File name:

content-991525967-38927148539.eml

Full analysis: https://app.any.run/tasks/7c1ae0d0-5e56-4a62-94f8-4387230395da
Verdict: Malicious activity
Threats:

Ursnif is a banking Trojan that usually infects corporate victims. It is based on an old malware but was substantially updated over the years and became quite powerful. Today Ursnif is one of the most widely spread banking Trojans in the world.

Malware Trends Tracker     >>>
Analysis date: February 18, 2019, 09:13:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ursnif
Indicators:
MIME: message/rfc822
File info: RFC 822 mail, ASCII text, with very long lines, with CRLF, LF line terminators
MD5:

A173497D719B98F1CFD08870C4D8536B

SHA1:

152475BAA3C3EB85B160B57278BA03139541B96A

SHA256:

8D76B01BBA01E9E04B24D7B967958248E30DAED39FF88D7FE44691D4AFAF9F44

SSDEEP:

12288:CeQjSW4UMo35lz1v5qnPRxJgW7scHS4QFq+si:CPFIi1BWRV7dSXqo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Проверить договор январь-февраль.exe (PID: 3656)

    • Loads dropped or rewritten executable

      • Проверить договор январь-февраль.exe (PID: 3656)
      • rundll32.exe (PID: 2724)
      • OUTLOOK.EXE (PID: 2992)
      • explorer.exe (PID: 2028)
      • WinRAR.exe (PID: 3148)

    • Loads the Task Scheduler COM API

      • Проверить договор январь-февраль.exe (PID: 3656)

    • URSNIF was detected

      • rundll32.exe (PID: 2724)

  • SUSPICIOUS

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2992)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2992)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3148)
      • Проверить договор январь-февраль.exe (PID: 3656)

    • Creates files in the program directory

      • Проверить договор январь-февраль.exe (PID: 3656)

    • Connects to unusual port

      • rundll32.exe (PID: 2724)

  • INFO

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 5) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
5
Malicious processes
1
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start outlook.exe winrar.exe проверить договор январь-февраль.exe #URSNIF rundll32.exe explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2028C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
2724rundll32.exe "C:\ProgramData\2401bf603c90\2702bc633f93.dat",DllGetClassObject rootC:\Windows\system32\rundll32.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2992"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\content-991525967-38927148539.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\progra~1\micros~1\office14\outlook.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3148"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\LK7FXKHB\Проверить договор январь-февраль.rar"C:\Program Files\WinRAR\WinRAR.exe
OUTLOOK.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3656"C:\Users\admin\AppData\Local\Temp\Rar$EXa3148.27931\Проверить договор январь-февраль.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3148.27931\Проверить договор январь-февраль.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3148.27931\проверить договор январь-февраль.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\certcli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
Total events
2 006
Read events
1 564
Write events
423
Delete events
19

Modification events

(PID) Process:(2992) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2992) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2992) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems
Operation:writeName:o>0
Value:
6F3E3000B00B0000010000000000000000000000
(PID) Process:(2992) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook
Operation:writeName:MTTT
Value:
B00B0000304A7D4B6AC7D40100000000
(PID) Process:(2992) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\SQM
Operation:writeName:SQMSessionNumber
Value:
0
(PID) Process:(2992) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\SQM
Operation:writeName:SQMSessionDate
Value:
219915360
(PID) Process:(2992) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\0a0d020000000000c000000000000046
Operation:writeName:00030429
Value:
03000000
(PID) Process:(2992) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\9375CFF0413111d3B88A00104B2A6676
Operation:writeName:{ED475418-B0D6-11D2-8C3B-00104B2A6676}
Value:
(PID) Process:(2992) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\9375CFF0413111d3B88A00104B2A6676
Operation:writeName:LastChangeVer
Value:
1200000000000000
(PID) Process:(2992) OUTLOOK.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109A10090400000000000F01FEC\Usage
Operation:writeName:OutlookMAPI2Intl_1033
Value:
1313996821
Executable files
3
Suspicious files
2
Text files
24
Unknown types
1

Dropped files

PID
Process
Filename
Type
2992OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR6AEF.tmp.cvr —
MD5:—
SHA256:—
2992OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\tmp6C77.tmp —
MD5:—
SHA256:—
2992OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\LK7FXKHB\Проверить договор январь-февраль (2).rar\:Zone.Identifier:$DATA —
MD5:—
SHA256:—
2724rundll32.exeC:\Users\admin\AppData\Local\Temp\EE48.tmp —
MD5:—
SHA256:—
2724rundll32.exeC:\Users\admin\AppData\Local\Temp\ainmpjbldhdnlppe —
MD5:—
SHA256:—
2724rundll32.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3148.27931\Проверить договор январь-февраль.exe —
MD5:—
SHA256:—
2724rundll32.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3148.27931\felcbfaffligogbc —
MD5:—
SHA256:—
2992OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inftext
MD5:48DD6CAE43CE26B992C35799FCD76898
SHA256:7BFE1F3691E2B4FB4D61FBF5E9F7782FBE49DA1342DBD32201C2CC8E540DBD1A
2992OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_RssRule_2_BA3F780B40CB9E4FB29920ED2E560E5A.datxml
MD5:D8B37ED0410FB241C283F72B76987F18
SHA256:31E68049F6B7F21511E70CD7F2D95B9CF1354CF54603E8F47C1FC40F40B7A114
2992OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_WorkHours_1_CA9E6ACBB090D94C92AA502F64B0E12E.datxml
MD5:807EF0FC900FEB3DA82927990083D6E7
SHA256:4411E7DC978011222764943081500FFF0E43CBF7CCD44264BD1AB6306CA68913
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
5
DNS requests
2
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2724
rundll32.exe
GET
200
178.62.9.171:80
http://myip.ru/index_small.php
GB
html
325 b
malicious
2992
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2992
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2724
rundll32.exe
178.62.9.171:80
myip.ru
Digital Ocean, Inc.
GB
malicious
2724
rundll32.exe
192.155.83.101:9001
—
Linode, LLC
US
suspicious
2724
rundll32.exe
172.245.24.228:9001
—
ColoCrossing
US
suspicious
2724
rundll32.exe
193.81.216.170:9001
—
A1 Telekom Austria AG
AT
unknown

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
myip.ru
  • 178.62.9.171
unknown

Threats

PID
Process
Class
Message
2724
rundll32.exe
Potential Corporate Privacy Violation
ET POLICY myip.ru IP lookup
2724
rundll32.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 258
2724
rundll32.exe
Misc activity
ET POLICY TLS possible TOR SSL traffic
2724
rundll32.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 181
2724
rundll32.exe
Misc activity
ET POLICY TLS possible TOR SSL traffic
2724
rundll32.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Spy.Ursnif SSL TOR activity
2724
rundll32.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Spy.Ursnif SSL TOR activity
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
content-991525967-38927148539.eml