Malware Analysis Report

2025-01-02 14:19

Sample ID 220714-dwkvpabdap
Target 4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c
SHA256 4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c
Tags
hawkeye keylogger spyware stealer trojan collection
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c

Threat Level: Known bad

The file 4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c was found to be: Known bad.

Malicious Activity Summary

hawkeye keylogger spyware stealer trojan collection

HawkEye

Nirsoft

NirSoft MailPassView

NirSoft WebBrowserPassView

Executes dropped EXE

Checks computer location settings

Deletes itself

Loads dropped DLL

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of UnmapMainImage

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-14 03:21

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-14 03:21

Reported

2022-07-14 05:10

Platform

win7-20220414-en

Max time kernel

148s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1948 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe
PID 1948 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe
PID 1948 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe
PID 1948 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe
PID 1456 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1456 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1456 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1456 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1456 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1456 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1456 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 848 wrote to memory of 552 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 848 wrote to memory of 552 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 848 wrote to memory of 552 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 848 wrote to memory of 552 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 848 wrote to memory of 552 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 848 wrote to memory of 552 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 848 wrote to memory of 552 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe

"C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe"

C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe

C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

"C:\Users\Admin\AppData\Roaming\Windows Update.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

C:\Users\Admin\AppData\Roaming\Windows Update.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.155.36:80 whatismyipaddress.com tcp
US 104.16.155.36:443 whatismyipaddress.com tcp
US 104.16.155.36:443 whatismyipaddress.com tcp

Files

memory/1948-56-0x0000000000280000-0x0000000000288000-memory.dmp

memory/1948-57-0x0000000076571000-0x0000000076573000-memory.dmp

memory/1456-58-0x00000000004A632F-mapping.dmp

memory/1948-59-0x00000000778E0000-0x0000000077A60000-memory.dmp

memory/1456-63-0x0000000000400000-0x0000000000477000-memory.dmp

memory/1456-66-0x00000000000E0000-0x0000000000170000-memory.dmp

memory/1456-69-0x00000000778E0000-0x0000000077A60000-memory.dmp

memory/1456-70-0x00000000778E0000-0x0000000077A60000-memory.dmp

memory/1456-71-0x0000000074940000-0x0000000074EEB000-memory.dmp

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 919fad47fb64a39ead7e17dfbe4cfc06
SHA1 5397ecbfee38cc27ad328c80de850a1da0334734
SHA256 4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c
SHA512 d0e0b93b39730a6ba98f1af3af0d10948c4fe036b940fc3520ad7a667a94641c447fdcb66ee0716b632bec2cb588594e884f1ba58a23f8d2eea5de0666775005

memory/848-73-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 919fad47fb64a39ead7e17dfbe4cfc06
SHA1 5397ecbfee38cc27ad328c80de850a1da0334734
SHA256 4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c
SHA512 d0e0b93b39730a6ba98f1af3af0d10948c4fe036b940fc3520ad7a667a94641c447fdcb66ee0716b632bec2cb588594e884f1ba58a23f8d2eea5de0666775005

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 919fad47fb64a39ead7e17dfbe4cfc06
SHA1 5397ecbfee38cc27ad328c80de850a1da0334734
SHA256 4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c
SHA512 d0e0b93b39730a6ba98f1af3af0d10948c4fe036b940fc3520ad7a667a94641c447fdcb66ee0716b632bec2cb588594e884f1ba58a23f8d2eea5de0666775005

memory/1456-77-0x00000000778E0000-0x0000000077A60000-memory.dmp

memory/1456-78-0x0000000074940000-0x0000000074EEB000-memory.dmp

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 919fad47fb64a39ead7e17dfbe4cfc06
SHA1 5397ecbfee38cc27ad328c80de850a1da0334734
SHA256 4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c
SHA512 d0e0b93b39730a6ba98f1af3af0d10948c4fe036b940fc3520ad7a667a94641c447fdcb66ee0716b632bec2cb588594e884f1ba58a23f8d2eea5de0666775005

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 919fad47fb64a39ead7e17dfbe4cfc06
SHA1 5397ecbfee38cc27ad328c80de850a1da0334734
SHA256 4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c
SHA512 d0e0b93b39730a6ba98f1af3af0d10948c4fe036b940fc3520ad7a667a94641c447fdcb66ee0716b632bec2cb588594e884f1ba58a23f8d2eea5de0666775005

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 919fad47fb64a39ead7e17dfbe4cfc06
SHA1 5397ecbfee38cc27ad328c80de850a1da0334734
SHA256 4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c
SHA512 d0e0b93b39730a6ba98f1af3af0d10948c4fe036b940fc3520ad7a667a94641c447fdcb66ee0716b632bec2cb588594e884f1ba58a23f8d2eea5de0666775005

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 919fad47fb64a39ead7e17dfbe4cfc06
SHA1 5397ecbfee38cc27ad328c80de850a1da0334734
SHA256 4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c
SHA512 d0e0b93b39730a6ba98f1af3af0d10948c4fe036b940fc3520ad7a667a94641c447fdcb66ee0716b632bec2cb588594e884f1ba58a23f8d2eea5de0666775005

memory/552-85-0x00000000004A632F-mapping.dmp

memory/848-88-0x00000000778E0000-0x0000000077A60000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 919fad47fb64a39ead7e17dfbe4cfc06
SHA1 5397ecbfee38cc27ad328c80de850a1da0334734
SHA256 4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c
SHA512 d0e0b93b39730a6ba98f1af3af0d10948c4fe036b940fc3520ad7a667a94641c447fdcb66ee0716b632bec2cb588594e884f1ba58a23f8d2eea5de0666775005

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 919fad47fb64a39ead7e17dfbe4cfc06
SHA1 5397ecbfee38cc27ad328c80de850a1da0334734
SHA256 4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c
SHA512 d0e0b93b39730a6ba98f1af3af0d10948c4fe036b940fc3520ad7a667a94641c447fdcb66ee0716b632bec2cb588594e884f1ba58a23f8d2eea5de0666775005

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 919fad47fb64a39ead7e17dfbe4cfc06
SHA1 5397ecbfee38cc27ad328c80de850a1da0334734
SHA256 4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c
SHA512 d0e0b93b39730a6ba98f1af3af0d10948c4fe036b940fc3520ad7a667a94641c447fdcb66ee0716b632bec2cb588594e884f1ba58a23f8d2eea5de0666775005

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 919fad47fb64a39ead7e17dfbe4cfc06
SHA1 5397ecbfee38cc27ad328c80de850a1da0334734
SHA256 4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c
SHA512 d0e0b93b39730a6ba98f1af3af0d10948c4fe036b940fc3520ad7a667a94641c447fdcb66ee0716b632bec2cb588594e884f1ba58a23f8d2eea5de0666775005

memory/552-94-0x0000000000400000-0x0000000000477000-memory.dmp

memory/552-99-0x0000000000480000-0x0000000000510000-memory.dmp

memory/552-98-0x0000000000482000-0x000000000050A000-memory.dmp

memory/552-101-0x0000000008C60000-0x0000000009758000-memory.dmp

memory/552-102-0x00000000778E0000-0x0000000077A60000-memory.dmp

memory/552-103-0x00000000778E0000-0x0000000077A60000-memory.dmp

memory/552-104-0x0000000074390000-0x000000007493B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 1ecd6816a51877ed449c46e97da68163
SHA1 ead75fb308c112ddd346330050e5dbcc56cb8246
SHA256 aab13006a002ff3b7708c6a90f67752834c25aa4f6822f54531133fa4ea1f481
SHA512 b989bd5df9e706adcb51cde8c052fc7e7b7829ffc010377acf2fffd85c3ca282324c26f8557c1cccf1cdd005fdb65ff7252c47769fd5df151c246adecf4cfac8

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-14 03:21

Reported

2022-07-14 05:11

Platform

win10v2004-20220414-en

Max time kernel

141s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe N/A

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4052 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe
PID 4052 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe
PID 4052 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe
PID 424 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 424 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 424 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1940 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1940 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1940 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2624 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe

"C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe"

C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe

C:\Users\Admin\AppData\Local\Temp\4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

"C:\Users\Admin\AppData\Roaming\Windows Update.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

C:\Users\Admin\AppData\Roaming\Windows Update.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
US 52.242.97.97:443 tcp
US 209.197.3.8:80 tcp
IE 13.69.239.73:443 tcp
US 8.8.8.8:53 96.108.152.52.in-addr.arpa udp
US 67.26.211.254:80 tcp
US 67.26.211.254:80 tcp
US 8.8.8.8:53 7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa udp
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.155.36:80 whatismyipaddress.com tcp
US 104.16.155.36:443 whatismyipaddress.com tcp
US 204.79.197.203:80 tcp
US 8.8.8.8:53 smtp.yandex.com udp
RU 77.88.21.158:587 smtp.yandex.com tcp

Files

memory/4052-132-0x00000000029A0000-0x00000000029A8000-memory.dmp

memory/424-133-0x0000000000000000-mapping.dmp

memory/4052-134-0x00000000770A0000-0x0000000077243000-memory.dmp

memory/424-135-0x00000000770A0000-0x0000000077243000-memory.dmp

memory/424-138-0x0000000000400000-0x0000000000477000-memory.dmp

memory/424-141-0x0000000006AB0000-0x0000000006B40000-memory.dmp

memory/424-144-0x00000000770A0000-0x0000000077243000-memory.dmp

memory/424-145-0x0000000074710000-0x0000000074CC1000-memory.dmp

memory/1940-146-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 919fad47fb64a39ead7e17dfbe4cfc06
SHA1 5397ecbfee38cc27ad328c80de850a1da0334734
SHA256 4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c
SHA512 d0e0b93b39730a6ba98f1af3af0d10948c4fe036b940fc3520ad7a667a94641c447fdcb66ee0716b632bec2cb588594e884f1ba58a23f8d2eea5de0666775005

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 919fad47fb64a39ead7e17dfbe4cfc06
SHA1 5397ecbfee38cc27ad328c80de850a1da0334734
SHA256 4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c
SHA512 d0e0b93b39730a6ba98f1af3af0d10948c4fe036b940fc3520ad7a667a94641c447fdcb66ee0716b632bec2cb588594e884f1ba58a23f8d2eea5de0666775005

memory/424-149-0x00000000770A0000-0x0000000077243000-memory.dmp

memory/424-152-0x0000000074710000-0x0000000074CC1000-memory.dmp

memory/2624-153-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 919fad47fb64a39ead7e17dfbe4cfc06
SHA1 5397ecbfee38cc27ad328c80de850a1da0334734
SHA256 4858c75de20e121e8fea9996ad070ee4759764b46cc247687bf42af3ac08c46c
SHA512 d0e0b93b39730a6ba98f1af3af0d10948c4fe036b940fc3520ad7a667a94641c447fdcb66ee0716b632bec2cb588594e884f1ba58a23f8d2eea5de0666775005

memory/1940-155-0x00000000770A0000-0x0000000077243000-memory.dmp

memory/2624-161-0x0000000006A90000-0x0000000006B20000-memory.dmp

memory/2624-164-0x00000000770A0000-0x0000000077243000-memory.dmp

memory/2624-165-0x00000000770A0000-0x0000000077243000-memory.dmp

memory/2624-166-0x0000000074710000-0x0000000074CC1000-memory.dmp

memory/2624-167-0x0000000074710000-0x0000000074CC1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 1ecd6816a51877ed449c46e97da68163
SHA1 ead75fb308c112ddd346330050e5dbcc56cb8246
SHA256 aab13006a002ff3b7708c6a90f67752834c25aa4f6822f54531133fa4ea1f481
SHA512 b989bd5df9e706adcb51cde8c052fc7e7b7829ffc010377acf2fffd85c3ca282324c26f8557c1cccf1cdd005fdb65ff7252c47769fd5df151c246adecf4cfac8

memory/2388-169-0x0000000000000000-mapping.dmp

memory/2388-170-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2388-172-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2388-173-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2624-174-0x00000000770A0000-0x0000000077243000-memory.dmp

memory/2624-175-0x0000000074710000-0x0000000074CC1000-memory.dmp

memory/3860-176-0x0000000000000000-mapping.dmp

memory/3860-177-0x0000000000400000-0x0000000000458000-memory.dmp

memory/3860-179-0x0000000000400000-0x0000000000458000-memory.dmp

memory/3860-180-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

MD5 f94dc819ca773f1e3cb27abbc9e7fa27
SHA1 9a7700efadc5ea09ab288544ef1e3cd876255086
SHA256 a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA512 72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

memory/3860-182-0x0000000000400000-0x0000000000458000-memory.dmp