Analysis
-
max time kernel
65s -
max time network
67s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
04-05-2020 19:58
Static task
static1
Behavioral task
behavioral1
Sample
KxAv6dlO4dTXfWq.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
KxAv6dlO4dTXfWq.exe
Resource
win10v200430
General
-
Target
KxAv6dlO4dTXfWq.exe
-
Size
240KB
-
MD5
23ffd35d0d0afd657a63be803e6d1049
-
SHA1
ef6c7aa6567da81a14fceb47858ece21cfb0aa45
-
SHA256
bd878970ab0cbcf5b29bf5a7e2f9ae25e81279ddc0cc30d59bdd242f40a465c2
-
SHA512
0915b561391c5c6127881d762eeb2d4c9d96c6462a8bef1c8827d875727879feb06e1b29b2596f7358b669f66d21f6ca67575e7644782541081301f2332a736f
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MSBuild.exepid process 860 MSBuild.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 bot.whatismyipaddress.com -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
KxAv6dlO4dTXfWq.exedescription pid process target process PID 2564 wrote to memory of 3732 2564 KxAv6dlO4dTXfWq.exe schtasks.exe PID 2564 wrote to memory of 3732 2564 KxAv6dlO4dTXfWq.exe schtasks.exe PID 2564 wrote to memory of 3732 2564 KxAv6dlO4dTXfWq.exe schtasks.exe PID 2564 wrote to memory of 672 2564 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 2564 wrote to memory of 672 2564 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 2564 wrote to memory of 672 2564 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 2564 wrote to memory of 804 2564 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 2564 wrote to memory of 804 2564 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 2564 wrote to memory of 804 2564 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 2564 wrote to memory of 860 2564 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 2564 wrote to memory of 860 2564 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 2564 wrote to memory of 860 2564 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 2564 wrote to memory of 860 2564 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 2564 wrote to memory of 860 2564 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 2564 wrote to memory of 860 2564 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 2564 wrote to memory of 860 2564 KxAv6dlO4dTXfWq.exe MSBuild.exe PID 2564 wrote to memory of 860 2564 KxAv6dlO4dTXfWq.exe MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
KxAv6dlO4dTXfWq.exedescription pid process target process PID 2564 set thread context of 860 2564 KxAv6dlO4dTXfWq.exe MSBuild.exe -
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
KxAv6dlO4dTXfWq.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 2564 KxAv6dlO4dTXfWq.exe Token: SeDebugPrivilege 860 MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
KxAv6dlO4dTXfWq.exeMSBuild.exepid process 2564 KxAv6dlO4dTXfWq.exe 2564 KxAv6dlO4dTXfWq.exe 2564 KxAv6dlO4dTXfWq.exe 2564 KxAv6dlO4dTXfWq.exe 860 MSBuild.exe 860 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\KxAv6dlO4dTXfWq.exe"C:\Users\Admin\AppData\Local\Temp\KxAv6dlO4dTXfWq.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2564 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\osYohnoDrGJg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8C1E.tmp"2⤵
- Creates scheduled task(s)
PID:3732 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"2⤵PID:672
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"2⤵PID:804
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:860