analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

content-991525967-38927148539.eml

Full analysis: https://app.any.run/tasks/7c1ae0d0-5e56-4a62-94f8-4387230395da
Verdict: Malicious activity
Threats:

Ursnif is a banking Trojan that usually infects corporate victims. It is based on an old malware but was substantially updated over the years and became quite powerful. Today Ursnif is one of the most widely spread banking Trojans in the world.

Malware Trends Tracker     >>>
Analysis date: February 18, 2019, 09:13:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ursnif
Indicators:
MIME: message/rfc822
File info: RFC 822 mail, ASCII text, with very long lines, with CRLF, LF line terminators
MD5:

A173497D719B98F1CFD08870C4D8536B

SHA1:

152475BAA3C3EB85B160B57278BA03139541B96A

SHA256:

8D76B01BBA01E9E04B24D7B967958248E30DAED39FF88D7FE44691D4AFAF9F44

SSDEEP:

12288:CeQjSW4UMo35lz1v5qnPRxJgW7scHS4QFq+si:CPFIi1BWRV7dSXqo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • rundll32.exe (PID: 2724)
      • Проверить договор январь-февраль.exe (PID: 3656)
      • OUTLOOK.EXE (PID: 2992)
      • explorer.exe (PID: 2028)
      • WinRAR.exe (PID: 3148)

    • Loads the Task Scheduler COM API

      • Проверить договор январь-февраль.exe (PID: 3656)

    • Application was dropped or rewritten from another process

      • Проверить договор январь-февраль.exe (PID: 3656)

    • URSNIF was detected

      • rundll32.exe (PID: 2724)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2992)

    • Executable content was dropped or overwritten

      • Проверить договор январь-февраль.exe (PID: 3656)
      • WinRAR.exe (PID: 3148)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2992)

    • Creates files in the program directory

      • Проверить договор январь-февраль.exe (PID: 3656)

    • Connects to unusual port

      • rundll32.exe (PID: 2724)

  • INFO

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 5) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
5
Malicious processes
1
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start outlook.exe winrar.exe проверить договор январь-февраль.exe #URSNIF rundll32.exe explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2992"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\content-991525967-38927148539.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
3148"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\LK7FXKHB\Проверить договор январь-февраль.rar"C:\Program Files\WinRAR\WinRAR.exe
OUTLOOK.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3656"C:\Users\admin\AppData\Local\Temp\Rar$EXa3148.27931\Проверить договор январь-февраль.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3148.27931\Проверить договор январь-февраль.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2724rundll32.exe "C:\ProgramData\2401bf603c90\2702bc633f93.dat",DllGetClassObject rootC:\Windows\system32\rundll32.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2028C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 006
Read events
1 564
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
2
Text files
24
Unknown types
1

Dropped files

PID
Process
Filename
Type
2992OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR6AEF.tmp.cvr —
MD5:—
SHA256:—
2992OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\tmp6C77.tmp —
MD5:—
SHA256:—
2992OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\LK7FXKHB\Проверить договор январь-февраль (2).rar\:Zone.Identifier:$DATA —
MD5:—
SHA256:—
2724rundll32.exeC:\Users\admin\AppData\Local\Temp\EE48.tmp —
MD5:—
SHA256:—
2724rundll32.exeC:\Users\admin\AppData\Local\Temp\ainmpjbldhdnlppe —
MD5:—
SHA256:—
2724rundll32.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3148.27931\Проверить договор январь-февраль.exe —
MD5:—
SHA256:—
2724rundll32.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3148.27931\felcbfaffligogbc —
MD5:—
SHA256:—
2992OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:F3BF52E377516D4B876FFCA0108FA35F
SHA256:A296D1759A7F35A340C1CD6ED2E1F32F316AE41E0ACD8EB30C49F0894352D695
3656Проверить договор январь-февраль.exeC:\Users\admin\AppData\Local\Temp\EE48.tmpexecutable
MD5:637299B765F5790DCA95B1BF5092948C
SHA256:923E318BBB07309ED12BADBDAB53CDE98F3D2BFDE70EC27AF425319A9884C2C3
2992OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\LK7FXKHB\Проверить договор январь-февраль.rarcompressed
MD5:F33F64EB613BAD9C90D191BF9439FB41
SHA256:8B8809FBDCC460D94A404E7653966255B16EBA05B50554AA05033F52B24EC965
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
5
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2992
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
2724
rundll32.exe
GET
200
178.62.9.171:80
http://myip.ru/index_small.php
GB
html
325 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2724
rundll32.exe
192.155.83.101:9001
—
Linode, LLC
US
suspicious
2724
rundll32.exe
193.81.216.170:9001
—
A1 Telekom Austria AG
AT
unknown
2724
rundll32.exe
178.62.9.171:80
myip.ru
Digital Ocean, Inc.
GB
malicious
2724
rundll32.exe
172.245.24.228:9001
—
ColoCrossing
US
suspicious
2992
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
myip.ru
  • 178.62.9.171
unknown

Threats

PID
Process
Class
Message
2724
rundll32.exe
Potential Corporate Privacy Violation
ET POLICY myip.ru IP lookup
2724
rundll32.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 258
2724
rundll32.exe
Misc activity
ET POLICY TLS possible TOR SSL traffic
2724
rundll32.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 181
2724
rundll32.exe
Misc activity
ET POLICY TLS possible TOR SSL traffic
2724
rundll32.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Spy.Ursnif SSL TOR activity
2724
rundll32.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Spy.Ursnif SSL TOR activity
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
content-991525967-38927148539.eml