Analysis
-
max time kernel
149s -
max time network
76s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
04-05-2020 19:58
Static task
static1
Behavioral task
behavioral1
Sample
KxAv6dlO4dTXfWq.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
KxAv6dlO4dTXfWq.exe
Resource
win10v200430
General
-
Target
KxAv6dlO4dTXfWq.exe
-
Size
240KB
-
MD5
23ffd35d0d0afd657a63be803e6d1049
-
SHA1
ef6c7aa6567da81a14fceb47858ece21cfb0aa45
-
SHA256
bd878970ab0cbcf5b29bf5a7e2f9ae25e81279ddc0cc30d59bdd242f40a465c2
-
SHA512
0915b561391c5c6127881d762eeb2d4c9d96c6462a8bef1c8827d875727879feb06e1b29b2596f7358b669f66d21f6ca67575e7644782541081301f2332a736f
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
KxAv6dlO4dTXfWq.exedescription pid process target process PID 1360 set thread context of 1616 1360 KxAv6dlO4dTXfWq.exe MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MSBuild.exepid process 1616 MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
MSBuild.exepid process 1616 MSBuild.exe 1616 MSBuild.exe -
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
KxAv6dlO4dTXfWq.exedescription pid process target process PID 1360 wrote to memory of 1508 1360 KxAv6dlO4dTXfWq.exe schtasks.exe PID 1360 wrote to memory of 1508 1360 KxAv6dlO4dTXfWq.exe schtasks.exe PID 1360 wrote to memory of 1508 1360 KxAv6dlO4dTXfWq.exe schtasks.exe PID 1360 wrote to memory of 1508 1360 KxAv6dlO4dTXfWq.exe schtasks.exe PID 1360 wrote to memory of 1616 1360 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 1360 wrote to memory of 1616 1360 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 1360 wrote to memory of 1616 1360 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 1360 wrote to memory of 1616 1360 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 1360 wrote to memory of 1616 1360 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 1360 wrote to memory of 1616 1360 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 1360 wrote to memory of 1616 1360 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 1360 wrote to memory of 1616 1360 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 1360 wrote to memory of 1616 1360 KxAv6dlO4dTXfWq.exe MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 1616 MSBuild.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 bot.whatismyipaddress.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\KxAv6dlO4dTXfWq.exe"C:\Users\Admin\AppData\Local\Temp\KxAv6dlO4dTXfWq.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\osYohnoDrGJg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB9EB.tmp"2⤵
- Creates scheduled task(s)
PID:1508 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616