File name: | 17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded |
Full analysis: | https://app.any.run/tasks/d1190429-2d9f-4073-a532-4418af35ece1 |
Verdict: | Malicious activity |
Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
Analysis date: | May 10, 2025, 05:10:28 |
OS: | Windows 10 Professional (build: 19044, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections |
MD5: | 484430CDCE9379CD8720A4FA7A820D27 |
SHA1: | B7098A8A9D4D3771AABD994C62F54257A1E42B7A |
SHA256: | C472CFD602E98DA9A3E85CC86BE8F140CDE1AA9A1AF299510F40F80D8CD14D5C |
SSDEEP: | 12288:j1eur+yiTgkF444VAw7ge/Q4fR4kunYcWGcK4oZ+VpWVVVVVVVVVVVVVVVVVdqL:drdQ0BunO1oZwpX |
.exe | | | Win64 Executable (generic) (64.6) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (15.4) |
.exe | | | Win32 Executable (generic) (10.5) |
.exe | | | Generic Win/DOS Executable (4.6) |
.exe | | | DOS Executable Generic (4.6) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2022:08:20 16:47:03+00:00 |
ImageFileCharacteristics: | Executable, 32-bit |
PEType: | PE32 |
LinkerVersion: | 14 |
CodeSize: | 345088 |
InitializedDataSize: | 134656 |
UninitializedDataSize: | - |
EntryPoint: | 0x327a4 |
OSVersion: | 5.1 |
ImageVersion: | - |
SubsystemVersion: | 5.1 |
Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
536 | C:\Users\admin\AppData\Roaming\mykksg\mykksg.exe | C:\Users\admin\AppData\Roaming\mykksg\mykksg.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Version: 1.0.0.0 Modules
AgentTesla(PID) Process(536) mykksg.exe C2https://api.telegram.org/bot5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM/ ims-api(PID) Process(536) mykksg.exe Telegram-Tokens (1)5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM Telegram-Info-Links 5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM Get info about bothttps://api.telegram.org/bot5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM/getMe Get incoming updateshttps://api.telegram.org/bot5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM/getUpdates Get webhookhttps://api.telegram.org/bot5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM/getWebhookInfo Delete webhookhttps://api.telegram.org/bot5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM/deleteWebhook Drop incoming updateshttps://api.telegram.org/bot5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM/deleteWebhook?drop_pending_updates=true Telegram-Requests Token5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM End-PointsendDocument Args | |||||||||||||||
1072 | C:\Users\admin\AppData\Local\Temp\17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe /stext "C:\Users\admin\AppData\Local\Temp\lbuawtoznztqiijk" | C:\Users\admin\AppData\Local\Temp\17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | — | 17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
5008 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
5352 | C:\Users\admin\AppData\Local\Temp\17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe /stext "C:\Users\admin\AppData\Local\Temp\rfbpuilde" | C:\Users\admin\AppData\Local\Temp\17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | 17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
5588 | C:\Users\admin\AppData\Local\Temp\17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe /stext "C:\Users\admin\AppData\Local\Temp\bzpivaexsrbdy" | C:\Users\admin\AppData\Local\Temp\17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | 17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
6656 | "C:\Users\admin\AppData\Roaming\dwn.exe" | C:\Users\admin\AppData\Roaming\dwn.exe | 17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Version: 1.0.0.0 Modules
AgentTesla(PID) Process(6656) dwn.exe C2https://api.telegram.org/bot5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM/ ims-api(PID) Process(6656) dwn.exe Telegram-Tokens (1)5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM Telegram-Info-Links 5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM Get info about bothttps://api.telegram.org/bot5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM/getMe Get incoming updateshttps://api.telegram.org/bot5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM/getUpdates Get webhookhttps://api.telegram.org/bot5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM/getWebhookInfo Delete webhookhttps://api.telegram.org/bot5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM/deleteWebhook Drop incoming updateshttps://api.telegram.org/bot5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM/deleteWebhook?drop_pending_updates=true Telegram-Requests Token5612460560:AAHyXkizBwpknHBFsEt3GDIwhLylabAVwjM End-PointsendDocument Args | |||||||||||||||
7328 | "C:\Users\admin\AppData\Local\Temp\17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe" | C:\Users\admin\AppData\Local\Temp\17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
Remcos(PID) Process(7328) 17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe C2 (3)myhost001.myddns.me:9373 89.40.31.57:9373 198.54.129.52:6623 BotnetMAY 7 DEN Options Connect_interval1 Install_flagFalse Install_HKCU\RunTrue Install_HKLM\RunTrue Install_HKLM\Explorer\Run1 Setup_path%LOCALAPPDATA% Copy_fileremcos.exe Startup_valueRemcos Hide_fileFalse Mutex_nameRmc-K8IAFW Keylog_flag1 Keylog_path%LOCALAPPDATA% Keylog_filelogs.dat Keylog_cryptFalse Hide_keylogFalse Screenshot_flagFalse Screenshot_time5 Take_ScreenshotFalse Screenshot_path%APPDATA% Screenshot_fileScreenshots Screenshot_cryptFalse Mouse_optionFalse Delete_fileFalse Audio_record_time5 Audio_path%ProgramFiles% Audio_dirMicRecords Connect_delay0 Copy_dirRemcos Keylog_dirremcos Max_keylog_file100000 | |||||||||||||||
7392 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
7428 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
|
(PID) Process: | (7328) 17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Rmc-K8IAFW |
Operation: | write | Name: | exepath |
Value: 36F9CB121668CDE2DACB7E6470D17A774AC633C1F46E3EDDABDB1A70E5165794A15BE9632159A8B892F7403FADB7AC37DA50C3974213B0052D13569C69AB97B5FE7382E77586FED183B6BC76D3CE9D83E6B3D17D5E728E4E33513A72C9BDDE8EB26E508F6A96907F1D7B54002C36253D5F1BAFAA1B619C16B23E7C767D211C6A75022B28502EB211CB03A9514EF1F3A626FA9CD0D0DDB92882ECF50146A07F39B859FCAFB38CD52658070F8B51E60ED7D24C419E64351BC7232131DE66B878DBD6C2BD13EE657A7F16502025353375F52E7B70DCCFA3DB6174B6BFDDA5F6D3F9C97CC104E28F404BA97897B17308DFF5B04189B637A215D34A02B7F6B5FE15F5 | |||
(PID) Process: | (7328) 17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Rmc-K8IAFW |
Operation: | write | Name: | licence |
Value: B5FE68644FDACE2CDAE74DA602F2BF46 | |||
(PID) Process: | (7328) 17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (7328) 17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (7328) 17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (6656) dwn.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\dwn_RASAPI32 |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (6656) dwn.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\dwn_RASAPI32 |
Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
(PID) Process: | (6656) dwn.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\dwn_RASAPI32 |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
(PID) Process: | (6656) dwn.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\dwn_RASAPI32 |
Operation: | write | Name: | FileTracingMask |
Value: | |||
(PID) Process: | (6656) dwn.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\dwn_RASAPI32 |
Operation: | write | Name: | ConsoleTracingMask |
Value: |
PID | Process | Filename | Type | |
---|---|---|---|---|
5352 | 17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | C:\Users\admin\AppData\Local\Temp\bhv877C.tmp | — | |
MD5:— | SHA256:— | |||
7328 | 17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | C:\ProgramData\remcos\logs.dat | binary | |
MD5:4A1337730B173D34D03B1E99232E1A5A | SHA256:B4DBDDC3D6DEE01782337E674C45B18ED513DE05DA9ED6559390EB5D19BCCEDE | |||
536 | mykksg.exe | C:\Users\admin\AppData\Roaming\bxuk5olv.0rx\Chrome\Default\Network\Cookies | binary | |
MD5:06AD9E737639FDC745B3B65312857109 | SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404 | |||
5352 | 17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | C:\Users\admin\AppData\Local\Temp\rfbpuilde | text | |
MD5:73AFEF57A57FF8285682E59AEBA8FE4A | SHA256:9081F636845E9A6B7D781F2F35A28B33B7FDF5373075B435C5B373119D0934A3 | |||
6656 | dwn.exe | C:\Users\admin\AppData\Roaming\1flwuxky.12y\Chrome\Default\Network\Cookies | binary | |
MD5:06AD9E737639FDC745B3B65312857109 | SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404 | |||
6656 | dwn.exe | C:\Users\admin\AppData\Roaming\mykksg\mykksg.exe | executable | |
MD5:ACCFB066306C95FEA0ED42DC99DF1634 | SHA256:E6720928EA03235A4A2AE2183D8E82483EAB11C5D77EC554CA3D85CC69D244B2 | |||
7328 | 17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | C:\Users\admin\AppData\Roaming\dwn.exe | executable | |
MD5:ACCFB066306C95FEA0ED42DC99DF1634 | SHA256:E6720928EA03235A4A2AE2183D8E82483EAB11C5D77EC554CA3D85CC69D244B2 | |||
7328 | 17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\json[1].json | binary | |
MD5:2D6D4619B195C311AC491647648106B5 | SHA256:9F4BBA17E85682EFFCF8D333A226BBCB00382963FDEB1810434253EA93BA846C | |||
6656 | dwn.exe | C:\Users\admin\AppData\Roaming\1flwuxky.12y\Edge Chromium\Default\Network\Cookies | binary | |
MD5:46D9FCA6032297F8AEE08D73418312BA | SHA256:865856FA4C33C4AEE52E15FBB370B6611468FE947E76E197F0E50D0AD62CB1B4 | |||
536 | mykksg.exe | C:\Users\admin\AppData\Roaming\bxuk5olv.0rx\Edge Chromium\Default\Network\Cookies | binary | |
MD5:46D9FCA6032297F8AEE08D73418312BA | SHA256:865856FA4C33C4AEE52E15FBB370B6611468FE947E76E197F0E50D0AD62CB1B4 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
8032 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.216.77.25:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.25:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
8032 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7328 | 17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | GET | 200 | 178.237.33.50:80 | http://geoplugin.net/json.gp | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2104 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 23.216.77.25:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.216.77.25:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
7328 | 17468064642706d462acefb79be4d258259c7fd3847ae87f1d6fa77aa372bfbc1d3f486068783.dat-decoded.exe | 89.40.31.57:9373 | myhost001.myddns.me | Dynamic Connection SRL | RO | whitelisted |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
myhost001.myddns.me |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
geoplugin.net |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 332 |
— | — | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |
— | — | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |
— | — | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |
— | — | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |
— | — | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |
— | — | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |
— | — | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |
— | — | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |
— | — | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |