Overview

overview

10

Static

static

Purchase O...TD.exe

windows7_x64

10

Purchase O...TD.exe

windows10_x64

10

Analysis

  • max time kernel
    123s
  • max time network
    125s
  • platform
    windows10_x64
  • resource
    win10v200410
  • submitted
    16-04-2020 14:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Purchase Order PO-004276 dated 15042020 for EASTERN GUIDE ELECTRONICS PTE LTD.exe

  • Size

    797KB

  • MD5

    505264e67b6787fedea83f9e991af967

  • SHA1

    710f8b8cef9c23ca3a2e9a73ed77efad9b2dc417

  • SHA256

    ea20eb1a2d508640fc12743bce90d5ce169ea87fd394a701359429498aef934c

  • SHA512

    e75326df6e359362ec78d8c4ca175aeea475c0a2cad3d4437cf99ecc61c84854dbdee4e96fb46690724da700970f690faf316cd74785c9c99fb7f691ba6c517c

Score
10/10
keyloggertrojanstealerspywarehawkeye_reborn

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Purchase Order PO-004276 dated 15042020 for EASTERN GUIDE ELECTRONICS PTE LTD.exe
    "C:\Users\Admin\AppData\Local\Temp\Purchase Order PO-004276 dated 15042020 for EASTERN GUIDE ELECTRONICS PTE LTD.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetThreadContext
    PID:4036
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SsOOnpSFLbg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7649.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1828
    • C:\Users\Admin\AppData\Local\Temp\Purchase Order PO-004276 dated 15042020 for EASTERN GUIDE ELECTRONICS PTE LTD.exe
      "{path}"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2860

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Purchase Order PO-004276 dated 15042020 for EASTERN GUIDE ELECTRONICS PTE LTD.exe.log
    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp7649.tmp
    Download Submit

  • memory/2860-4-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

    Download