URL:

http://mail-bigfile.hiworks.biz/service/download/dbe8d94bd81ed9de846a3746bc06328fb8446d046f6f1f32827bb2442e1e8c38

Full analysis: https://app.any.run/tasks/387536c5-6bdb-467c-823b-bb6cb8dae389
Verdict: Malicious activity
Threats:

GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities.

Malware Trends Tracker     >>>
Analysis date: December 19, 2023, 05:48:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
guloader
loader
trojan
rat
remcos
remote
stealer
Indicators:
MD5:

6BA4BD9239EBC0880ED03061810D0627

SHA1:

1C7362E8C006A09804AEEFE88EB950E6DC480C17

SHA256:

E5B451F801775ADBE0CBD65FA57C09D448A817E7246196C9FD5C26DE1835FFA1

SSDEEP:

3:N1KTDCx5AOMHxZK4mKBgH465SRLCTWNDBXdyEn:CB0uBgHr50DBt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • powershell.exe (PID: 2168)

    • REMCOS has been detected (SURICATA)

      • wab.exe (PID: 1384)

    • Actions looks like stealing of personal data

      • wab.exe (PID: 2880)
      • wab.exe (PID: 2876)
      • wab.exe (PID: 952)

    • Steals credentials from Web Browsers

      • wab.exe (PID: 952)

    • GULOADER has been detected (SURICATA)

      • wab.exe (PID: 1384)

    • Uses NirSoft utilities to collect credentials

      • wab.exe (PID: 2880)
      • wab.exe (PID: 952)

    • Steals credentials

      • wab.exe (PID: 952)
      • wab.exe (PID: 2880)

  • SUSPICIOUS

    • Reads the Internet Settings

      • ORDER#79956500027_20231219.com (PID: 1784)
      • wab.exe (PID: 1384)

    • Starts POWERSHELL.EXE for commands execution

      • ORDER#79956500027_20231219.com (PID: 1784)

    • Connects to the server without a host name

      • wab.exe (PID: 1384)

    • Application launched itself

      • wab.exe (PID: 1384)

    • Connects to unusual port

      • wab.exe (PID: 1384)

    • Accesses Microsoft Outlook profiles

      • wab.exe (PID: 2880)

    • Loads DLL from Mozilla Firefox

      • wab.exe (PID: 2876)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2036)
      • chrome.exe (PID: 3040)

    • Checks supported languages

      • ORDER#79956500027_20231219.com (PID: 1784)
      • wab.exe (PID: 1384)
      • wab.exe (PID: 2876)
      • wab.exe (PID: 2880)
      • wab.exe (PID: 952)

    • Reads the computer name

      • ORDER#79956500027_20231219.com (PID: 1784)
      • wab.exe (PID: 1384)
      • wab.exe (PID: 2876)
      • wab.exe (PID: 952)
      • wab.exe (PID: 2880)

    • The process uses the downloaded file

      • iexplore.exe (PID: 2036)
      • WinRAR.exe (PID: 1864)

    • Manual execution by a user

      • ORDER#79956500027_20231219.com (PID: 1784)
      • WINWORD.EXE (PID: 1992)
      • chrome.exe (PID: 3040)

    • Create files in a temporary directory

      • ORDER#79956500027_20231219.com (PID: 1784)
      • wab.exe (PID: 2880)
      • wab.exe (PID: 952)
      • wab.exe (PID: 2876)

    • Creates files in the program directory

      • ORDER#79956500027_20231219.com (PID: 1784)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1864)

    • Creates files or folders in the user directory

      • ORDER#79956500027_20231219.com (PID: 1784)
      • wab.exe (PID: 1384)

    • Checks proxy server information

      • wab.exe (PID: 1384)

    • Reads the machine GUID from the registry

      • wab.exe (PID: 1384)
      • wab.exe (PID: 952)
      • wab.exe (PID: 2876)

    • Reads Environment values

      • wab.exe (PID: 1384)

    • Reads product name

      • wab.exe (PID: 1384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
30
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe no specs order#79956500027_20231219.com no specs powershell.exe no specs #GULOADER wab.exe PhotoViewer.dll no specs winword.exe no specs wab.exe wab.exe wab.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
696"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2180 --field-trial-handle=1156,i,3523692383700943705,13714538708510562724,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
952"C:\Program Files\windows mail\wab.exe" /stext "C:\Users\admin\AppData\Local\Temp\fuzkefqfkhztmegvobtzjvzteh"C:\Program Files\windows mail\wab.exe
wab.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Contacts
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\program files\windows mail\wab.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1380"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3944 --field-trial-handle=1156,i,3523692383700943705,13714538708510562724,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1384"C:\Program Files\windows mail\wab.exe"C:\Program Files\windows mail\wab.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Contacts
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\mshtml.dll
c:\program files\windows mail\wab.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1596"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4012 --field-trial-handle=1156,i,3523692383700943705,13714538708510562724,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1784"C:\Users\admin\Desktop\ORDER#79956500027_20231219.com" C:\Users\admin\Desktop\ORDER#79956500027_20231219.com—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\desktop\order#79956500027_20231219.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1864"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\사본(11) - ORDER#79956500027_20231219.zip"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1992"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\leaddvd.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2028"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2340 --field-trial-handle=1156,i,3523692383700943705,13714538708510562724,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2036"C:\Program Files\Internet Explorer\iexplore.exe" "http://mail-bigfile.hiworks.biz/service/download/dbe8d94bd81ed9de846a3746bc06328fb8446d046f6f1f32827bb2442e1e8c38"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
17 382
Read events
17 048
Write events
186
Delete events
148

Modification events

(PID) Process:(2036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
3
Suspicious files
104
Text files
39
Unknown types
0

Dropped files

PID
Process
Filename
Type
2168powershell.exeC:\Users\admin\AppData\Local\Temp\rubious\Paagribelsernes92\dagtures\Dendropogon\Finansiererne\ORDER#79956500027_20231219.comexecutable
MD5:A61991F7B4B4DC37317D0EF860C9B70C
SHA256:5C30D414283FECBDD093B0231344C012A9A34F419DC02879D0A03ABA15D7E56B
1784ORDER#79956500027_20231219.comC:\Users\admin\AppData\Local\Temp\nsr58AC.tmpbinary
MD5:1525B399CEAD4390D44D1ED1F641B761
SHA256:8F75F74F504E42928EFBD672F20AACB2B6449397038A3CD811762AF2AEF11249
1864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1864.41443\ORDER#79956500027_20231219.comexecutable
MD5:A61991F7B4B4DC37317D0EF860C9B70C
SHA256:5C30D414283FECBDD093B0231344C012A9A34F419DC02879D0A03ABA15D7E56B
2168powershell.exeC:\Users\admin\AppData\Local\Temp\l4nlti4h.pzx.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1784ORDER#79956500027_20231219.comC:\ProgramData\palaemon.initext
MD5:099775EACEAAAEAA2E596328B08D2329
SHA256:C59C80CBEDBF82CA1C62553F5F07035660AAF55364F26F7CF6CFB97FFCD7D7D1
1784ORDER#79956500027_20231219.comC:\Users\admin\AppData\Local\Temp\rubious\Paagribelsernes92\dagtures\Albert.Fortext
MD5:348CFB4DCFE9026A0061C3B35A9FDDCB
SHA256:8EE4CCE104CF9C1EE9797202C3D04C91BC7A1769C146BEE29C50F816A4B26C3F
2168powershell.exeC:\Users\admin\AppData\Local\Temp\1lqjf3fm.y50.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1992WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR95CE.tmp.cvr —
MD5:—
SHA256:—
2036iexplore.exeC:\Users\admin\Downloads\사본(11) - ORDER#79956500027_20231219.zipcompressed
MD5:C1955D712A87EE33D91EEE11E7A2981C
SHA256:424D477B24663F6E2CDD68F4B7FC91A9F58056BB3D759F43C5B4F5A830D6087A
1784ORDER#79956500027_20231219.comC:\Users\admin\AppData\Local\Temp\rubious\Paagribelsernes92\dagtures\Orddelingerne.Aribinary
MD5:73E3AB6D5213AF174BDE45DEB2CE1DBB
SHA256:853A680980F537E138AE2E81BD471D9C699E2A667A7C33DEDF0691213B171885
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
36
DNS requests
30
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2036
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?914f352674d8023c
unknown
compressed
4.66 Kb
unknown
2068
iexplore.exe
GET
200
45.120.70.56:80
http://mail-bigfile.hiworks.biz/service/download/dbe8d94bd81ed9de846a3746bc06328fb8446d046f6f1f32827bb2442e1e8c38
unknown
compressed
286 Kb
unknown
2036
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ca04fd3518ca5bb7
unknown
compressed
4.66 Kb
unknown
2036
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?22dec979149153ff
unknown
compressed
4.66 Kb
unknown
1080
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a414549a770d7263
unknown
—
—
unknown
2036
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
1384
wab.exe
GET
—
146.70.79.70:80
http://146.70.79.70/doditAmnAdSOdqGlRTzkqvo161.bin
unknown
—
—
unknown
1384
wab.exe
GET
200
146.70.79.70:80
http://146.70.79.70/doditAmnAdSOdqGlRTzkqvo161.bin
unknown
binary
483 Kb
unknown
1384
wab.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
binary
950 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2068
iexplore.exe
45.120.70.56:80
mail-bigfile.hiworks.biz
LG DACOM Corporation
KR
unknown
2036
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
2036
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2036
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1080
svchost.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
1384
wab.exe
146.70.79.70:80
—
M247 Ltd
HK
unknown
1384
wab.exe
146.70.79.70:27000
—
M247 Ltd
HK
unknown
1384
wab.exe
178.237.33.50:80
geoplugin.net
Schuberg Philis B.V.
NL
malicious

DNS requests

Domain
IP
Reputation
mail-bigfile.hiworks.biz
  • 45.120.70.56
  • 45.120.70.100
unknown
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
geoplugin.net
  • 178.237.33.50
malicious
clientservices.googleapis.com
  • 142.250.185.163
whitelisted
accounts.google.com
  • 108.177.15.84
shared
www.google.com
  • 216.58.212.164
whitelisted
www.gstatic.com
  • 142.250.185.163
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
1384
wab.exe
A Network Trojan was detected
LOADER [ANY.RUN] GuLoader
1384
wab.exe
Potentially Bad Traffic
ET HUNTING Generic .bin download from Dotted Quad
1384
wab.exe
A Network Trojan was detected
LOADER [ANY.RUN] GuLoader
1384
wab.exe
Potentially Bad Traffic
ET HUNTING Generic .bin download from Dotted Quad
1384
wab.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
1384
wab.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
1384
wab.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
1384
wab.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://mail-bigfile.hiworks.biz/service/download/dbe8d94bd81ed9de846a3746bc06328fb8446d046f6f1f32827bb2442e1e8c38