hawkeye_reborn | 1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325

General

Target

1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325.exe
Size

824KB
MD5

2576c26966ac131a4b4b036e910ee309
SHA1

fe4260b5e6242f44ce852b088b6e91adebd889d2
SHA256

1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325
SHA512

4f02d71d633d9d280f2d420c14340ece36112046ed93b857d10901ac2c094fd9a00848abbedb15b051d63fe51dad904914a23c03e2750472a285825c51aeea26

Score

10^/10

hawkeye_reborn m00nd3v_logger collection infostealer keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger Payload 1 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

Processes:

resource	yara_rule
behavioral2/memory/3652-141-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/5064-153-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/5064-155-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/5064-156-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/5064-157-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/1048-146-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/1048-148-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/1048-149-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/1048-150-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Nirsoft 8 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1048-146-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/1048-148-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/1048-149-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/1048-150-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/5064-153-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/5064-155-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/5064-156-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/5064-157-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Executes dropped EXE 2 IoCs

Processes:

appli.exeappli.exe

pid process

4372 appli.exe
3652 appli.exe

pid	process
4372	appli.exe
3652	appli.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

appli.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe\Debugger = "rundll32.exe"	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = "rundll32.exe"	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastSvc.exe\Debugger = "rundll32.exe"	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgidsagent.exe\Debugger = "rundll32.exe"	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe\Debugger = "rundll32.exe"	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe\Debugger = "rundll32.exe"	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastUI.exe\Debugger = "rundll32.exe"	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keyscrambler.exe	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe\Debugger = "rundll32.exe"	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgidsagent.exe	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spybotsd.exe	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "rundll32.exe"	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\instup.exe	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\instup.exe\Debugger = "rundll32.exe"	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "rundll32.exe"	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "rundll32.exe"	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spybotsd.exe\Debugger = "rundll32.exe"	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe\Debugger = "rundll32.exe"	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe\Debugger = "rundll32.exe"	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = "rundll32.exe"	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastUI.exe	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe\Debugger = "rundll32.exe"	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe\Debugger = "rundll32.exe"	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\Debugger = "rundll32.exe"	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe\Debugger = "rundll32.exe"	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\Debugger = "rundll32.exe"	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastSvc.exe	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe\Debugger = "rundll32.exe"	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe\Debugger = "rundll32.exe"	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbampt.exe	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keyscrambler.exe\Debugger = "rundll32.exe"	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe\Debugger = "rundll32.exe"	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe\Debugger = "rundll32.exe"	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe\Debugger = "rundll32.exe"	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe\Debugger = "rundll32.exe"	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "rundll32.exe"	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbampt.exe\Debugger = "rundll32.exe"	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe\Debugger = "rundll32.exe"	appli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccuac.exe	appli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccuac.exe\Debugger = "rundll32.exe"	appli.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

appli.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Local\\appli.exe -boot"	appli.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

appli.exeappli.exe

description	pid	process	target process
PID 4372 set thread context of 3652	4372	appli.exe	appli.exe
PID 3652 set thread context of 1048	3652	appli.exe	vbc.exe
PID 3652 set thread context of 5064	3652	appli.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325.exeappli.exevbc.exe

pid	process
1424	1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325.exe
4372	appli.exe
1048	vbc.exe
1048	vbc.exe
1048	vbc.exe
1048	vbc.exe
1048	vbc.exe
1048	vbc.exe
1048	vbc.exe
1048	vbc.exe
1048	vbc.exe
1048	vbc.exe
1048	vbc.exe
1048	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325.exeappli.exe

description	pid	process
Token: SeDebugPrivilege	1424	1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325.exe
Token: SeDebugPrivilege	4372	appli.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325.exeexplorer.exeappli.exeappli.exe

description	pid	process	target process
PID 1424 wrote to memory of 4332	1424	1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325.exe	cmd.exe
PID 1424 wrote to memory of 4332	1424	1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325.exe	cmd.exe
PID 1424 wrote to memory of 4332	1424	1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325.exe	cmd.exe
PID 1424 wrote to memory of 3960	1424	1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325.exe	explorer.exe
PID 1424 wrote to memory of 3960	1424	1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325.exe	explorer.exe
PID 1424 wrote to memory of 3960	1424	1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325.exe	explorer.exe
PID 4248 wrote to memory of 4372	4248	explorer.exe	appli.exe
PID 4248 wrote to memory of 4372	4248	explorer.exe	appli.exe
PID 4248 wrote to memory of 4372	4248	explorer.exe	appli.exe
PID 4372 wrote to memory of 3652	4372	appli.exe	appli.exe
PID 4372 wrote to memory of 3652	4372	appli.exe	appli.exe
PID 4372 wrote to memory of 3652	4372	appli.exe	appli.exe
PID 4372 wrote to memory of 3652	4372	appli.exe	appli.exe
PID 4372 wrote to memory of 3652	4372	appli.exe	appli.exe
PID 4372 wrote to memory of 3652	4372	appli.exe	appli.exe
PID 4372 wrote to memory of 3652	4372	appli.exe	appli.exe
PID 4372 wrote to memory of 3652	4372	appli.exe	appli.exe
PID 3652 wrote to memory of 1048	3652	appli.exe	vbc.exe
PID 3652 wrote to memory of 1048	3652	appli.exe	vbc.exe
PID 3652 wrote to memory of 1048	3652	appli.exe	vbc.exe
PID 3652 wrote to memory of 1048	3652	appli.exe	vbc.exe
PID 3652 wrote to memory of 1048	3652	appli.exe	vbc.exe
PID 3652 wrote to memory of 1048	3652	appli.exe	vbc.exe
PID 3652 wrote to memory of 1048	3652	appli.exe	vbc.exe
PID 3652 wrote to memory of 1048	3652	appli.exe	vbc.exe
PID 3652 wrote to memory of 1048	3652	appli.exe	vbc.exe
PID 3652 wrote to memory of 5064	3652	appli.exe	vbc.exe
PID 3652 wrote to memory of 5064	3652	appli.exe	vbc.exe
PID 3652 wrote to memory of 5064	3652	appli.exe	vbc.exe
PID 3652 wrote to memory of 5064	3652	appli.exe	vbc.exe
PID 3652 wrote to memory of 5064	3652	appli.exe	vbc.exe
PID 3652 wrote to memory of 5064	3652	appli.exe	vbc.exe
PID 3652 wrote to memory of 5064	3652	appli.exe	vbc.exe
PID 3652 wrote to memory of 5064	3652	appli.exe	vbc.exe
PID 3652 wrote to memory of 5064	3652	appli.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325.exe
"C:\Users\Admin\AppData\Local\Temp\1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325.exe" "C:\Users\Admin\AppData\Local\appli.exe"
2⤵
PID:4332

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Local\appli.exe"
2⤵
PID:3960

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4248

C:\Users\Admin\AppData\Local\appli.exe
"C:\Users\Admin\AppData\Local\appli.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372

C:\Users\Admin\AppData\Local\appli.exe
"C:\Users\Admin\AppData\Local\appli.exe"
3⤵
- Executes dropped EXE
- Sets file execution options in registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3652

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp49F.tmp"
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1048

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp16B1.tmp"
4⤵
- Accesses Microsoft Outlook accounts
PID:5064

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Scripting

1

T1064

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\appli.exe.log
Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp49F.tmp
Filesize
4KB

MD5
e64c42bc217d551e4168a94182323359

SHA1
76937b2d460a61e91393dc198b277c4171b11fd8

SHA256
9bf4040d8495d226d2fa94cc117181a753d36197a944e73c9f02186bc3d93454

SHA512
c1ff859dcd080e7c77a594c81b9e3068ac899db2b7ccb2c3672e988f5a616b292bc7feaabcd4d4966c41fa28584a5458be60cd7edc661d2d4f9de0520b5f52c9

Download Submit
C:\Users\Admin\AppData\Local\appli.exe
Filesize
824KB

MD5
2576c26966ac131a4b4b036e910ee309

SHA1
fe4260b5e6242f44ce852b088b6e91adebd889d2

SHA256
1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325

SHA512
4f02d71d633d9d280f2d420c14340ece36112046ed93b857d10901ac2c094fd9a00848abbedb15b051d63fe51dad904914a23c03e2750472a285825c51aeea26

Download Submit
C:\Users\Admin\AppData\Local\appli.exe
Filesize
824KB

MD5
2576c26966ac131a4b4b036e910ee309

SHA1
fe4260b5e6242f44ce852b088b6e91adebd889d2

SHA256
1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325

SHA512
4f02d71d633d9d280f2d420c14340ece36112046ed93b857d10901ac2c094fd9a00848abbedb15b051d63fe51dad904914a23c03e2750472a285825c51aeea26

Download Submit
C:\Users\Admin\AppData\Local\appli.exe
Filesize
824KB

MD5
2576c26966ac131a4b4b036e910ee309

SHA1
fe4260b5e6242f44ce852b088b6e91adebd889d2

SHA256
1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325

SHA512
4f02d71d633d9d280f2d420c14340ece36112046ed93b857d10901ac2c094fd9a00848abbedb15b051d63fe51dad904914a23c03e2750472a285825c51aeea26

Download Submit
memory/1048-145-0x0000000000000000-mapping.dmp

Download
memory/1048-150-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1048-149-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1048-148-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1048-146-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1424-131-0x0000000008620000-0x0000000008BC4000-memory.dmp

Filesize
5.6MB

Download
memory/1424-133-0x000000000BCC0000-0x000000000BCCA000-memory.dmp

Filesize
40KB

Download
memory/1424-130-0x0000000000FB0000-0x0000000001088000-memory.dmp

Filesize
864KB

Download
memory/1424-132-0x0000000008070000-0x0000000008102000-memory.dmp

Filesize
584KB

Download
memory/3652-144-0x0000000005A10000-0x0000000005A76000-memory.dmp

Filesize
408KB

Download
memory/3652-140-0x0000000000000000-mapping.dmp

Download
memory/3652-141-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/3960-135-0x0000000000000000-mapping.dmp

Download
memory/4332-134-0x0000000000000000-mapping.dmp

Download
memory/4372-139-0x0000000006D50000-0x0000000006DEC000-memory.dmp

Filesize
624KB

Download
memory/4372-137-0x0000000000000000-mapping.dmp

Download
memory/5064-152-0x0000000000000000-mapping.dmp

Download
memory/5064-153-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5064-155-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5064-156-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5064-157-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads