File name:

Your FedEx Invoice 2341884702.eml

Full analysis: https://app.any.run/tasks/27649b9e-3f2a-4f03-b5ed-79fa980e28a4
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: February 16, 2024, 04:06:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
spam
formbook
xloader
stealer
spyware
Indicators:
MIME: message/rfc822
File info: SMTP mail, ASCII text, with CRLF line terminators
MD5:

17544D9CD687725A9C98054DC1529B63

SHA1:

2D3707884A9011FE5F168F415327AB959318B365

SHA256:

09C3E5BAD51D26A57EE79F5C072404EC58F4AA9742FA69A09927749B0B2A4D42

SSDEEP:

24576:7hx0JfH7XhTGItRAITBRffcW1KR+H5Miwkbz9/Oxf1bcnQE:+oI9RffcWH+UzFO/E

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • OUTLOOK.EXE (PID: 3700)

    • FORMBOOK has been detected (YARA)

      • proquota.exe (PID: 2148)

    • Steals credentials

      • proquota.exe (PID: 2148)

    • FORMBOOK has been detected (SURICATA)

      • explorer.exe (PID: 1164)

    • Actions looks like stealing of personal data

      • proquota.exe (PID: 2148)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • OUTLOOK.EXE (PID: 3700)
      • WinRAR.exe (PID: 4000)
      • explorer.exe (PID: 1164)

    • Reads Microsoft Outlook installation path

      • explorer.exe (PID: 1164)

    • Starts a Microsoft application from unusual location

      • FedEx Invoice_2341884702.exe (PID: 2364)
      • FedEx Invoice_2341884702.exe (PID: 2168)

    • Application launched itself

      • FedEx Invoice_2341884702.exe (PID: 2364)

    • Reads the Internet Settings

      • proquota.exe (PID: 2148)

    • Loads DLL from Mozilla Firefox

      • proquota.exe (PID: 2148)

    • Executable content was dropped or overwritten

      • proquota.exe (PID: 2148)

    • Process drops SQLite DLL files

      • proquota.exe (PID: 2148)

  • INFO

    • The process uses the downloaded file

      • OUTLOOK.EXE (PID: 3700)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1164)
      • proquota.exe (PID: 2148)

    • Manual execution by a user

      • WinRAR.exe (PID: 4000)
      • FedEx Invoice_2341884702.exe (PID: 2364)
      • proquota.exe (PID: 2148)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4000)

    • Reads the Internet Settings

      • explorer.exe (PID: 1164)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4000)
      • explorer.exe (PID: 1164)
      • proquota.exe (PID: 2148)

    • Checks supported languages

      • FedEx Invoice_2341884702.exe (PID: 2364)
      • FedEx Invoice_2341884702.exe (PID: 2168)

    • Reads the computer name

      • FedEx Invoice_2341884702.exe (PID: 2364)

    • Reads the machine GUID from the registry

      • FedEx Invoice_2341884702.exe (PID: 2364)

    • Checks proxy server information

      • proquota.exe (PID: 2148)

    • Creates files or folders in the user directory

      • proquota.exe (PID: 2148)

    • Create files in a temporary directory

      • proquota.exe (PID: 2148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 1) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe winrar.exe fedex invoice_2341884702.exe no specs fedex invoice_2341884702.exe no specs #FORMBOOK proquota.exe #FORMBOOK explorer.exe firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1164C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1308"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe—proquota.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
2148"C:\Windows\System32\proquota.exe"C:\Windows\System32\proquota.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ProQuota
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\proquota.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2168"C:\Users\admin\Desktop\FedEx Invoice_2341884702.exe"C:\Users\admin\Desktop\FedEx Invoice_2341884702.exe—FedEx Invoice_2341884702.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.Netframwork
Exit code:
0
Version:
1.1.0.0
Modules
Images
c:\users\admin\desktop\fedex invoice_2341884702.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2364"C:\Users\admin\Desktop\FedEx Invoice_2341884702.exe" C:\Users\admin\Desktop\FedEx Invoice_2341884702.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.Netframwork
Exit code:
0
Version:
1.1.0.0
Modules
Images
c:\users\admin\desktop\fedex invoice_2341884702.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3700"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\Your FedEx Invoice 2341884702.eml"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4000"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\FedEx Invoice_2341884702.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
18 531
Read events
18 301
Write events
191
Delete events
39

Modification events

(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000DBDD10622BD67741A42163F361389C47000000000200000000001066000000010000200000008ED9A1005EF4B952223AFF6842F43155FEF321F115A52192490F5580741942E6000000000E80000000020000200000008C49FB323AB369A23C0759A68E34BF298189611F5676B4328B8B309D70404C53300000008BB5AEDCE2B223DA441B4F5C0704498F36EEFB403A69215D06CD299C9C2950A7B7F4D2124F63C8C61B753103C3C3947B40000000C8978C004960C9EE6733254763FDE1DC473B238B3EADF44710EEC003753698BBAE5F64BE5BB2EBFF17AD885DE5C2B05CCB3033E4859E7477B1888118CF304F91
(PID) Process:(3700) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3700) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(3700) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(3700) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(3700) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(3700) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(3700) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(3700) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(3700) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
3
Suspicious files
13
Text files
4
Unknown types
3

Dropped files

PID
Process
Filename
Type
3700OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR376.tmp.cvr —
MD5:—
SHA256:—
3700OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
3700OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inftext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
3700OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\2CA65QMF\FedEx Invoice_2341884702.rar:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
3700OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\~DF0FD701DFB431E924.TMPbinary
MD5:72F5C05B7EA8DD6059BF59F50B22DF33
SHA256:1DC0C8D7304C177AD0E74D3D2F1002EB773F4B180685A7DF6BBE75CCC24B0164
3700OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{E448BA88-D39D-4446-8680-CE6E696EBC2F}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:4C61C12EDBC453D7AE184976E95258E1
SHA256:296526F9A716C1AA91BA5D6F69F0EB92FDF79C2CB2CFCF0CEB22B7CCBC27035F
1164explorer.exeC:\Users\admin\Desktop\FedEx Invoice_2341884702.rarcompressed
MD5:E8C4664BBB11E2498AF51C485C1D42D7
SHA256:557502A203D1F91B1AB609BB793B045DFC2067D64FEDEA60E8A3C0547AB817CB
3700OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\2CA65QMF\FedEx Invoice_2341884702.rarcompressed
MD5:E8C4664BBB11E2498AF51C485C1D42D7
SHA256:557502A203D1F91B1AB609BB793B045DFC2067D64FEDEA60E8A3C0547AB817CB
3700OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\tmp4DE.tmpbinary
MD5:1CC9076E935D13D0318AD3898E4143CC
SHA256:A61089852BC2BFC07412B45FB7270ED820E0F07DBB817AE60750A2F7A4CD5ADD
1164explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\290532160612e071.automaticDestinations-msbinary
MD5:6EB2E6B2D2D1D59984E76FDC6BAC238E
SHA256:0F6ABE2110935B25882212A4928B20C4DF08C90AB986A90A5208085B728647C4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
58
TCP/UDP connections
62
DNS requests
13
Threats
49

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1164
explorer.exe
GET
—
91.195.240.117:80
http://www.chameleonboysclub.com/g3h4/?Ipf0rV=EzVemOi9F5PrbqjSpYgh2o3emqccsRGcNSzh5/VVBzkrCXFmlgzCOpgVwfN+WOTPdNatfdcL3ND0D5Oqnp7ifF/EtsRXIj+En/wIaK6ZfiOWmeYZPu2z+LNHtxTR&76yX=LbT0ClNp7r4xK4n0
unknown
—
—
unknown
2148
proquota.exe
GET
200
45.33.6.223:80
http://www.sqlite.org/2019/sqlite-dll-win32-x86-3280000.zip
unknown
compressed
472 Kb
unknown
1164
explorer.exe
POST
—
188.114.97.3:80
http://www.barrettdigitalart.com/g3h4/
unknown
—
—
unknown
1164
explorer.exe
POST
404
188.114.97.3:80
http://www.barrettdigitalart.com/g3h4/
unknown
html
7.22 Kb
unknown
1164
explorer.exe
POST
404
188.114.97.3:80
http://www.barrettdigitalart.com/g3h4/
unknown
html
7.22 Kb
unknown
1164
explorer.exe
POST
404
188.114.97.3:80
http://www.barrettdigitalart.com/g3h4/
unknown
html
7.20 Kb
unknown
1164
explorer.exe
GET
301
188.114.97.3:80
http://www.barrettdigitalart.com/g3h4/?Ipf0rV=XbLJlNGEtKCVcgAr+z1a4JWOLcBeMbPS0sz5DT5hAXrZxmNu3mZ/EdNlE8mf2m9oShAc/L1zcnw/QKhOWmb+aHwwvETZzrgBOqmw+wR53lSfmD8L7nu7vJbI/0by&76yX=LbT0ClNp7r4xK4n0
unknown
—
—
unknown
1164
explorer.exe
POST
404
188.114.97.3:80
http://www.barrettdigitalart.com/g3h4/
unknown
html
7.23 Kb
unknown
1164
explorer.exe
POST
404
188.114.97.3:80
http://www.barrettdigitalart.com/g3h4/
unknown
html
7.22 Kb
unknown
1164
explorer.exe
POST
200
206.233.249.197:80
http://www.click-advertising.net/g3h4/
unknown
html
165 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3700
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1164
explorer.exe
91.195.240.117:80
www.chameleonboysclub.com
SEDO GmbH
DE
unknown
2148
proquota.exe
45.33.6.223:80
www.sqlite.org
Linode, LLC
US
unknown
1164
explorer.exe
188.114.97.3:80
www.barrettdigitalart.com
CLOUDFLARENET
NL
unknown
1164
explorer.exe
206.233.249.197:80
www.click-advertising.net
HONG KONG Megalayer Technology Co.,Limited
US
unknown
1164
explorer.exe
37.9.175.196:80
www.terazinvestment.com
WebSupport s.r.o.
SK
unknown
1164
explorer.exe
15.235.86.83:80
www.angelasboutiquesc.com
OVH SAS
CA
unknown

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
www.justgoodsin.com
  • —
unknown
www.chameleonboysclub.com
  • 91.195.240.117
unknown
www.sqlite.org
  • 45.33.6.223
whitelisted
www.barrettdigitalart.com
  • 188.114.97.3
  • 188.114.96.3
unknown
www.click-advertising.net
  • 206.233.249.197
unknown
www.terazinvestment.com
  • 37.9.175.196
unknown
www.angelasboutiquesc.com
  • 15.235.86.83
unknown
www.severnii-port.pro
  • 194.58.112.174
unknown

Threats

PID
Process
Class
Message
1164
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
1164
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
1164
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
1164
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
1164
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
1164
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
1164
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
1164
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
1164
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
1164
explorer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Formbook HTTP header
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Your FedEx Invoice 2341884702.eml