Analysis
-
max time kernel
152s -
max time network
113s -
platform
windows7_x64 -
resource
win7v200217 -
submitted
19-03-2020 13:09
Static task
static1
Behavioral task
behavioral1
Sample
260017# PURCHASE LIST pdf.exe
Resource
win7v200217
Behavioral task
behavioral2
Sample
260017# PURCHASE LIST pdf.exe
Resource
win10v200217
General
-
Target
260017# PURCHASE LIST pdf.exe
-
Size
1.1MB
-
MD5
2a01ff3fa54364cc15e6535be1e57cca
-
SHA1
8c1d0197d9fac0d7d580702860d35049424aa9af
-
SHA256
3dd0e88a93b6d4fa561f0ece77fee607262c53a5ecb7164b64c29505b88083a8
-
SHA512
3a2467296decf132a37fa164424acee57a3299e4d851829786359d0b2c9c41e62a5f136049b06ae2e51697f27561f7d24f86e4c5a12f024a7305d81089d9b041
Malware Config
Signatures
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
260017# PURCHASE LIST pdf.exe260017# PURCHASE LIST pdf.exedescription pid process target process PID 1844 set thread context of 1944 1844 260017# PURCHASE LIST pdf.exe 260017# PURCHASE LIST pdf.exe PID 1944 set thread context of 1096 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 set thread context of 240 1944 260017# PURCHASE LIST pdf.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
vbc.exepid process 1096 vbc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
HawkEye Reborn
HawkEye Reborn is an enchanced version of the HawkEye malware kit.
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
260017# PURCHASE LIST pdf.exe260017# PURCHASE LIST pdf.exedescription pid process target process PID 1844 wrote to memory of 1900 1844 260017# PURCHASE LIST pdf.exe schtasks.exe PID 1844 wrote to memory of 1900 1844 260017# PURCHASE LIST pdf.exe schtasks.exe PID 1844 wrote to memory of 1900 1844 260017# PURCHASE LIST pdf.exe schtasks.exe PID 1844 wrote to memory of 1900 1844 260017# PURCHASE LIST pdf.exe schtasks.exe PID 1844 wrote to memory of 1944 1844 260017# PURCHASE LIST pdf.exe 260017# PURCHASE LIST pdf.exe PID 1844 wrote to memory of 1944 1844 260017# PURCHASE LIST pdf.exe 260017# PURCHASE LIST pdf.exe PID 1844 wrote to memory of 1944 1844 260017# PURCHASE LIST pdf.exe 260017# PURCHASE LIST pdf.exe PID 1844 wrote to memory of 1944 1844 260017# PURCHASE LIST pdf.exe 260017# PURCHASE LIST pdf.exe PID 1844 wrote to memory of 1944 1844 260017# PURCHASE LIST pdf.exe 260017# PURCHASE LIST pdf.exe PID 1844 wrote to memory of 1944 1844 260017# PURCHASE LIST pdf.exe 260017# PURCHASE LIST pdf.exe PID 1844 wrote to memory of 1944 1844 260017# PURCHASE LIST pdf.exe 260017# PURCHASE LIST pdf.exe PID 1844 wrote to memory of 1944 1844 260017# PURCHASE LIST pdf.exe 260017# PURCHASE LIST pdf.exe PID 1844 wrote to memory of 1944 1844 260017# PURCHASE LIST pdf.exe 260017# PURCHASE LIST pdf.exe PID 1944 wrote to memory of 1096 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 1096 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 1096 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 1096 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 1096 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 1096 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 1096 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 1096 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 1096 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 1096 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 240 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 240 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 240 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 240 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 240 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 240 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 240 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 240 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 240 1944 260017# PURCHASE LIST pdf.exe vbc.exe PID 1944 wrote to memory of 240 1944 260017# PURCHASE LIST pdf.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\260017# PURCHASE LIST pdf.exe"C:\Users\Admin\AppData\Local\Temp\260017# PURCHASE LIST pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DkoKQhprZPZjG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD825.tmp"2⤵
- Creates scheduled task(s)
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\260017# PURCHASE LIST pdf.exe"{path}"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpEA0.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1096 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp7D.tmp"3⤵PID:240