File name:

lib_update.exe

Full analysis: https://app.any.run/tasks/0e6f3aa2-bbaf-4539-bd2e-f2b01415528c
Verdict: Malicious activity
Analysis date: July 18, 2024, 20:03:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
python
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

0CFFC6E70072492F2DB865BEEF41230B

SHA1:

ECA91C34C87499A7BB803F7E848D8B253B171BD1

SHA256:

ED85EAE2CA05BED55452E9E8CC1D45719CA0D9D93DC364BBECF931A3F9AF7CD8

SSDEEP:

196608:J/IkKxBvLNVDhtjtNVJPu78iV/0/w/V0DpvxRORRcWXSNzXYbY:Jwz/LNVDhtjtHJPSFQ/xORRcWiNzXY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • lib_update.exe (PID: 7976)

    • Drops the executable file immediately after the start

      • lib_update.exe (PID: 7976)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • lib_update.exe (PID: 7976)

    • Reads the BIOS version

      • lib_update.exe (PID: 7976)
      • lib_update.exe (PID: 7252)

    • Executable content was dropped or overwritten

      • lib_update.exe (PID: 7976)

    • Process drops python dynamic module

      • lib_update.exe (PID: 7976)

    • Starts a Microsoft application from unusual location

      • lib_update.exe (PID: 7976)
      • lib_update.exe (PID: 7252)

    • The process drops C-runtime libraries

      • lib_update.exe (PID: 7976)

    • Application launched itself

      • lib_update.exe (PID: 7976)

    • Loads Python modules

      • lib_update.exe (PID: 7252)

    • Starts CMD.EXE for commands execution

      • lib_update.exe (PID: 7252)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 3024)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 1652)

  • INFO

    • Checks supported languages

      • lib_update.exe (PID: 7976)
      • lib_update.exe (PID: 7252)

    • Reads the computer name

      • lib_update.exe (PID: 7976)
      • lib_update.exe (PID: 7252)

    • Create files in a temporary directory

      • lib_update.exe (PID: 7976)
      • lib_update.exe (PID: 7252)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 1652)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:07:16 18:36:24+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 168960
InitializedDataSize: 111104
UninitializedDataSize: -
EntryPoint: 0x5ff058
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 9.3.0.0
ProductVersionNumber: 9.3.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
LegalCopyright: © Microsoft Corporation. All rights reserved.
CompanyName: Microsoft Corporation
FileDescription: Host Process for Windows Services
FileVersion: 9.3.1.0
ProductVersion: 9.3.1.0
InternalName: svchost.exe
LegalTrademarks: -
OriginalFileName: svchost.exe
ProductName: Microsoft® Windows® Operating System
BuildID: 122820232119
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start lib_update.exe lib_update.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1652C:\Windows\System32\wbem\WMIC.exe csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
3024C:\WINDOWS\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"C:\Windows\System32\cmd.exe—lib_update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
6900\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7252"C:\Users\admin\Desktop\lib_update.exe" C:\Users\admin\Desktop\lib_update.exe—lib_update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
9.3.1.0
Modules
Images
c:\users\admin\desktop\lib_update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7976"C:\Users\admin\Desktop\lib_update.exe" C:\Users\admin\Desktop\lib_update.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
9.3.1.0
Modules
Images
c:\users\admin\desktop\lib_update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
977
Read events
977
Write events
0
Delete events
0

Modification events

No data
Executable files
127
Suspicious files
1
Text files
45
Unknown types
1

Dropped files

PID
Process
Filename
Type
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_pkcs1_decode.pydexecutable
MD5:1CC6B7B7F0DBF9350392E938386953A8
SHA256:C1A17A620268EC63F9FB944CAC07CE03312B51C868861D25918CC95C318B399A
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_raw_cbc.pydexecutable
MD5:08B45EC5CBD5CA037CB3A591156F27E7
SHA256:7DA13F22EAF1A6C392ABC114C125DE2AF5D2F0417D8A26A954FA48F955124D21
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_raw_aesni.pydexecutable
MD5:8236DBB2921441733B3B2307CF30F94E
SHA256:85FF3FA625970F4AA7ABBC0051015FE046461DE0DFF6327741ACED93D61B0211
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_chacha20.pydexecutable
MD5:4D783114B6A5503EE1B741030C3A6ADD
SHA256:1F5EA24EFE2BFF51A3D89E970361DE60CFC63B77A7017012A9475437AAD62D93
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_raw_ecb.pydexecutable
MD5:6AE6943B964DF59A6252BF48EB5A6D9D
SHA256:02D033BE79080E90592A1E124483363559528D1EEBEC3CA4ED5EA3DA6D6A6E69
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_raw_ctr.pydexecutable
MD5:5FB3ECBA94DF90DDE616F5E9B369D965
SHA256:C41F64CA9E686B683BE55DE894CD3BF50D1A8A4C9003F6949FAF58F548610E24
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_raw_arc2.pydexecutable
MD5:9E3C473F69BBE4625157A678E473AF16
SHA256:3A2AEE1A66F14A9F5AF3D13C5DA029E2E0E0FA5D92954D407378EE208B500950
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_raw_blowfish.pydexecutable
MD5:78F8D76C0FAE3F217C6CC6333B8BABC3
SHA256:4CA1D569A7B1B78765FD0F66D0A6A21AEA6B27FC223FCC5BD50293514803863F
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_raw_cast.pydexecutable
MD5:459E263EC52EABD16FDD0EB41FBC3AF3
SHA256:E42700228A9BE84D7FBB5A6BD4C48894B193046998C9589523D4CEA64A8F7931
7976lib_update.exeC:\Users\admin\AppData\Local\Temp\_MEI79762\Crypto\Cipher\_raw_cfb.pydexecutable
MD5:F6C05DF37303599205208BFD96A7D0C9
SHA256:D547DF7465AB13202D5E5680B48FDD569662D93BDDE3C109E14DEDC1E43CA804
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
20
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
—
20.223.35.26:443
https://fd.api.iris.microsoft.com/v4/api/selection?&asid=FD19017A31A74BFA839FCD27BAF15A32&nct=1&placement=88000677&bcnt=30&country=US&locale=en-US&poptin=0&fmt=json&arch=AMD64&chassis=1&concp=0&d3dfl=D3D_FEATURE_LEVEL_12_1&devfam=Windows.Desktop&devosver=10.0.19045.4046&dinst=1661339444&dmret=0&flightbranch=&flightring=Retail&icluc=0&localid=w%3AAC7699B0-48EA-FD22-C8DC-06A02098A0F0&oem=DELL&osbranch=vb_release&oslocale=en-US&osret=1&ossku=Professional&osskuid=48&prccn=4&prccs=3094&prcmf=AuthenticAMD&procm=Intel%28R%29%20Core%28TM%29%20i5-6400%20CPU%20%40%202.70GHz&ram=4096&tinst=Client&tl=1&pat=0&smc=0&sac=0&disphorzres=1280&dispsize=15.3&dispvertres=720&ldisphorzres=1280&ldispvertres=720&moncnt=1&cpdsk=260281&frdsk=218542&lo=3609363&tsu=999893
unknown
—
—
unknown
—
—
POST
—
20.190.159.64:443
https://login.live.com/RST2.srf
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4716
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
7856
svchost.exe
4.208.221.206:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
5968
backgroundTaskHost.exe
20.103.156.88:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
239.255.255.250:1900
—
—
—
whitelisted
2760
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4716
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5968
backgroundTaskHost.exe
20.223.35.26:443
fd.api.iris.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
arc.msn.com
  • 20.103.156.88
whitelisted
login.live.com
  • 40.126.31.67
  • 20.190.159.0
  • 20.190.159.2
  • 20.190.159.4
  • 40.126.31.73
  • 40.126.31.69
  • 20.190.159.73
  • 20.190.159.64
whitelisted
google.com
  • 216.58.212.174
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
lib_update.exe