Malware Analysis Report

2025-01-18 02:42

Sample ID 220128-2jcwbaffg7
Target 068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73
SHA256 068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73
Tags
hawkeye_reborn m00nd3v_logger collection keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73

Threat Level: Known bad

The file 068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73 was found to be: Known bad.

Malicious Activity Summary

hawkeye_reborn m00nd3v_logger collection keylogger spyware stealer trojan

M00nd3v_Logger

HawkEye Reborn

NirSoft MailPassView

Nirsoft

M00nD3v Logger Payload

NirSoft WebBrowserPassView

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-28 22:36

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-28 22:36

Reported

2022-01-28 23:02

Platform

win7-en-20211208

Max time kernel

154s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe"

Signatures

HawkEye Reborn

keylogger trojan stealer spyware hawkeye_reborn

M00nd3v_Logger

stealer spyware m00nd3v_logger

M00nD3v Logger Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1564 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\SysWOW64\schtasks.exe
PID 1564 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\SysWOW64\schtasks.exe
PID 1564 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\SysWOW64\schtasks.exe
PID 1564 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\SysWOW64\schtasks.exe
PID 1564 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe
PID 1564 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe
PID 1564 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe
PID 1564 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe
PID 1564 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe
PID 1564 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe
PID 1564 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe
PID 1564 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe
PID 1564 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe
PID 1964 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe

"C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ABrPtoLb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDD54.tmp"

C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe

"C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp1748.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp9B2.tmp"

Network

N/A

Files

memory/1564-54-0x0000000075B51000-0x0000000075B53000-memory.dmp

memory/1564-55-0x00000000000F0000-0x0000000000133000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpDD54.tmp

MD5 7ccb9e5a4e513629d2800aea14ccc385
SHA1 b07a205b4545f52c16b8ac4d650e47fca50b6151
SHA256 6fc054747c7e51ba4e9320a388cb7216ded47dba285756820e527d2a95cecdbc
SHA512 3f6538e16e878f0e99e588ad286d9cdf1586114e1f325d6883b88410b98fe56c42b4311cd9cadaba43523b23d78610831017f38afcdae48ac56fa17d7bbfef0b

memory/1964-57-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1964-59-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1964-58-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1964-60-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1964-61-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1964-63-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

memory/1404-64-0x0000000000400000-0x000000000045B000-memory.dmp

memory/1404-65-0x0000000000400000-0x000000000045B000-memory.dmp

memory/1404-67-0x0000000000400000-0x000000000045B000-memory.dmp

memory/1404-68-0x0000000000400000-0x000000000045B000-memory.dmp

memory/1404-66-0x0000000000400000-0x000000000045B000-memory.dmp

memory/1404-69-0x0000000000400000-0x000000000045B000-memory.dmp

memory/1404-72-0x0000000000400000-0x000000000045B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1748.tmp

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/740-74-0x0000000000400000-0x000000000041C000-memory.dmp

memory/740-75-0x0000000000400000-0x000000000041C000-memory.dmp

memory/740-76-0x0000000000400000-0x000000000041C000-memory.dmp

memory/740-77-0x0000000000400000-0x000000000041C000-memory.dmp

memory/740-78-0x0000000000400000-0x000000000041C000-memory.dmp

memory/740-79-0x0000000000400000-0x000000000041C000-memory.dmp

memory/740-81-0x0000000000400000-0x000000000041C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-28 22:36

Reported

2022-01-28 23:02

Platform

win10-en-20211208

Max time kernel

152s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe"

Signatures

HawkEye Reborn

keylogger trojan stealer spyware hawkeye_reborn

M00nd3v_Logger

stealer spyware m00nd3v_logger

M00nD3v Logger Payload

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A bot.whatismyipaddress.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3048 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\SysWOW64\schtasks.exe
PID 3048 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\SysWOW64\schtasks.exe
PID 3048 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\SysWOW64\schtasks.exe
PID 3048 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe
PID 3048 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe
PID 3048 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe
PID 3048 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe
PID 3048 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe
PID 3048 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe
PID 3048 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe
PID 3048 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe
PID 2752 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2752 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2752 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2752 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2752 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2752 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2752 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2752 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2752 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2752 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2752 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2752 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2752 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2752 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2752 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2752 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2752 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2752 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe

"C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ABrPtoLb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC59E.tmp"

C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe

"C:\Users\Admin\AppData\Local\Temp\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpF875.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpFC7E.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 bot.whatismyipaddress.com udp

Files

memory/3048-117-0x0000000003030000-0x0000000003031000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpC59E.tmp

MD5 cc1808e94c79d7ff44708e268739a25b
SHA1 5e4d4887bcb38bec8ca328e832abc3c977653dfd
SHA256 675f371100596b8a0d27fc7f3adb20b6f8f4591ea458c80251da435d051365c8
SHA512 a79c3bedf3558f631c6e3b02bd4c67ea1da45a8e29b4aeec0e921719b1d257b40af0fef22daa5c3962b77e16fa834ad5bfca8293fa7fe9ff982bbe48c2f063d4

memory/2752-119-0x0000000000400000-0x0000000000490000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73.exe.log

MD5 63d5e381c73f51d67f146673b579e1e2
SHA1 f19bdac1f4240ae47c21b67e0cae827696e69352
SHA256 5b0f01dfcbb68a865042f6456c0861fa616f6b32886cec3acc07df6c22e0fba2
SHA512 cb6b0c3235a082b605d8d0a9cb567099db8026ddc4266ef3148412e49348135c0cc4b752d9212578914f30ef6b9ce4be21d5ee76fcc3ead5c84dd940f74b9611

memory/2752-121-0x0000000001490000-0x0000000001491000-memory.dmp

memory/1396-122-0x0000000000400000-0x000000000045B000-memory.dmp

memory/1396-140-0x0000000000400000-0x000000000045B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpF875.tmp

MD5 598aedc3862250a8590740a47d090605
SHA1 74d0d250683a480af0d2cf8d826d1f572f7ef5fd
SHA256 1b316d5728580fdf74ad8b6841b94dbe683b6d62c087eddf636f0599306e5172
SHA512 5096f5b3236b4f8f0346e3b0f20ee01ca5dc7e0ff41f4dddc2ea9658cbd7f8e05fa1276f5b0363f8696da83c402db8507ed636971ffc00bd36d1c8179f92a282

memory/1420-142-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1420-143-0x0000000000400000-0x000000000041C000-memory.dmp