Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23/09/2024, 16:05
General
-
Target
shipping-bill_PNR-Ref228C3290-12450-76123--BLMEDUU0610003--EBKG016897656.exe
-
Size
112KB
-
MD5
8685d406f3daa9573cd92ef858eacd04
-
SHA1
4ca949e3c62206c04d659bbe2d30d7c040023649
-
SHA256
5131026ed926f33115dafa7558e8892c1c5a274d57236f453ea8c160dfa81714
-
SHA512
3b5db98f613b8bdf0eb445fcd59c8506b8e2d53689eb4daecf34287308e580d757b43ec8c1c82342a213d8489134664ed0e09afaeb05b6221b9cfc429cb3a12b
-
SSDEEP
1536:NBG3z0LdQPaRxICmE90+2r3aIFZYIPZs7Dw/qxNRH4PHCski8ofNsn2nnPKzMBDV:XG3Udckmxa48Dw/qPxo3LfY2PKzY
Score
10/10
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\shipping-bill_PNR-Ref228C3290-12450-76123--BLMEDUU0610003--EBKG016897656.exe"C:\Users\Admin\AppData\Local\Temp\shipping-bill_PNR-Ref228C3290-12450-76123--BLMEDUU0610003--EBKG016897656.exe"1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
-
Filesize
76KB