analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

evel2.eml

Full analysis: https://app.any.run/tasks/b5db2073-3a97-42ac-8b56-b459e9915fed
Verdict: Malicious activity
Threats:

LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals.

Malware Trends Tracker     >>>
Analysis date: January 23, 2019, 03:19:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
lokibot
Indicators:
MIME: message/rfc822
File info: RFC 822 mail, ASCII text, with CRLF line terminators
MD5:

3C4EF90B03F9B6B6D6414E4926056194

SHA1:

AD8B9396E5885396471F6ADDBF550D65D9C70732

SHA256:

7E1DCF7E387FF9A609EF8B729D9B389F655F33D50B4BADE475E0295F4A46F46E

SSDEEP:

12288:NZQd0KVXGnIh3flSYXfZmFDrhq+TorIAEYx:/CXGnIh30YZWror2Yx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • NEW_QUOTATION-PDF.exe (PID: 3336)
      • NEW_QUOTATION-PDF.exe (PID: 3564)

    • LokiBot was detected

      • NEW_QUOTATION-PDF.exe (PID: 3564)

    • Actions looks like stealing of personal data

      • NEW_QUOTATION-PDF.exe (PID: 3564)

  • SUSPICIOUS

    • Application launched itself

      • NEW_QUOTATION-PDF.exe (PID: 3336)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3028)
      • NEW_QUOTATION-PDF.exe (PID: 3564)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 3028)

    • Loads DLL from Mozilla Firefox

      • NEW_QUOTATION-PDF.exe (PID: 3564)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2860)
      • NEW_QUOTATION-PDF.exe (PID: 3564)

  • INFO

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 5) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start outlook.exe winrar.exe new_quotation-pdf.exe no specs #LOKIBOT new_quotation-pdf.exe

Process information

PID
CMD
Path
Indicators
Parent process
3028"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\evel2.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
2860"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\3Q7BUEK3\NEW_QUOTATION-ZIP.arj"C:\Program Files\WinRAR\WinRAR.exe
OUTLOOK.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3336"C:\Users\admin\AppData\Local\Temp\Rar$EXa2860.9189\NEW_QUOTATION-PDF.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2860.9189\NEW_QUOTATION-PDF.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3564"C:\Users\admin\AppData\Local\Temp\Rar$EXa2860.9189\NEW_QUOTATION-PDF.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2860.9189\NEW_QUOTATION-PDF.exe
NEW_QUOTATION-PDF.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 988
Read events
1 565
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
24
Unknown types
23

Dropped files

PID
Process
Filename
Type
3028OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVREA06.tmp.cvr —
MD5:—
SHA256:—
3028OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\tmpEBBD.tmp —
MD5:—
SHA256:—
3028OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\3Q7BUEK3\NEW_QUOTATION-ZIP (2).arj\:Zone.Identifier:$DATA —
MD5:—
SHA256:—
3564NEW_QUOTATION-PDF.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.lck —
MD5:—
SHA256:—
3028OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:93D1EB5207525DD42BCCE71D342FF198
SHA256:332EA772D2B2902A0166DA3D708ECC8B6D541B829ED108D22B41AD2D2E8DBF50
3028OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\3Q7BUEK3\NEW_QUOTATION-ZIP.arjcompressed
MD5:A93F7A4B1022ED6291F216EF4AD84E9E
SHA256:F3309FEFECC872EC1E3D4B0CDFC9B9F1BFFD27E6FCEEF17F3DEFDB4194EE488E
3028OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\3Q7BUEK3\NEW_QUOTATION-ZIP (2).arjcompressed
MD5:A93F7A4B1022ED6291F216EF4AD84E9E
SHA256:F3309FEFECC872EC1E3D4B0CDFC9B9F1BFFD27E6FCEEF17F3DEFDB4194EE488E
2860WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2860.9189\NEW_QUOTATION-PDF.exeexecutable
MD5:62BE2CC1B972D783B6372A45BA5559A6
SHA256:472C2D9A6B0819394A81A7D474A5B45980E26002C768F47FC1DDB9CE766A2645
3028OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_2DF8DE08235E27419A368BE0BC021C0A.datxml
MD5:B21ED3BD946332FF6EBC41A87776C6BB
SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4
3028OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{56E5434C-67DD-40A2-9470-3C4FE5417865}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:7D80C0A7E3849818695EAF4989186A3C
SHA256:72DC527D78A8E99331409803811CC2D287E812C008A1C869A6AEA69D7A44B597
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3028
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3028
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
illinosblower.com
  • —
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
evel2.eml