Managed XDR

purchase-order-cooling...k-rafiq-investment.eml (CloudEyE) — malware analysis report

File info

Filename
purchase-order-cooling-tower-rak-thermik-rafiq-investment.eml
File type
RFC 822 mail, ASCII text
File size
957.9 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
f6f2c1a137b50ccd454271ec4ca8f6bf5c2810e0
SHA256
fbd7293aef7a655b002f2401372c7fc5f5939f8b9a25654eb6c265d61cb9b0f5
MD5
6d286b79dac51f56a23927ef0b26f5d3

Malwares

  • CloudEyE

Signatures

Execution

T1059.001 suspicious_powershell: Creates suspicious powershell process
T1047 has_wmi: Executes one or several WMI requests
T1059 nsis_suspicious_filenames: Nsis contains files with suspicious names
T1106 susp_callbacks: Suspicious usage of some WinAPI with callbacks

Privilege Escalation

T1055.012 injection_runpe: Injects code into another process
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1055.012 injection_runpe: Injects code into another process
T1036.001 invalid_authenticode: Digital signature of the executable file has failed the verification
T1027.002 guloader_behaviour: Cloudeye/GuLoader specific behaviour has been detected
T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1497 antidbg_setinformationthread: Attempts to evade debugger using NtSetInformationThread
T1480 system_default_lang_id_present: Checks the system language
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1027.002 nsis_suspicious_filenames: Nsis contains files with suspicious names
T1027.002 nsis_archive: One of the packages is NSIS archive

Credential Access

T1555.003 cookie_files: Accesses cookie files
T1552 cookie_files: Accesses cookie files

Discovery

T1497 antidbg_setinformationthread: Attempts to evade debugger using NtSetInformationThread
T1057 has_wmi: Executes one or several WMI requests
T1082 reads_csrss: Attempts to read csrss.exe memory

Command and Control

T1071.001 wininet_openurl: Performs HTTP/HTTPS-requests using InternetOpenUrl

Other

copies_self: Creates a copy of itself
creates_exe: Creates executable files in the file system
dead_host: Connects to IP addresses that do not respond to requests
unexpected_exception: Unexpected exception
no_graphical_activity: No graphic activity
create_rpc_bindings: Creates RPC connection
creates_suspended_process: Creates suspended process
get_policy_info: Retrieves information about a Policy object
checktokenmembership: Checks user token with CheckTokenMembership call
pe_overlay: PE file contains overlay

Related reports