File name: | Radicado- Del- Caso- En- Curso-.eml |
Full analysis: | https://app.any.run/tasks/9836cace-e3d0-48e8-bcaf-ce61a33a8fe2 |
Verdict: | Malicious activity |
Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
Analysis date: | March 31, 2023, 20:57:41 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | message/rfc822 |
File info: | RFC 822 mail, ASCII text, with very long lines, with CRLF line terminators |
MD5: | AE1CD5F8F17472EEF95EDBC914BD7E9E |
SHA1: | 1E0047CFD3C88080F1068DFD35A10625C93BB12E |
SHA256: | E4D9E8ECB5391DC8034F8A93BA296A7917EBAFF319D4D14CB94153A861F7D55E |
SSDEEP: | 768:Ss2dhfhv9yi1FqhQCZetBrx2bmel9QOj92x:SVZDiHg8MOgx |
.eml | | | E-Mail message (Var. 5) (100) |
---|
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2680 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\Radicado- Del- Caso- En- Curso-.eml" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 Modules
| |||||||||||||||
3348 | "C:\Program Files\Internet Explorer\iexplore.exe" http://webdefence.global.blackspider.com/urlwrap/?q=AXicFcpPDsFAFIDx1yNwCDvT0aYJkob4E4KFjYRlzYwxMp1Xb6YtR3BGJ3ALLL7V7-vM4c0jeHUjIPtMRpp5alhZGCvQBULLBJaQJoclp-bCs2GaZOAVNUYYZMIa5YKa0rn8f7_gGkLlx3EsUXimEbVVf4prMVGPCinkEltnsZA9I_PBpqTTqtgGnc382u1TKfpH14oFV_Xdq90NAD55BF8Rozfr&Z | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3764 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3348 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
2904 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Folio Y Acta Entregada 7.tar" | C:\Program Files\WinRAR\WinRAR.exe | — | iexplore.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
3928 | "C:\Users\admin\AppData\Local\Temp\Rar$EXb2904.32530\Folio Y Acta Entregada 7.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXb2904.32530\Folio Y Acta Entregada 7.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe Acrobat Exit code: 4294967295 Version: 23.1.20064.0 Modules
| |||||||||||||||
2736 | "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\admin\AppData\Roaming\Gkdf.exe'" /f | C:\Windows\System32\cmd.exe | — | Folio Y Acta Entregada 7.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
1620 | "cmd" /c copy "C:\Users\admin\AppData\Local\Temp\Rar$EXb2904.32530\Folio Y Acta Entregada 7.exe" "C:\Users\admin\AppData\Roaming\Gkdf.exe" | C:\Windows\System32\cmd.exe | — | Folio Y Acta Entregada 7.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
952 | schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\admin\AppData\Roaming\Gkdf.exe'" /f | C:\Windows\System32\schtasks.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3480 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\admin\AppData\Local\Temp\Rar$EXb2904.32530\Folio Y Acta Entregada 7.exe'" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | Folio Y Acta Entregada 7.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
3180 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe | Folio Y Acta Entregada 7.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Version: 4.0.30319.34209 built by: FX452RTMGDR Modules
Remcos(PID) Process(3180) csc.exe Hosts (1)estefanjkfk.duckdns.org:6000 BotnetMiosssf Connect_interval1 Install_flagFalse Install_HKCU\RunTrue Install_HKLM\RunTrue Install_HKLM\Explorer\Run1 Setup_path%LOCALAPPDATA% Copy_fileremcos.exe Startup_valueRemcos Hide_fileFalse Mutex_nameRmc-YGFXSD Keylog_flag1 Keylog_path%LOCALAPPDATA% Keylog_fileregistros.dat Keylog_cryptFalse Hide_keylogFalse Screenshot_flagFalse Screenshot_time5 Take_ScreenshotFalse Screenshot_path%APPDATA% Screenshot_fileCapturas de pantalla Screenshot_cryptFalse Mouse_optionFalse Delete_fileFalse Audio_record_time5 Audio_path%ProgramFiles% Audio_dirMicRecords Connect_delay0 Copy_dirRemcos Keylog_dirremcos Max_keylog_file100000 |
(PID) Process: | (2680) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (2680) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1041 |
Value: On | |||
(PID) Process: | (2680) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1046 |
Value: On | |||
(PID) Process: | (2680) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1036 |
Value: On | |||
(PID) Process: | (2680) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1031 |
Value: On | |||
(PID) Process: | (2680) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1040 |
Value: On | |||
(PID) Process: | (2680) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1049 |
Value: On | |||
(PID) Process: | (2680) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 3082 |
Value: On | |||
(PID) Process: | (2680) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1042 |
Value: On | |||
(PID) Process: | (2680) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1055 |
Value: On |
PID | Process | Filename | Type | |
---|---|---|---|---|
2680 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRF83B.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2680 | OUTLOOK.EXE | C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst | — | |
MD5:— | SHA256:— | |||
2680 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:6EFCA87F90F95FE336D677016AD301A0 | SHA256:BD4BF10BF29F6C0F45D27C4F193055FBEBD9CC9E164746FF73534D1D10C416AD | |||
2680 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{F96867B9-F68F-45C6-AB78-657C3CB00A35}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.png | image | |
MD5:4C61C12EDBC453D7AE184976E95258E1 | SHA256:296526F9A716C1AA91BA5D6F69F0EB92FDF79C2CB2CFCF0CEB22B7CCBC27035F | |||
2680 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:3D9EAA4FAB110CA72926AABD1FE9C2E4 | SHA256:922EE5F459E616DC4360546CAB5BD841EFF74EBF748B2C2FA451E76659336CE6 | |||
2680 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_RssRule_2_82166543FC8FA8498873CC6AE5B511EB.dat | xml | |
MD5:D8B37ED0410FB241C283F72B76987F18 | SHA256:31E68049F6B7F21511E70CD7F2D95B9CF1354CF54603E8F47C1FC40F40B7A114 | |||
2680 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inf | text | |
MD5:F3B25701FE362EC84616A93A45CE9998 | SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209 | |||
2680 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_32FBBACB81D30448880AD5E344343348.dat | xml | |
MD5:BBCF400BD7AE536EB03054021D6A6398 | SHA256:383020065C1F31F4FB09F448599A6D5E532C390AF4E5B8AF0771FE17A23222AD | |||
2680 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_217548752A92074DA51C241E8EC8B6FD.dat | xml | |
MD5:EEAA832C12F20DE6AAAA9C7B77626E72 | SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16 | |||
2680 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_WorkHours_1_E93876B551243045BFF0537063356CB6.dat | xml | |
MD5:807EF0FC900FEB3DA82927990083D6E7 | SHA256:4411E7DC978011222764943081500FFF0E43CBF7CCD44264BD1AB6306CA68913 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3764 | iexplore.exe | GET | 200 | 85.115.52.220:80 | http://www.mailcontrol.com/http-resources/notification-pages/empty.js | GB | — | — | whitelisted |
2680 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
3764 | iexplore.exe | GET | 403 | 208.87.233.180:80 | http://webdefence.global.blackspider.com/urlwrap/?q=AXicFcpPDsFAFIDx1yNwCDvT0aYJkob4E4KFjYRlzYwxMp1Xb6YtR3BGJ3ALLL7V7-vM4c0jeHUjIPtMRpp5alhZGCvQBULLBJaQJoclp-bCs2GaZOAVNUYYZMIa5YKa0rn8f7_gGkLlx3EsUXimEbVVf4prMVGPCinkEltnsZA9I_PBpqTTqtgGnc382u1TKfpH14oFV_Xdq90NAD55BF8Rozfr&Z | US | html | 5.01 Kb | whitelisted |
3764 | iexplore.exe | GET | 403 | 208.87.233.180:80 | http://webdefence.global.blackspider.com/urlwrap/?q=AXicFYxLTsMwGITdI8AhWCAldpy4titVIF5F0EU3IFg6v52nE7d2ksIROCMn4BYkI400i--bi3v0S1bo53KFvP2msoyDn-JO1RZcP3hnY3AdSunbI_FTQZhIKUPB-KmG2sVga9MP5tbn3cLNRdUwHMMGY-0gIiEiIppXiEvnSmvG2Vx-Z2nhFyjgYGD0JgCuFPFOpryEEbjl2hRFG0ZblaziXX5McOuGU1M0nIKsSGhbkU1ZbQisadkPKZM4WQtC5ZoyMgcTyuaVCSkzngrOhUgEvsbJS-c_d-p1KNldeO4PqYbooz_DAzHjKZh9c2O22p1765S-Gsdab0ERAZliEVDCo4ylKlIaWJRroUyuiAQD6PT1vts3m-OBPW1mTGQZQn_bFfoHJBJwJQ&action=scan | US | html | 4.90 Kb | whitelisted |
3764 | iexplore.exe | GET | 200 | 85.115.52.220:80 | http://www.mailcontrol.com/http-resources/notification-pages/2020/notification_page_logo_145x35.png | GB | image | 4.24 Kb | whitelisted |
3764 | iexplore.exe | GET | 303 | 208.87.233.180:80 | http://webdefence.global.blackspider.com/urlwrap/?q=AXicFcpNEsEwGIDhr0fgEHbSaHVUZzqM_8HChmFZSVRMmq-StOUIzugEboHFu3re1hTe1INX2wOjnsEwJ9bUpMikYqidQUUYFhAG-zk19YVGcRhEYIWpJZNImJJCOzE25-L__YKrc6VNfJ8jsyRHzJX4k1-xkXiUaFzKsdEKM96RPO2tC3NaZhuXRxO70ruQs-5RN2xGRXW3YnuD--Ow3N6SchctkoAO4n4f4JN68AVCAz0P&action=scan | US | html | 5.01 Kb | whitelisted |
3764 | iexplore.exe | GET | 200 | 85.115.52.220:80 | http://www.mailcontrol.com/http-resources/notification-pages/notification.css | GB | text | 5.06 Kb | whitelisted |
3764 | iexplore.exe | GET | 200 | 85.115.52.220:80 | http://www.mailcontrol.com/http-resources/notification-pages/icons60/warning.png | GB | image | 5.02 Kb | whitelisted |
3764 | iexplore.exe | GET | 403 | 208.87.233.180:80 | http://webdefence.global.blackspider.com/urlwrap/?q=AXicFcpPDsFAFIDx1yNwCDvT0aYJkob4E4KFjYRlzYwxMp1Xb6YtR3BGJ3ALLL7V7-vM4c0jeHUjIPtMRpp5alhZGCvQBULLBJaQJoclp-bCs2GaZOAVNUYYZMIa5YKa0rn8f7_gGkLlx3EsUXimEbVVf4prMVGPCinkEltnsZA9I_PBpqTTqtgGnc382u1TKfpH14oFV_Xdq90NAD55BF8Rozfr&Z | US | html | 5.01 Kb | whitelisted |
3764 | iexplore.exe | GET | 200 | 142.250.185.195:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCAnAYBLgi%2BghKCkyxZyQ88 | US | der | 472 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3348 | iexplore.exe | 204.79.197.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2680 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
3348 | iexplore.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
3348 | iexplore.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
3764 | iexplore.exe | 85.115.52.220:80 | www.mailcontrol.com | Forcepoint Cloud Ltd | GB | unknown |
3764 | iexplore.exe | 208.87.233.180:80 | webdefence.global.blackspider.com | Forcepoint Cloud Ltd | US | unknown |
3764 | iexplore.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
3764 | iexplore.exe | 142.250.185.195:80 | ocsp.pki.goog | GOOGLE | US | whitelisted |
3348 | iexplore.exe | 152.199.19.161:443 | r20swj13mr.microsoft.com | EDGECAST | US | whitelisted |
— | — | 142.250.185.193:443 | doc-0s-08-docs.googleusercontent.com | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
webdefence.global.blackspider.com |
| whitelisted |
www.mailcontrol.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
iecvlist.microsoft.com |
| whitelisted |
doc-0s-08-docs.googleusercontent.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain |
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
3180 | csc.exe | Unknown Classtype | ET MALWARE Remcos 3.x Unencrypted Checkin |
3180 | csc.exe | Unknown Classtype | ET MALWARE Remcos 3.x Unencrypted Server Response |