File name:

susp.exe

Full analysis: https://app.any.run/tasks/61d427ee-637e-4716-8e74-74fece5acb88
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: October 10, 2024, 11:42:18
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
ftp
stealer
agenttesla
exfiltration
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

60FD002DB3C71C635932F93A67BB6438

SHA1:

82B73E84A080DFA7F7642C141974FB6D63EC6CEF

SHA256:

D72465B4D315F50E5B4EF4A7F00236E29C25A7A6F0DD9524AAF011EAC230BC2E

SSDEEP:

24576:wXd5p6exfWaN0AWHPo5Hx986LyIGY3Rc7RZPhpCZ8Wti6yUHFQQXjpJ05:wXd5kexfWaN0AWHPo5Hx986LyIV3Rc75

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • susp.exe (PID: 6664)

    • Steals credentials from Web Browsers

      • susp.exe (PID: 6660)

    • Actions looks like stealing of personal data

      • susp.exe (PID: 6660)

    • Connects to the CnC server

      • susp.exe (PID: 6660)

    • Stealers network behavior

      • susp.exe (PID: 6660)

    • AGENTTESLA has been detected (SURICATA)

      • susp.exe (PID: 6660)

    • AGENTTESLA has been detected (YARA)

      • susp.exe (PID: 6660)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • susp.exe (PID: 6664)

    • Reads security settings of Internet Explorer

      • susp.exe (PID: 6664)

    • Application launched itself

      • susp.exe (PID: 6664)

    • Checks for external IP

      • susp.exe (PID: 6660)
      • svchost.exe (PID: 2172)

    • Connects to FTP

      • susp.exe (PID: 6660)

    • Connects to unusual port

      • susp.exe (PID: 6660)

  • INFO

    • Reads the computer name

      • susp.exe (PID: 6664)
      • susp.exe (PID: 6660)

    • The process uses the downloaded file

      • susp.exe (PID: 6664)

    • Create files in a temporary directory

      • susp.exe (PID: 6664)

    • Reads the machine GUID from the registry

      • susp.exe (PID: 6664)
      • susp.exe (PID: 6660)

    • Checks supported languages

      • susp.exe (PID: 6664)
      • susp.exe (PID: 6660)

    • Creates files or folders in the user directory

      • susp.exe (PID: 6664)

    • Process checks computer location settings

      • susp.exe (PID: 6664)

    • Disables trace logs

      • susp.exe (PID: 6660)

    • Checks proxy server information

      • susp.exe (PID: 6660)
      • slui.exe (PID: 4476)

    • Reads the software policy settings

      • slui.exe (PID: 4476)
      • slui.exe (PID: 5356)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (72.2)
.scr | Windows screen saver (12.9)
.dll | Win32 Dynamic Link Library (generic) (6.4)
.exe | Win32 Executable (generic) (4.4)
.exe | Generic Win/DOS Executable (1.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2064:01:28 05:10:01+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 855552
InitializedDataSize: 2560
UninitializedDataSize: -
EntryPoint: 0xd2d92
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Microsoft Corporation.
FileDescription: Play Manager
FileVersion: 1.0.0.0
InternalName: RxivO.exe
LegalCopyright: Copyright © Microsoft Corporation. All rights reserved.
LegalTrademarks: -
OriginalFileName: RxivO.exe
ProductName: Play Manager
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start susp.exe schtasks.exe no specs conhost.exe no specs #AGENTTESLA susp.exe svchost.exe sppextcomobj.exe no specs slui.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
612\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2172C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4476C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5356"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6176C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6228"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KmmQsXajLTnJQ" /XML "C:\Users\admin\AppData\Local\Temp\tmpDFE9.tmp"C:\Windows\SysWOW64\schtasks.exe—susp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6660"C:\Users\admin\AppData\Local\Temp\susp.exe"C:\Users\admin\AppData\Local\Temp\susp.exe
susp.exe
User:
admin
Company:
Microsoft Corporation.
Integrity Level:
MEDIUM
Description:
Play Manager
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\susp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6664"C:\Users\admin\AppData\Local\Temp\susp.exe" C:\Users\admin\AppData\Local\Temp\susp.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation.
Integrity Level:
MEDIUM
Description:
Play Manager
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\susp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
2 669
Read events
2 655
Write events
14
Delete events
0

Modification events

(PID) Process:(6660) susp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\susp_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6660) susp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\susp_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6660) susp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\susp_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6660) susp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\susp_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6660) susp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\susp_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6660) susp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\susp_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6660) susp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\susp_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6660) susp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\susp_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6660) susp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\susp_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6660) susp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\susp_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6664susp.exeC:\Users\admin\AppData\Local\Temp\tmpDFE9.tmpxml
MD5:3F4012A64AFF407CFF7A5A3CB2B30B6F
SHA256:CDDCF37094B61BC919F47E60DA2E2A499CA62E6EA5A52A06F382EBB1CDC7DDF6
6664susp.exeC:\Users\admin\AppData\Roaming\KmmQsXajLTnJQ.exeexecutable
MD5:60FD002DB3C71C635932F93A67BB6438
SHA256:D72465B4D315F50E5B4EF4A7F00236E29C25A7A6F0DD9524AAF011EAC230BC2E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
60
DNS requests
26
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
624
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1500
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6660
susp.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
shared
2272
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2272
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3952
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6944
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4360
SearchApp.exe
104.126.37.144:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 104.126.37.144
  • 104.126.37.155
  • 104.126.37.170
  • 104.126.37.139
  • 104.126.37.163
  • 104.126.37.162
  • 104.126.37.153
  • 104.126.37.154
  • 104.126.37.136
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.22
  • 40.126.32.74
  • 20.190.160.17
  • 40.126.32.76
  • 40.126.32.136
  • 40.126.32.133
  • 40.126.32.68
whitelisted
th.bing.com
  • 104.126.37.177
  • 104.126.37.170
  • 104.126.37.163
  • 104.126.37.186
  • 104.126.37.161
  • 104.126.37.179
  • 104.126.37.162
  • 104.126.37.171
  • 104.126.37.176
whitelisted
go.microsoft.com
  • 23.207.104.224
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
6660
susp.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
2172
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6660
susp.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
6660
susp.exe
Misc activity
INFO [ANY.RUN] FTP protocol command for uploading a file
6660
susp.exe
A Network Trojan was detected
ET MALWARE AgentTesla Exfil via FTP
6660
susp.exe
Misc activity
SUSPICIOUS [ANY.RUN] Sent Host Name in HTTP POST Body
6660
susp.exe
A Network Trojan was detected
STEALER [ANY.RUN] AgentTesla Exfiltration (raw TCP)
6660
susp.exe
A Network Trojan was detected
STEALER [ANY.RUN] AgentTesla Exfiltration (raw TCP)
6660
susp.exe
Misc activity
INFO [ANY.RUN] FTP server is ready for the new user
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
susp.exe