analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | EA396919-8758-8405-970F-F576EC8B84CE.eml |
| Full analysis: | https://app.any.run/tasks/5cb52f0d-e439-45bf-9a4a-84484096f061 |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | April 25, 2019, 12:29:52 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | message/rfc822 |
| File info: | RFC 822 mail, ASCII text, with CRLF line terminators |
| MD5: | 994D370443DC937118BADDEF4CC835E5 |
| SHA1: | 246555CA4D0EFEB4AAFD2A430527D8D26202ACC7 |
| SHA256: | 0F4489A9DB9165EE6103A239A0FD9592C8DA3B5821E874A1948B293F67720446 |
| SSDEEP: | 768:JtGtgI04fn17GB32ELEP8TuIB3yCyxGt97YXfIR66p1:Jtrv3hWIBzt90XfQjv |
MALICIOUS
Application was dropped or rewritten from another process
- Fatura0025.scr (PID: 1916)
- qsm.exe (PID: 3004)
- qsm.exe (PID: 1028)
- qsm.exe (PID: 2164)
- RegSvcs.exe (PID: 3524)
- Fatura0025.scr (PID: 3948)
- RegSvcs.exe (PID: 2900)
- qsm.exe (PID: 1520)
REMCOS RAT was detected
- RegSvcs.exe (PID: 3524)
Changes the autorun value in the registry
- qsm.exe (PID: 1028)
- qsm.exe (PID: 2164)
SUSPICIOUS
Creates files in the user directory
- OUTLOOK.EXE (PID: 2072)
- RegSvcs.exe (PID: 3524)
Starts Internet Explorer
- OUTLOOK.EXE (PID: 2072)
Modifies files in Chrome extension folder
- chrome.exe (PID: 388)
Executable content was dropped or overwritten
- Fatura0025.scr (PID: 1916)
- qsm.exe (PID: 1028)
Drop AutoIt3 executable file
- Fatura0025.scr (PID: 1916)
Application launched itself
- qsm.exe (PID: 3004)
INFO
Application launched itself
- iexplore.exe (PID: 3928)
- iexplore.exe (PID: 2420)
- iexplore.exe (PID: 2652)
- iexplore.exe (PID: 3968)
- chrome.exe (PID: 388)
Changes internet zones settings
- iexplore.exe (PID: 2420)
- iexplore.exe (PID: 3928)
- iexplore.exe (PID: 2652)
- iexplore.exe (PID: 3968)
Reads internet explorer settings
- iexplore.exe (PID: 1244)
- iexplore.exe (PID: 1564)
- iexplore.exe (PID: 2440)
- iexplore.exe (PID: 3608)
Reads settings of System Certificates
- iexplore.exe (PID: 3928)
- iexplore.exe (PID: 2420)
- chrome.exe (PID: 388)
Reads Internet Cache Settings
- iexplore.exe (PID: 1244)
- iexplore.exe (PID: 1564)
- iexplore.exe (PID: 2420)
- iexplore.exe (PID: 2440)
- iexplore.exe (PID: 3608)
- chrome.exe (PID: 388)
Creates files in the user directory
- iexplore.exe (PID: 3928)
- iexplore.exe (PID: 1244)
- iexplore.exe (PID: 1564)
- iexplore.exe (PID: 2440)
- iexplore.exe (PID: 2420)
- iexplore.exe (PID: 3608)
Adds / modifies Windows certificates
- iexplore.exe (PID: 3928)
- iexplore.exe (PID: 2420)
Changes settings of System certificates
- iexplore.exe (PID: 3928)
- iexplore.exe (PID: 2420)
Reads Microsoft Office registry keys
- OUTLOOK.EXE (PID: 2072)
Dropped object may contain Bitcoin addresses
- iexplore.exe (PID: 1564)
- iexplore.exe (PID: 2652)
- qsm.exe (PID: 3004)
- qsm.exe (PID: 1520)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .eml | | | E-Mail message (Var. 5) (100) |
|---|
Total processes
75
Monitored processes
35
Malicious processes
7
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2072 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\EA396919-8758-8405-970F-F576EC8B84CE.eml" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
| 3928 | "C:\Program Files\Internet Explorer\iexplore.exe" https://onedrive.live.com/download?cid=4904002C61CC2C33&resid=4904002C61CC2C33%21118&authkey=AKss8cqqznj_GaY | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 3489660927 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 1244 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3928 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 2420 | "C:\Program Files\Internet Explorer\iexplore.exe" https://onedrive.live.com/download?cid=4904002C61CC2C33&resid=4904002C61CC2C33%21118&authkey=AKss8cqqznj_GaY | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 1564 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2420 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 2652 | "C:\Program Files\Internet Explorer\iexplore.exe" https://onedrive.live.com/download?cid=4904002C61CC2C33&resid=4904002C61CC2C33%21118&authkey=AKss8cqqznj_GaY | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 3489660927 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 2440 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2652 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 388 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | |
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 73.0.3683.75 | ||||
| 3640 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=73.0.3683.75 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6a240f18,0x6a240f28,0x6a240f34 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 73.0.3683.75 | ||||
| 3636 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=936 --on-initialized-event-handle=308 --parent-handle=312 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 73.0.3683.75 | ||||
Total events
4 887
Read events
4 126
Write events
0
Delete events
0
Modification events
Executable files
3
Suspicious files
60
Text files
358
Unknown types
14
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2072 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR5BA8.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3928 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2072 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:49B2DE6D5A72365A441EF470BF6F0C1E | SHA256:FD8C2B02AE68A9D2FE5036C806536D055E4F48C0202C15E8F2C8842648A43DB0 | |||
| 2072 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\676527F.dat | image | |
MD5:A809597A17123DDF70A6C24555C38EE9 | SHA256:5748DC9C9477A47DC28C8BD7B39C879AF88E145784031B74BEE6D310A32E5DF0 | |||
| 3928 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 1244 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:CA7966C98D99A4A4085F1B1C0B6B03CC | SHA256:42AE161D398A051A928CEFF8A0DEA65FB3A85EA8A2F32BF245DD7B53AB5520BA | |||
| 2072 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inf | text | |
MD5:48DD6CAE43CE26B992C35799FCD76898 | SHA256:7BFE1F3691E2B4FB4D61FBF5E9F7782FBE49DA1342DBD32201C2CC8E540DBD1A | |||
| 2072 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_AF54B5C6DF5EE148834B93CBD0B57253.dat | xml | |
MD5:B21ED3BD946332FF6EBC41A87776C6BB | SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4 | |||
| 2072 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{486BD43E-4EF4-4997-8CB6-E82B0B9FFBD2}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.png | image | |
MD5:7D80C0A7E3849818695EAF4989186A3C | SHA256:72DC527D78A8E99331409803811CC2D287E812C008A1C869A6AEA69D7A44B597 | |||
| 2072 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_5CD54A2FE957FE4C89451707CCD9E82B.dat | xml | |
MD5:EEAA832C12F20DE6AAAA9C7B77626E72 | SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
97
DNS requests
46
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1564 | iexplore.exe | GET | 302 | 52.142.114.176:80 | http://g.live.com/9uxp9en-us/ep_bro1 | IE | — | — | whitelisted |
2072 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
388 | chrome.exe | GET | 200 | 173.194.164.140:80 | http://r6---sn-4g5e6nle.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMjJlQUFXRC12Ny1ldUFnMXF3SDlXZDlFZw/7319.128.0.1_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mip=185.217.119.8&mm=28&mn=sn-4g5e6nle&ms=nvh&mt=1556195385&mv=m&pl=24&shardbypass=yes | US | crx | 842 Kb | whitelisted |
388 | chrome.exe | GET | 302 | 172.217.18.14:80 | http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMjJlQUFXRC12Ny1ldUFnMXF3SDlXZDlFZw/7319.128.0.1_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx | US | html | 504 b | whitelisted |
1564 | iexplore.exe | GET | 301 | 2.23.106.83:80 | http://www.microsoft.com/windows/downloads/ie/getitnow.mspx | unknown | html | 189 b | whitelisted |
2420 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
3928 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
2652 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
3968 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3928 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2420 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
1244 | iexplore.exe | 2.16.186.25:443 | spoprod-a.akamaihd.net | Akamai International B.V. | — | whitelisted |
1564 | iexplore.exe | 2.16.186.25:443 | spoprod-a.akamaihd.net | Akamai International B.V. | — | whitelisted |
1244 | iexplore.exe | 13.107.42.13:443 | onedrive.live.com | Microsoft Corporation | US | malicious |
1564 | iexplore.exe | 13.107.42.13:443 | onedrive.live.com | Microsoft Corporation | US | malicious |
3928 | iexplore.exe | 104.109.78.2:443 | p.sfx.ms | Akamai International B.V. | NL | whitelisted |
1244 | iexplore.exe | 13.107.42.12:443 | 3qru3g.bl.files.1drv.com | Microsoft Corporation | US | suspicious |
1244 | iexplore.exe | 104.109.78.2:443 | p.sfx.ms | Akamai International B.V. | NL | whitelisted |
2072 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
config.messenger.msn.com |
| whitelisted |
onedrive.live.com |
| shared |
www.bing.com |
| whitelisted |
spoprod-a.akamaihd.net |
| whitelisted |
p.sfx.ms |
| whitelisted |
3qru3g.bl.files.1drv.com |
| whitelisted |
g.live.com |
| whitelisted |
c.live.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
c.bing.com |
| whitelisted |