Malware analysis labelImg.exe Malicious activity | ANY.RUN

Add for printing

File name:	labelImg.exe
Full analysis:	https://app.any.run/tasks/2944ce39-1fdb-4a9e-a46f-3b48d1859bdb
Verdict:	Malicious activity
Analysis date:	November 25, 2024, 01:58:22
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	python
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (console) Intel 80386, for MS Windows, 4 sections
MD5:	0066DA200EAD7F1EB48693B1D5B2E064
SHA1:	4EDE2B1AC8BA806B4B95237E9774AEC4BFD8174B
SHA256:	C2477E9DAB909FF059BA9C028429C08C373579A4A0275262F75675F2C682A37B
SSDEEP:	98304:15/U/w15hV6zl4RGCjQvRIiWPE5Site9sn9DD5qy8qOd8E6XzQKyTNIuxmdfUxrQ:JhbRybZw80NHsm48CXmgtkzfQK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Executable content was dropped or overwritten
  - labelImg.exe (PID: 4444)
- Loads Python modules
  - labelImg.exe (PID: 2100)
- Process drops python dynamic module
  - labelImg.exe (PID: 4444)
- Application launched itself
  - labelImg.exe (PID: 4444)
INFO
- Checks supported languages
  - labelImg.exe (PID: 2100)
  - labelImg.exe (PID: 4444)
- Create files in a temporary directory
  - labelImg.exe (PID: 4444)
- Reads the computer name
  - labelImg.exe (PID: 2100)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win32 Executable MS Visual C++ (generic) (67.4)
.dll	\|	Win32 Dynamic Link Library (generic) (14.2)
.exe	\|	Win32 Executable (generic) (9.7)
.exe	\|	Generic Win/DOS Executable (4.3)
.exe	\|	DOS Executable Generic (4.3)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2013:03:23 22:26:54+00:00
ImageFileCharacteristics:	No relocs, Executable, 32-bit
PEType:	PE32
LinkerVersion:	9
CodeSize:	105472
InitializedDataSize:	128512
UninitializedDataSize:	-
EntryPoint:	0xb2f7
OSVersion:	5
ImageVersion:	-
SubsystemVersion:	5
Subsystem:	Windows command line

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

125

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

2100

"C:\Users\admin\AppData\Local\Temp\labelImg.exe"

C:\Users\admin\AppData\Local\Temp\labelImg.exe

—

labelImg.exe

User:

admin

Integrity Level:

MEDIUM

Modules

Images
c:\users\admin\appdata\local\temp\labelimg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll

3620

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

labelImg.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

4444

"C:\Users\admin\AppData\Local\Temp\labelImg.exe"

C:\Users\admin\AppData\Local\Temp\labelImg.exe

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Modules

Images
c:\users\admin\appdata\local\temp\labelimg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll

Add for printing

Total events

4 711

Read events

4 613

Write events

Delete events

Modification events


(PID) Process:	(2100) labelImg.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.8.false\C:\Users\admin\AppData\Local\Temp\_MEI44442\qt4_plugins\imageformats
Operation:	write	Name:	qgif4.dll
Value: 40807
(PID) Process:	(2100) labelImg.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Trolltech\OrganizationDefaults\Qt Factory Cache 4.8\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Users\admin\AppData\Local\Temp\_MEI44442\qt4_plugins\imageformats
Operation:	write	Name:	qgif4.dll
Value: 2024-11-25T01:58:33
(PID) Process:	(2100) labelImg.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.8.false\C:\Users\admin\AppData\Local\Temp\_MEI44442\qt4_plugins\imageformats
Operation:	write	Name:	qico4.dll
Value: 40807
(PID) Process:	(2100) labelImg.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Trolltech\OrganizationDefaults\Qt Factory Cache 4.8\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Users\admin\AppData\Local\Temp\_MEI44442\qt4_plugins\imageformats
Operation:	write	Name:	qico4.dll
Value: 2024-11-25T01:58:33
(PID) Process:	(2100) labelImg.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.8.false\C:\Users\admin\AppData\Local\Temp\_MEI44442\qt4_plugins\imageformats
Operation:	write	Name:	qjpeg4.dll
Value: 40807
(PID) Process:	(2100) labelImg.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Trolltech\OrganizationDefaults\Qt Factory Cache 4.8\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Users\admin\AppData\Local\Temp\_MEI44442\qt4_plugins\imageformats
Operation:	write	Name:	qjpeg4.dll
Value: 2024-11-25T01:58:33
(PID) Process:	(2100) labelImg.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.8.false\C:\Users\admin\AppData\Local\Temp\_MEI44442\qt4_plugins\imageformats
Operation:	write	Name:	qmng4.dll
Value: 40807
(PID) Process:	(2100) labelImg.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Trolltech\OrganizationDefaults\Qt Factory Cache 4.8\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Users\admin\AppData\Local\Temp\_MEI44442\qt4_plugins\imageformats
Operation:	write	Name:	qmng4.dll
Value: 2024-11-25T01:58:33
(PID) Process:	(2100) labelImg.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.8.false\C:\Users\admin\AppData\Local\Temp\_MEI44442\qt4_plugins\imageformats
Operation:	write	Name:	qsvg4.dll
Value: 40807
(PID) Process:	(2100) labelImg.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.8.false\C:\Users\admin\AppData\Local\Temp\_MEI44442\qt4_plugins\imageformats
Operation:	write	Name:	qtga4.dll
Value: 40807

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
4444	labelImg.exe	C:\Users\admin\AppData\Local\Temp\_MEI44442\unicodedata.pyd		executable
		MD5:B4530ADC9CBA15114A001D1AAE2E98B3	SHA256:C7C85F717B8A3676716BB2106E31B288EA1DFE90D1802180169CF92488F47DDE
4444	labelImg.exe	C:\Users\admin\AppData\Local\Temp\_MEI44442\sip.pyd		executable
		MD5:C722D01F6D5A762D3A43B9E642220964	SHA256:46B027D3038A0D6191183B187EFD0B0F41005AE53D35D7E6F8CC48DC962D86B0
4444	labelImg.exe	C:\Users\admin\AppData\Local\Temp\_MEI44442\_ssl.pyd		executable
		MD5:6F47CDDCC5C74CF22A1B5CF710935EBF	SHA256:D9FADB044CA15EE133F157180197F6867FE21D03FB3A4F601A6F356150F1D08D
4444	labelImg.exe	C:\Users\admin\AppData\Local\Temp\_MEI44442\win32pipe.pyd		executable
		MD5:E1F9FC63175A0E6799CBB58A094A80FA	SHA256:955E1A98D2DDCAA64ACF4E47135434E6557427B52D6BAC59AAAE2DAFEA463CD3
4444	labelImg.exe	C:\Users\admin\AppData\Local\Temp\_MEI44442\_hashlib.pyd		executable
		MD5:3C58062B89379F2D29A12BFFD3D01AF8	SHA256:706BEBA9F66B1422AC45F35E9094846F1E6E76CF1120FCAB0835EA6BE4236B61
4444	labelImg.exe	C:\Users\admin\AppData\Local\Temp\_MEI44442\qt4_plugins\codecs\qtwcodecs4.dll		executable
		MD5:9E9B14FA5F128FA430ED5DB8EB54BC66	SHA256:C88312ACA69A0F43CB1C81A0582C8077BDB6D95E5DEB72E5F6A147D0C4DAB11E
4444	labelImg.exe	C:\Users\admin\AppData\Local\Temp\_MEI44442\qt4_plugins\codecs\qjpcodecs4.dll		executable
		MD5:875A260560C78F5DAB835AB84A3DC2ED	SHA256:1896B90FAB05A0C9D53D3B2D954728B99903FD29D466401FC8948AB07135B413
4444	labelImg.exe	C:\Users\admin\AppData\Local\Temp\_MEI44442\select.pyd		executable
		MD5:4F1C033A4B8B1BC19565A78655C0E385	SHA256:029D60725554EF87BF13C667B01AD32159DD2852FACA43F3A81D71D0062A3A33
4444	labelImg.exe	C:\Users\admin\AppData\Local\Temp\_MEI44442\bz2.pyd		executable
		MD5:A9445508C595C742D93B473B1DB1758C	SHA256:E9E06E0D6E4B9B3486EB0E100C35B13C90A92864305CDE9E6DAEA74CFF7722CD
4444	labelImg.exe	C:\Users\admin\AppData\Local\Temp\_MEI44442\qt4_plugins\imageformats\qico4.dll		executable
		MD5:89CE1B694879E18835B794462D0A9768	SHA256:5C1E4FD2A2931486287BD09B13FA306AE7562B6980F95C0BF38126140AEBA6F2

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	200	2.16.164.49:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
—	—	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5064	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
1176	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
4972	SIHClient.exe	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
4972	SIHClient.exe	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
4392	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:138	—	—	—	whitelisted
6060	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4712	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	2.16.164.49:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
—	—	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
6060	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
5064	SearchApp.exe	2.23.209.130:443	www.bing.com	Akamai International B.V.	GB	whitelisted
1176	svchost.exe	40.126.31.69:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 20.73.194.208 51.104.136.2 40.127.240.158	whitelisted
google.com	142.250.185.174	whitelisted
crl.microsoft.com	2.16.164.49 2.16.164.9	whitelisted
www.microsoft.com	95.101.149.131 2.23.181.156	whitelisted
www.bing.com	2.23.209.130 2.23.209.187	whitelisted
login.live.com	40.126.31.69 20.190.159.73 20.190.159.71 20.190.159.75 20.190.159.0 40.126.31.73 20.190.159.23 20.190.159.2	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
go.microsoft.com	2.18.97.227	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted
fe3cr.delivery.mp.microsoft.com	13.95.31.18	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

labelImg.exe

0066DA200EAD7F1EB48693B1D5B2E064

4EDE2B1AC8BA806B4B95237E9774AEC4BFD8174B

C2477E9DAB909FF059BA9C028429C08C373579A4A0275262F75675F2C682A37B

98304:15/U/w15hV6zl4RGCjQvRIiWPE5Site9sn9DD5qy8qOd8E6XzQKyTNIuxmdfUxrQ:JhbRybZw80NHsm48CXmgtkzfQK

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Executable content was dropped or overwritten

Loads Python modules

Process drops python dynamic module

Application launched itself

INFO

Checks supported languages

Create files in a temporary directory

Reads the computer name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings