analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

999.9000000000061320787.eml

Full analysis: https://app.any.run/tasks/9f2c9a40-5f78-4642-a534-755bf96bd450
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: June 27, 2022, 09:45:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
Indicators:
MIME: message/rfc822
File info: RFC 822 mail, ASCII text
MD5:

09C0DA5732413E4109CD4E5C08F485C8

SHA1:

E309B9F33F599E68E8B577C16E4907CEA52F3C19

SHA256:

3C426974DE1CFD0C3EE467AFEDA7BF9EA5E3B2BC0790FDA1138C4263AAD78681

SSDEEP:

24576:a70DDbpyiQtzQ4CfWZKrVQDe2JhcG4cpYlJman:a7woiQtQHjVIMp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 3152)

    • Application was dropped or rewritten from another process

      • RFQ 10050395.exe (PID: 3932)
      • RFQ 10050395.exe (PID: 3308)
      • RFQ 10050395.exe (PID: 2632)
      • RFQ 10050395.exe (PID: 2536)

    • Steals credentials from Web Browsers

      • AppLaunch.exe (PID: 3232)

    • Stealing of credential data

      • AppLaunch.exe (PID: 3232)
      • AppLaunch.exe (PID: 2500)

    • Actions looks like stealing of personal data

      • AppLaunch.exe (PID: 3232)
      • AppLaunch.exe (PID: 2500)

  • SUSPICIOUS

    • Checks supported languages

      • OUTLOOK.EXE (PID: 2936)
      • WinRAR.exe (PID: 3152)
      • RFQ 10050395.exe (PID: 3308)
      • RFQ 10050395.exe (PID: 3932)
      • RFQ 10050395.exe (PID: 2632)
      • AppLaunch.exe (PID: 3232)
      • RFQ 10050395.exe (PID: 2536)
      • AppLaunch.exe (PID: 2500)

    • Reads the computer name

      • OUTLOOK.EXE (PID: 2936)
      • WinRAR.exe (PID: 3152)
      • RFQ 10050395.exe (PID: 3932)
      • RFQ 10050395.exe (PID: 3308)
      • RFQ 10050395.exe (PID: 2632)
      • AppLaunch.exe (PID: 3232)
      • AppLaunch.exe (PID: 2500)
      • RFQ 10050395.exe (PID: 2536)

    • Searches for installed software

      • OUTLOOK.EXE (PID: 2936)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2936)
      • AppLaunch.exe (PID: 3232)
      • AppLaunch.exe (PID: 2500)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3152)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3152)

    • Application launched itself

      • RFQ 10050395.exe (PID: 3308)
      • RFQ 10050395.exe (PID: 3932)

    • Reads the cookies of Mozilla Firefox

      • AppLaunch.exe (PID: 3232)

  • INFO

    • Manual execution by user

      • WinRAR.exe (PID: 3152)
      • RFQ 10050395.exe (PID: 3932)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2936)

    • Reads settings of System Certificates

      • RFQ 10050395.exe (PID: 2632)

    • Checks Windows Trust Settings

      • RFQ 10050395.exe (PID: 2632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 5) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
8
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start outlook.exe winrar.exe rfq 10050395.exe no specs rfq 10050395.exe no specs rfq 10050395.exe applaunch.exe rfq 10050395.exe no specs applaunch.exe

Process information

PID
CMD
Path
Indicators
Parent process
2936"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\999.9000000000061320787.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
3152"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\RFQ 10050395.z"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
3308"C:\Users\admin\AppData\Local\Temp\Rar$EXa3152.36902\RFQ 10050395.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3152.36902\RFQ 10050395.exe—WinRAR.exe
User:
admin
Company:
Marcos GTS
Integrity Level:
MEDIUM
Description:
TrafficlightController
Exit code:
0
Version:
1.0.0.0
3932"C:\Users\admin\Desktop\RFQ 10050395.exe" C:\Users\admin\Desktop\RFQ 10050395.exe—Explorer.EXE
User:
admin
Company:
Marcos GTS
Integrity Level:
MEDIUM
Description:
TrafficlightController
Exit code:
0
Version:
1.0.0.0
2632"C:\Users\admin\AppData\Local\Temp\Rar$EXa3152.36902\RFQ 10050395.exe"C:\Users\admin\AppData\Local\Temp\Rar$EXa3152.36902\RFQ 10050395.exe
RFQ 10050395.exe
User:
admin
Company:
Marcos GTS
Integrity Level:
MEDIUM
Description:
TrafficlightController
Version:
1.0.0.0
3232C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
RFQ 10050395.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
2536"C:\Users\admin\Desktop\RFQ 10050395.exe"C:\Users\admin\Desktop\RFQ 10050395.exe—RFQ 10050395.exe
User:
admin
Company:
Marcos GTS
Integrity Level:
MEDIUM
Description:
TrafficlightController
Version:
1.0.0.0
2500C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
RFQ 10050395.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Total events
12 143
Read events
11 422
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
9
Text files
15
Unknown types
4

Dropped files

PID
Process
Filename
Type
2936OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRCED0.tmp.cvr —
MD5:—
SHA256:—
2936OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
2936OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\tmpD019.tmpbinary
MD5:68B035588A08F57D5A6684D8B8B53A27
SHA256:3F8CBFE3D06ECB31BF12C37674210A6676BA5EB5EF27545639F76E3AC8A8D6BF
3152WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3152.38362\RFQ 10050395.exeexecutable
MD5:208B8885063F4562E1E181C63F155BD1
SHA256:A47F1B1A2995865A081E270569E3CB0857D3AF3759C2E06B72E3F418E9611A87
2936OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:BCB60D736701A4DB3B8B02CD3E6374AB
SHA256:2AF16C3028AA865E2A60644899D04EAB76FB462646CA328A58D1EDC2BD5EDD0C
2936OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\Z2OPWK9L\RFQ 10050395.zcompressed
MD5:EFCC79CCE430F9ED1ADC7C0FD5279C0B
SHA256:1722F9DCE9EC93C3DC6FEF892A57FC0DFD5D7E12C0DDB430AEF67809B731DA00
2936OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:5F2F55924B1FCF3CF4EBD1CD74E81424
SHA256:9B48F37C63A82161A03EA9E6A24F5069E4706B577D69457383DA93DDE0D294B4
3152WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3152.36902\RFQ 10050395.exeexecutable
MD5:208B8885063F4562E1E181C63F155BD1
SHA256:A47F1B1A2995865A081E270569E3CB0857D3AF3759C2E06B72E3F418E9611A87
2936OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_RssRule_2_C4FCD2D21C1DE6479EE86DF9E0FE4357.datxml
MD5:D8B37ED0410FB241C283F72B76987F18
SHA256:31E68049F6B7F21511E70CD7F2D95B9CF1354CF54603E8F47C1FC40F40B7A114
2936OUTLOOK.EXEC:\Users\admin\Desktop\RFQ 10050395.z:Zone.Identifier:$DATAtext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
5
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2936
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
2632
RFQ 10050395.exe
GET
200
192.124.249.24:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
US
der
1.69 Kb
whitelisted
2632
RFQ 10050395.exe
GET
200
192.124.249.24:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
US
der
1.66 Kb
whitelisted
2632
RFQ 10050395.exe
GET
200
192.124.249.24:80
http://ocsp.godaddy.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQC%2F44%2BOnb8HBQ%3D%3D
US
der
1.74 Kb
whitelisted
2632
RFQ 10050395.exe
GET
200
92.123.195.57:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f698669677282915
unknown
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2936
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2632
RFQ 10050395.exe
92.123.195.57:80
ctldl.windowsupdate.com
Akamai International B.V.
—
whitelisted
2632
RFQ 10050395.exe
149.154.167.220:443
api.telegram.org
Telegram Messenger LLP
GB
malicious
2632
RFQ 10050395.exe
192.124.249.24:80
ocsp.godaddy.com
Sucuri
US
suspicious

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
api.telegram.org
  • 149.154.167.220
shared
ctldl.windowsupdate.com
  • 92.123.195.57
  • 92.123.195.41
whitelisted
ocsp.godaddy.com
  • 192.124.249.24
  • 192.124.249.36
  • 192.124.249.22
  • 192.124.249.41
  • 192.124.249.23
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Telegram API Domain in DNS Lookup
2632
RFQ 10050395.exe
Misc activity
ET INFO Observed Telegram API Domain (api .telegram .org in TLS SNI)
2632
RFQ 10050395.exe
Misc activity
ET POLICY Telegram API Certificate Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
999.9000000000061320787.eml