Malware Analysis Report

2025-06-16 02:24

Sample ID 220310-am58gsbhf3
Target 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf
SHA256 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf
Tags
hawkeye collection keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf

Threat Level: Known bad

The file 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf was found to be: Known bad.

Malicious Activity Summary

hawkeye collection keylogger persistence spyware stealer trojan

HawkEye

Nirsoft

Nirsoft

NirSoft MailPassView

NirSoft WebBrowserPassView

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-03-10 00:20

Signatures

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-03-10 00:20

Reported

2022-03-10 00:23

Platform

win7-20220223-en

Max time kernel

4294204s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD772571-A007-11EC-85A2-722BEAC141C4} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ab8535dea0c55241b6e6a02dc814678c0000000002000000000010660000000100002000000096bf2c2650cc5a0df9fe6f63a30314deebde6c9b3e69c779e051a1201bb47359000000000e8000000002000020000000ea821d3b0b71fd968b8fce186b4da7fc69cceeb619925fc3b335afcbd99de9839000000050b3969e89fdeaa050beb8cb066b946083286e69546fd6ae38a8ec3eb035f21cc5e99214857f7fbe00e0af229eb72c003421c3190ac710da9d107df1070ebcc34e322e36780d7e8f6f18b8211bdc7f07507374f6776d2dc7f9ed8a8d8103c6409c3ebb8af41681563579637211fd4be9c47afe174e5d7749d4854b9f6c47c172fcb4ff80c3b4ddb4f124370debe71437400000001c0e6843040af0abd9eb30358d84a96cb0d0c6591bc866e9914728b72cc82b90876d3db896b218cc8fc586fb6deda51f01592e3ee034a406f3842a55f861da29 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e051ccd41434d801 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "353636646" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ab8535dea0c55241b6e6a02dc814678c00000000020000000000106600000001000020000000b23dff280ce88c5547ddd649e2cf4f94f6f809d5eda21b9f3b84a559c58a62b5000000000e800000000200002000000034ec688d2d4a3d3e3207f206375bfd81d50bac451df5a722c42bfaf849e7a72c20000000bb7de44173577ef53258a341df89b117d97f02322ef14d6cd035839261575f1e4000000085ff8f2c0e80c09ecf6497c3f890ff16e30ae7175e29e9c19ea9c4ab88a545fcae2e826965f5315271c6dd425d75caba1bee4c15ee0d4650179d2a38c079a7e6 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2016 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2016 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2016 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2016 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1164 wrote to memory of 1644 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1164 wrote to memory of 1644 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1164 wrote to memory of 1644 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1164 wrote to memory of 1644 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2016 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2016 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe

"C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://www.google.com/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1164 CREDAT:275457 /prefetch:2

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.154.36:80 whatismyipaddress.com tcp
US 104.16.154.36:443 whatismyipaddress.com tcp
US 104.16.154.36:443 whatismyipaddress.com tcp
US 8.8.8.8:53 smtp.gmail.com udp
US 142.250.102.108:587 smtp.gmail.com tcp
NL 142.250.179.132:80 www.google.com tcp
NL 142.250.179.132:80 www.google.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
US 8.8.8.8:53 clients1.google.com udp
NL 142.250.179.174:443 clients1.google.com tcp
NL 142.250.179.174:443 clients1.google.com tcp
US 8.8.8.8:53 apis.google.com udp
NL 142.250.179.142:443 apis.google.com tcp
NL 142.250.179.142:443 apis.google.com tcp
US 8.8.8.8:53 ogs.google.com udp
NL 142.251.39.110:443 ogs.google.com tcp
NL 142.251.39.110:443 ogs.google.com tcp
US 8.8.8.8:53 play.google.com udp
NL 142.251.39.110:443 play.google.com tcp
NL 142.251.39.110:443 play.google.com tcp
US 142.250.102.108:587 smtp.gmail.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2016-54-0x0000000075751000-0x0000000075753000-memory.dmp

memory/2016-56-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

memory/2016-55-0x0000000074840000-0x0000000074DEB000-memory.dmp

memory/2016-57-0x0000000074840000-0x0000000074DEB000-memory.dmp

memory/2016-58-0x0000000000BE6000-0x0000000000BE7000-memory.dmp

memory/600-59-0x0000000000400000-0x000000000041B000-memory.dmp

memory/600-62-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\rx62z5k\imagestore.dat

MD5 1d512ad4f7b517d664ad9c81bb24f1cd
SHA1 307b86212c83fea334ac4a51f4248129e89c3a88
SHA256 d6593c4191d1615c473c42fc465bf7ac55d80de6415d5b2b9abffec18095ec61
SHA512 3b2a1ec6f12d9dd9406629d21ad5eef5468b05bd4201203cf6083210bd1ee7ce292c0b82674a32a860c7e00618d0ac52e934c763788fd0744e80cec6c10c2c8d

memory/2000-64-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2000-67-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bdb69c2f84abb4606a7245692b69dd83
SHA1 41fee8770a7394f54be1806a56c8511eb83ed0be
SHA256 8de29726972e2d0d0dd5797530105a0e27e74f3015181bcf8fa19687e4b2aa14
SHA512 89f78fa70cf9c9c9f2bb361fa9715e26e70eb66ddfb50af22b36918de43dd5da6b77df9dba06f5be8c5d6710b9bba7c767a6dd5b1c1f7785edb346bb87f9b782

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\SDZA3XVN.txt

MD5 bdc4886a81039f7a86c61823e9b49fb2
SHA1 83579778d66efe9a18faf84aad94a62bca86636d
SHA256 ff80ebd6f2534337bbaf2a1e5cefcb1c992d8fd227d10c8eb1317eed66a1d4e1
SHA512 4ff60e7d3588e1037f6308bd9c25cecba8b8b9b243e47f04cb2f47e68c1bfbc5a8431359f63d1b5131f85f9b9647e976a36a5864953cdc8f36cb80ac0cea21c8

Analysis: behavioral2

Detonation Overview

Submitted

2022-03-10 00:20

Reported

2022-03-10 00:23

Platform

win10v2004-en-20220113

Max time kernel

136s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe

"C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe"

C:\Windows\SysWOW64\fondue.exe

"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll

C:\Windows\system32\FonDUE.EXE

"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll

Network

Files

N/A