File name:

lib_update.exe

Full analysis: https://app.any.run/tasks/0e6f3aa2-bbaf-4539-bd2e-f2b01415528c
Verdict: Malicious activity
Analysis date: July 18, 2024, 20:03:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
python
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

0CFFC6E70072492F2DB865BEEF41230B

SHA1:

ECA91C34C87499A7BB803F7E848D8B253B171BD1

SHA256:

ED85EAE2CA05BED55452E9E8CC1D45719CA0D9D93DC364BBECF931A3F9AF7CD8

SSDEEP:

196608:J/IkKxBvLNVDhtjtNVJPu78iV/0/w/V0DpvxRORRcWXSNzXYbY:Jwz/LNVDhtjtHJPSFQ/xORRcWiNzXY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • lib_update.exe (PID: 7976)

    • Drops the executable file immediately after the start

      • lib_update.exe (PID: 7976)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • lib_update.exe (PID: 7976)

    • Process drops legitimate windows executable

      • lib_update.exe (PID: 7976)

    • Reads the BIOS version

      • lib_update.exe (PID: 7976)
      • lib_update.exe (PID: 7252)

    • Process drops python dynamic module

      • lib_update.exe (PID: 7976)

    • Starts a Microsoft application from unusual location

      • lib_update.exe (PID: 7976)
      • lib_update.exe (PID: 7252)

    • Executable content was dropped or overwritten

      • lib_update.exe (PID: 7976)

    • Application launched itself

      • lib_update.exe (PID: 7976)

    • Starts CMD.EXE for commands execution

      • lib_update.exe (PID: 7252)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 3024)

    • Loads Python modules

      • lib_update.exe (PID: 7252)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 1652)

  • INFO

    • Checks supported languages

      • lib_update.exe (PID: 7976)
      • lib_update.exe (PID: 7252)

    • Reads the computer name

      • lib_update.exe (PID: 7976)
      • lib_update.exe (PID: 7252)

    • Create files in a temporary directory

      • lib_update.exe (PID: 7976)
      • lib_update.exe (PID: 7252)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 1652)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:07:16 18:36:24+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 168960
InitializedDataSize: 111104
UninitializedDataSize: -
EntryPoint: 0x5ff058
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 9.3.0.0
ProductVersionNumber: 9.3.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
LegalCopyright: © Microsoft Corporation. All rights reserved.
CompanyName: Microsoft Corporation
FileDescription: Host Process for Windows Services
FileVersion: 9.3.1.0
ProductVersion: 9.3.1.0
InternalName: svchost.exe
LegalTrademarks: -
OriginalFileName: svchost.exe
ProductName: Microsoft® Windows® Operating System
BuildID: 122820232119
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start lib_update.exe lib_update.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1652C:\Windows\System32\wbem\WMIC.exe csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
3024C:\WINDOWS\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"C:\Windows\System32\cmd.exe—lib_update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
6900\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7252"C:\Users\admin\Desktop\lib_update.exe" C:\Users\admin\Desktop\lib_update.exe—lib_update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
9.3.1.0
Modules
Images
c:\users\admin\desktop\lib_update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7976"C:\Users\admin\Desktop\lib_update.exe" C:\Users\admin\Desktop\lib_update.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
9.3.1.0
Modules
Images
c:\users\admin\desktop\lib_update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
977
Read events
977
Write events
0
Delete events
0

Modification events

No data
Executable files
127
Suspicious files
1
Text files
45
Unknown types
1

Dropped files

PID
Process
Filename
Type
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_Salsa20.pydexecutable
MD5:6C05B6C3ACE9049994B1A7F465B11B05
SHA256:80BF78BBC004F43700D5BAB3DDA32F78BB6EBD7462BBBBE60403959821CF772A
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_raw_arc2.pydexecutable
MD5:9E3C473F69BBE4625157A678E473AF16
SHA256:3A2AEE1A66F14A9F5AF3D13C5DA029E2E0E0FA5D92954D407378EE208B500950
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_raw_aes.pydexecutable
MD5:91820AE5A7C0B857024C30F0F62D3BB6
SHA256:B669F63F11FD9CF93A12383F5BD9C5F97EEEF3CE09F31088F3EBA624392C783E
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_raw_aesni.pydexecutable
MD5:8236DBB2921441733B3B2307CF30F94E
SHA256:85FF3FA625970F4AA7ABBC0051015FE046461DE0DFF6327741ACED93D61B0211
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_raw_cfb.pydexecutable
MD5:F6C05DF37303599205208BFD96A7D0C9
SHA256:D547DF7465AB13202D5E5680B48FDD569662D93BDDE3C109E14DEDC1E43CA804
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_raw_cbc.pydexecutable
MD5:08B45EC5CBD5CA037CB3A591156F27E7
SHA256:7DA13F22EAF1A6C392ABC114C125DE2AF5D2F0417D8A26A954FA48F955124D21
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_raw_blowfish.pydexecutable
MD5:78F8D76C0FAE3F217C6CC6333B8BABC3
SHA256:4CA1D569A7B1B78765FD0F66D0A6A21AEA6B27FC223FCC5BD50293514803863F
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_raw_cast.pydexecutable
MD5:459E263EC52EABD16FDD0EB41FBC3AF3
SHA256:E42700228A9BE84D7FBB5A6BD4C48894B193046998C9589523D4CEA64A8F7931
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_raw_ctr.pydexecutable
MD5:5FB3ECBA94DF90DDE616F5E9B369D965
SHA256:C41F64CA9E686B683BE55DE894CD3BF50D1A8A4C9003F6949FAF58F548610E24
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_ARC4.pydexecutable
MD5:F91727861FCB7E6A802E9201329487A8
SHA256:6A071CB11021E1040F34544A2D54267E13F4983F65FD39DF977BA01E2FFFA89D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
20
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
—
20.223.35.26:443
https://fd.api.iris.microsoft.com/v4/api/selection?&asid=FD19017A31A74BFA839FCD27BAF15A32&nct=1&placement=88000677&bcnt=30&country=US&locale=en-US&poptin=0&fmt=json&arch=AMD64&chassis=1&concp=0&d3dfl=D3D_FEATURE_LEVEL_12_1&devfam=Windows.Desktop&devosver=10.0.19045.4046&dinst=1661339444&dmret=0&flightbranch=&flightring=Retail&icluc=0&localid=w%3AAC7699B0-48EA-FD22-C8DC-06A02098A0F0&oem=DELL&osbranch=vb_release&oslocale=en-US&osret=1&ossku=Professional&osskuid=48&prccn=4&prccs=3094&prcmf=AuthenticAMD&procm=Intel%28R%29%20Core%28TM%29%20i5-6400%20CPU%20%40%202.70GHz&ram=4096&tinst=Client&tl=1&pat=0&smc=0&sac=0&disphorzres=1280&dispsize=15.3&dispvertres=720&ldisphorzres=1280&ldispvertres=720&moncnt=1&cpdsk=260281&frdsk=218542&lo=3609363&tsu=999893
unknown
—
—
—
—
—
POST
—
20.190.159.64:443
https://login.live.com/RST2.srf
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4716
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
7856
svchost.exe
4.208.221.206:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
5968
backgroundTaskHost.exe
20.103.156.88:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
239.255.255.250:1900
—
—
—
whitelisted
2760
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4716
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5968
backgroundTaskHost.exe
20.223.35.26:443
fd.api.iris.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
arc.msn.com
  • 20.103.156.88
whitelisted
login.live.com
  • 40.126.31.67
  • 20.190.159.0
  • 20.190.159.2
  • 20.190.159.4
  • 40.126.31.73
  • 40.126.31.69
  • 20.190.159.73
  • 20.190.159.64
whitelisted
google.com
  • 216.58.212.174
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
lib_update.exe