Analysis
-
max time kernel
151s -
max time network
36s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
08-06-2020 16:56
Static task
static1
Behavioral task
behavioral1
Sample
VGpf4astGj3sQeh.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
VGpf4astGj3sQeh.exe
Resource
win10v200430
General
-
Target
VGpf4astGj3sQeh.exe
-
Size
392KB
-
MD5
3ad2b596868395999cf1b9fdff597c61
-
SHA1
b79eca4f733c309d8683dbaee89d487de97d2873
-
SHA256
3a2adcac20af82cdb882ab9bd9a1a78ca30f833a488cd13a55daf8ff743271a3
-
SHA512
766ade300af51335fda0e37da034905c3699821cf2e33a462787288620d5062104fc9d6b791e873a893321dcc1ae450ce40403b6b997e46ec70c4a2a36b4c558
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
VGpf4astGj3sQeh.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 1520 VGpf4astGj3sQeh.exe Token: SeDebugPrivilege 1780 MSBuild.exe -
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
VGpf4astGj3sQeh.exeMSBuild.exedescription pid process target process PID 1520 wrote to memory of 1864 1520 VGpf4astGj3sQeh.exe schtasks.exe PID 1520 wrote to memory of 1864 1520 VGpf4astGj3sQeh.exe schtasks.exe PID 1520 wrote to memory of 1864 1520 VGpf4astGj3sQeh.exe schtasks.exe PID 1520 wrote to memory of 1864 1520 VGpf4astGj3sQeh.exe schtasks.exe PID 1520 wrote to memory of 1768 1520 VGpf4astGj3sQeh.exe MSBuild.exe PID 1520 wrote to memory of 1768 1520 VGpf4astGj3sQeh.exe MSBuild.exe PID 1520 wrote to memory of 1768 1520 VGpf4astGj3sQeh.exe MSBuild.exe PID 1520 wrote to memory of 1768 1520 VGpf4astGj3sQeh.exe MSBuild.exe PID 1520 wrote to memory of 1780 1520 VGpf4astGj3sQeh.exe MSBuild.exe PID 1520 wrote to memory of 1780 1520 VGpf4astGj3sQeh.exe MSBuild.exe PID 1520 wrote to memory of 1780 1520 VGpf4astGj3sQeh.exe MSBuild.exe PID 1520 wrote to memory of 1780 1520 VGpf4astGj3sQeh.exe MSBuild.exe PID 1520 wrote to memory of 1780 1520 VGpf4astGj3sQeh.exe MSBuild.exe PID 1520 wrote to memory of 1780 1520 VGpf4astGj3sQeh.exe MSBuild.exe PID 1520 wrote to memory of 1780 1520 VGpf4astGj3sQeh.exe MSBuild.exe PID 1520 wrote to memory of 1780 1520 VGpf4astGj3sQeh.exe MSBuild.exe PID 1520 wrote to memory of 1780 1520 VGpf4astGj3sQeh.exe MSBuild.exe PID 1780 wrote to memory of 1604 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1604 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1604 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1604 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1604 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1604 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1604 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1604 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1604 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1604 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1564 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1564 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1564 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1564 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1564 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1564 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1564 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1564 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1564 1780 MSBuild.exe vbc.exe PID 1780 wrote to memory of 1564 1780 MSBuild.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
VGpf4astGj3sQeh.exeMSBuild.exepid process 1520 VGpf4astGj3sQeh.exe 1780 MSBuild.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
VGpf4astGj3sQeh.exeMSBuild.exedescription pid process target process PID 1520 set thread context of 1780 1520 VGpf4astGj3sQeh.exe MSBuild.exe PID 1780 set thread context of 1604 1780 MSBuild.exe vbc.exe PID 1780 set thread context of 1564 1780 MSBuild.exe vbc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MSBuild.exepid process 1780 MSBuild.exe -
Uses the VBS compiler for execution 1 TTPs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VGpf4astGj3sQeh.exe"C:\Users\Admin\AppData\Local\Temp\VGpf4astGj3sQeh.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1520 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FnsdcIYzT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7973.tmp"2⤵
- Creates scheduled task(s)
PID:1864 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵PID:1768
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1780 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp9FD7.tmp"3⤵PID:1604
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp9231.tmp"3⤵PID:1564