Find similar analyses in TI Lookup

Analysis date (UTC): 10 September 2019, 16:02Analysis environment: Windows 7 Pro, build 7601, x86

c9b3b727f3ce582d5ef06649d804c96e.exe

MD5:C9B3B727F3CE582D5EF06649D804C96E

SHA1:DCD97BD1EB26577A4B092C411968F61AFC2CD543

SHA256:EA4EA08407D4EE72E009103A3B77E5A09412B722FDEF67315EA63F22011152AF

Analysis result

Threat level:Malicious activity

Tags:

evasiontrojanratagentteslakeylogger

Full analysis:Analysis c9b3b727f3ce582d5ef06649d804c96e.exe (MD5: C9B3B727F3CE582D5EF06649D804C96E) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Changes the autorun value in the registry

c9b3b727f3ce582d5ef06649d804c96e.exe (PID: 2716)

Disables registry editing tools (regedit)

c9b3b727f3ce582d5ef06649d804c96e.exe (PID: 2716)

Disables the Command Prompt (cmd)

c9b3b727f3ce582d5ef06649d804c96e.exe (PID: 2716)
REG.exe (PID: 1640)

Disables Windows System Restore

c9b3b727f3ce582d5ef06649d804c96e.exe (PID: 2716)

AGENTTESLA was detected

c9b3b727f3ce582d5ef06649d804c96e.exe (PID: 2716)

Task Manager has been disabled (taskmgr)

REG.exe (PID: 2972)

Disables the Run in Start menu

REG.exe (PID: 2468)

Actions looks like stealing of personal data

c9b3b727f3ce582d5ef06649d804c96e.exe (PID: 2716)

SUSPICIOUS

Creates files in the user directory

c9b3b727f3ce582d5ef06649d804c96e.exe (PID: 2716)

Application launched itself

c9b3b727f3ce582d5ef06649d804c96e.exe (PID: 2540)

Executable content was dropped or overwritten

c9b3b727f3ce582d5ef06649d804c96e.exe (PID: 2716)

Uses REG.EXE to modify Windows registry

c9b3b727f3ce582d5ef06649d804c96e.exe (PID: 2716)

Reads the cookies of Google Chrome

c9b3b727f3ce582d5ef06649d804c96e.exe (PID: 2716)

Reads the cookies of Mozilla Firefox

c9b3b727f3ce582d5ef06649d804c96e.exe (PID: 2716)

Checks for external IP

c9b3b727f3ce582d5ef06649d804c96e.exe (PID: 2716)

INFO

No info indicators.

Threats

PID	Process	Class	Message
2716	c9b3b727f3ce582d5ef06649d804c96e.exe	A Network Trojan was detected	MALWARE [PTsecurity] AgentTesla IP Check
2716	c9b3b727f3ce582d5ef06649d804c96e.exe	Generic Protocol Command Decode	SURICATA Applayer Detect protocol only one direction
2716	c9b3b727f3ce582d5ef06649d804c96e.exe	Generic Protocol Command Decode	SURICATA Applayer Detect protocol only one direction