File name:

d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8

Full analysis: https://app.any.run/tasks/40922400-3332-4cdd-b8da-4e8902428a99
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Analysis date: January 10, 2025, 19:09:17
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
stealer
ftp
agenttesla
exfiltration
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

278A25D8B1BEAC144CD590AE592BF680

SHA1:

D4B9110B6410FCB37E99BA258610A5F7D12FCFB5

SHA256:

D91D556C48FEFC1F1884371FA4277298C37B78D2296A4CF10AF7C1F7036F38B8

SSDEEP:

24576:IlhP9j05cf14Luj0GSSzTLAkb5KH/6c8nuSBXJPYMNY0l+gErWZiYNXUY:IlhP9j05cf14Luj0GSSzTLAkb5KHSc8l

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executing a file with an untrusted certificate

      • d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe (PID: 6292)
    • Actions looks like stealing of personal data

      • d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe (PID: 6292)
    • AGENTTESLA has been detected (SURICATA)

      • d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe (PID: 6292)
    • Steals credentials from Web Browsers

      • d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe (PID: 6292)
    • Connects to the CnC server

      • d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe (PID: 6292)
  • SUSPICIOUS

    • Connects to FTP

      • d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe (PID: 6292)
    • Checks for external IP

      • svchost.exe (PID: 2192)
      • d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe (PID: 6292)
    • Connects to unusual port

      • d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe (PID: 6292)
  • INFO

    • Checks proxy server information

      • d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe (PID: 6292)
    • Reads the machine GUID from the registry

      • d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe (PID: 6292)
    • Disables trace logs

      • d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe (PID: 6292)
    • Reads the computer name

      • d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe (PID: 6292)
    • Checks supported languages

      • d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe (PID: 6292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.scr | Windows screen saver (46.4)
.dll | Win32 Dynamic Link Library (generic) (23.3)
.exe | Win32 Executable (generic) (15.9)
.exe | Generic Win/DOS Executable (7.1)
.exe | DOS Executable Generic (7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:12:06 12:10:34+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 684544
InitializedDataSize: 5632
UninitializedDataSize: -
EntryPoint: 0xa9006
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.0.0.0
ProductVersionNumber: 3.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Calculadora
FileVersion: 3.0.0.0
InternalName: azmse.exe
LegalCopyright: -
LegalTrademarks: Calculadora
OriginalFileName: azmse.exe
ProductName: -
ProductVersion: 3.0.0.0
AssemblyVersion: 3.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #AGENTTESLA d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
6292"C:\Users\admin\AppData\Local\Temp\d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe" C:\Users\admin\AppData\Local\Temp\d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Calculadora
Version:
3.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
1 102
Read events
1 088
Write events
14
Delete events
0

Modification events

(PID) Process:(6292) d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6292) d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6292) d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6292) d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6292) d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6292) d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6292) d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6292) d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6292) d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6292) d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
36
DNS requests
18
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
2624
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
7140
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
7140
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
6292
d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
shared
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
2624
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6372
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
40.127.240.158:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4712
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2624
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
2624
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5064
SearchApp.exe
2.23.227.208:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
440
RUXIMICS.exe
40.127.240.158:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.35.229.160
whitelisted
google.com
  • 216.58.206.46
whitelisted
www.bing.com
  • 2.23.227.208
  • 2.23.227.215
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.64
  • 20.190.159.68
  • 20.190.159.4
  • 20.190.159.71
  • 40.126.31.69
  • 40.126.31.67
  • 40.126.31.73
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
Misc activity
INFO [ANY.RUN] FTP protocol command for uploading a file
A Network Trojan was detected
ET MALWARE AgentTesla Exfil via FTP
A Network Trojan was detected
STEALER [ANY.RUN] AgentTesla Exfiltration (raw TCP)
A Network Trojan was detected
STEALER [ANY.RUN] AgentTesla Exfiltration (raw TCP)
Misc activity
INFO [ANY.RUN] FTP server is ready for the new user
2 ETPRO signatures available at the full report
No debug info