344)

    • Checks proxy server information

      • KBDSMSFI.exe (PID: 3028)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3344)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:10:30 13:31:48+01:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 45056
InitializedDataSize: 8773632
UninitializedDataSize: -
EntryPoint: 0xa274
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start c.exe no specs #EMOTET kbdsmsfi.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1864"C:\Users\admin\AppData\Local\Temp\c.exe" C:\Users\admin\AppData\Local\Temp\c.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\c.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3028"C:\Users\admin\AppData\Local\vmicsvc\KBDSMSFI.exe"C:\Users\admin\AppData\Local\vmicsvc\KBDSMSFI.exe
c.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\vmicsvc\kbdsmsfi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3344"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
520
Read events
490
Write events
30
Delete events
0

Modification events

(PID) Process:(3028) KBDSMSFI.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3028) KBDSMSFI.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3028) KBDSMSFI.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3028) KBDSMSFI.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005A010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3028) KBDSMSFI.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-36-3e-ff
Operation:writeName:WpadDecisionReason
Value:
1
(PID) Process:(3028) KBDSMSFI.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-36-3e-ff
Operation:writeName:WpadDecisionTime
Value:
20B166F3F22DDA01
(PID) Process:(3028) KBDSMSFI.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-36-3e-ff
Operation:writeName:WpadDecision
Value:
0
(PID) Process:(3028) KBDSMSFI.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadDecisionReason
Value:
1
(PID) Process:(3028) KBDSMSFI.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadDecisionTime
Value:
20B166F3F22DDA01
(PID) Process:(3028) KBDSMSFI.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadDecision
Value:
0
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1864c.exeC:\Users\admin\AppData\Local\vmicsvc\KBDSMSFI.exeexecutable
MD5:37A03C2F59C3571D2ED75A2E7E5EF0E2
SHA256:BA91B4DB126869AB3FD3CEBA7E3D3B70791BE8D933E84667C355B518F0FC4535
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
17
DNS requests
5
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3028
KBDSMSFI.exe
190.202.229.74:80
—
CANTV Servicios, Venezuela
VE
unknown
3028
KBDSMSFI.exe
118.69.11.81:7080
—
FPT Telecom Company
VN
unknown
3028
KBDSMSFI.exe
70.39.251.94:8080
—
IMH-IAD
US
unknown
3028
KBDSMSFI.exe
87.230.25.43:8080
—
Host Europe GmbH
FR
unknown
3028
KBDSMSFI.exe
94.23.62.116:8080
—
OVH SAS
FR
unknown
3028
KBDSMSFI.exe
37.187.161.206:8080
—
OVH SAS
FR
unknown

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info