Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    19-07-2022 20:20

General

  • Target

    4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792.exe

  • Size

    970KB

  • MD5

    7368657baf850ecfd5d70e1f8e2a0fcd

  • SHA1

    70ec9d06ecd975708e1589da9900a75c8846e843

  • SHA256

    4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792

  • SHA512

    a54bf8e35f1209b4a6f22eccbda4ff95071791c870c7b5b88f7c511f66b4c3e2055ee9b6dfebe02154898e494244eb3614927a1144537b9e7d890915301ded8a

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    alibaba1234

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • NirSoft MailPassView 7 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 7 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 12 IoCs
  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792.exe
    "C:\Users\Admin\AppData\Local\Temp\4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1132
    • C:\Users\Admin\AppData\Local\Temp\4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792.exe
      C:\Users\Admin\AppData\Local\Temp\4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:984
      • C:\Users\Admin\AppData\Roaming\Windows Update.exe
        "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1552
        • C:\Users\Admin\AppData\Roaming\Windows Update.exe
          C:\Users\Admin\AppData\Roaming\Windows Update.exe"
          4⤵
          • Executes dropped EXE
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:1316
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
            5⤵
            • Accesses Microsoft Outlook accounts
            PID:1960
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
            5⤵
              PID:1604

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

      Filesize

      102B

      MD5

      789604969bcc4a6b979d79fef4470935

      SHA1

      d29d62732533dec35a81559259de1b4e7c2cfe9e

      SHA256

      172c35024fde99fd313b733a569270c0648f9f366e8d03370d11ff5cfe0bd1cb

      SHA512

      a971a46171714fab7ff4ed02ae12a1b2320fbd9faf90ea49f428ec5d1368cbf947bdd3bdd97fa16217b5de491dcb660f132896724139494377f3ae1ed74217ef

    • C:\Users\Admin\AppData\Local\Temp\holderwb.txt

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • C:\Users\Admin\AppData\Roaming\Windows Update.exe

      Filesize

      970KB

      MD5

      7368657baf850ecfd5d70e1f8e2a0fcd

      SHA1

      70ec9d06ecd975708e1589da9900a75c8846e843

      SHA256

      4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792

      SHA512

      a54bf8e35f1209b4a6f22eccbda4ff95071791c870c7b5b88f7c511f66b4c3e2055ee9b6dfebe02154898e494244eb3614927a1144537b9e7d890915301ded8a

    • C:\Users\Admin\AppData\Roaming\Windows Update.exe

      Filesize

      970KB

      MD5

      7368657baf850ecfd5d70e1f8e2a0fcd

      SHA1

      70ec9d06ecd975708e1589da9900a75c8846e843

      SHA256

      4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792

      SHA512

      a54bf8e35f1209b4a6f22eccbda4ff95071791c870c7b5b88f7c511f66b4c3e2055ee9b6dfebe02154898e494244eb3614927a1144537b9e7d890915301ded8a

    • C:\Users\Admin\AppData\Roaming\Windows Update.exe

      Filesize

      970KB

      MD5

      7368657baf850ecfd5d70e1f8e2a0fcd

      SHA1

      70ec9d06ecd975708e1589da9900a75c8846e843

      SHA256

      4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792

      SHA512

      a54bf8e35f1209b4a6f22eccbda4ff95071791c870c7b5b88f7c511f66b4c3e2055ee9b6dfebe02154898e494244eb3614927a1144537b9e7d890915301ded8a

    • \Users\Admin\AppData\Roaming\Windows Update.exe

      Filesize

      970KB

      MD5

      7368657baf850ecfd5d70e1f8e2a0fcd

      SHA1

      70ec9d06ecd975708e1589da9900a75c8846e843

      SHA256

      4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792

      SHA512

      a54bf8e35f1209b4a6f22eccbda4ff95071791c870c7b5b88f7c511f66b4c3e2055ee9b6dfebe02154898e494244eb3614927a1144537b9e7d890915301ded8a

    • \Users\Admin\AppData\Roaming\Windows Update.exe

      Filesize

      970KB

      MD5

      7368657baf850ecfd5d70e1f8e2a0fcd

      SHA1

      70ec9d06ecd975708e1589da9900a75c8846e843

      SHA256

      4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792

      SHA512

      a54bf8e35f1209b4a6f22eccbda4ff95071791c870c7b5b88f7c511f66b4c3e2055ee9b6dfebe02154898e494244eb3614927a1144537b9e7d890915301ded8a

    • \Users\Admin\AppData\Roaming\Windows Update.exe

      Filesize

      970KB

      MD5

      7368657baf850ecfd5d70e1f8e2a0fcd

      SHA1

      70ec9d06ecd975708e1589da9900a75c8846e843

      SHA256

      4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792

      SHA512

      a54bf8e35f1209b4a6f22eccbda4ff95071791c870c7b5b88f7c511f66b4c3e2055ee9b6dfebe02154898e494244eb3614927a1144537b9e7d890915301ded8a

    • \Users\Admin\AppData\Roaming\Windows Update.exe

      Filesize

      970KB

      MD5

      7368657baf850ecfd5d70e1f8e2a0fcd

      SHA1

      70ec9d06ecd975708e1589da9900a75c8846e843

      SHA256

      4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792

      SHA512

      a54bf8e35f1209b4a6f22eccbda4ff95071791c870c7b5b88f7c511f66b4c3e2055ee9b6dfebe02154898e494244eb3614927a1144537b9e7d890915301ded8a

    • \Users\Admin\AppData\Roaming\Windows Update.exe

      Filesize

      970KB

      MD5

      7368657baf850ecfd5d70e1f8e2a0fcd

      SHA1

      70ec9d06ecd975708e1589da9900a75c8846e843

      SHA256

      4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792

      SHA512

      a54bf8e35f1209b4a6f22eccbda4ff95071791c870c7b5b88f7c511f66b4c3e2055ee9b6dfebe02154898e494244eb3614927a1144537b9e7d890915301ded8a

    • \Users\Admin\AppData\Roaming\Windows Update.exe

      Filesize

      970KB

      MD5

      7368657baf850ecfd5d70e1f8e2a0fcd

      SHA1

      70ec9d06ecd975708e1589da9900a75c8846e843

      SHA256

      4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792

      SHA512

      a54bf8e35f1209b4a6f22eccbda4ff95071791c870c7b5b88f7c511f66b4c3e2055ee9b6dfebe02154898e494244eb3614927a1144537b9e7d890915301ded8a

    • \Users\Admin\AppData\Roaming\Windows Update.exe

      Filesize

      970KB

      MD5

      7368657baf850ecfd5d70e1f8e2a0fcd

      SHA1

      70ec9d06ecd975708e1589da9900a75c8846e843

      SHA256

      4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792

      SHA512

      a54bf8e35f1209b4a6f22eccbda4ff95071791c870c7b5b88f7c511f66b4c3e2055ee9b6dfebe02154898e494244eb3614927a1144537b9e7d890915301ded8a

    • \Users\Admin\AppData\Roaming\Windows Update.exe

      Filesize

      970KB

      MD5

      7368657baf850ecfd5d70e1f8e2a0fcd

      SHA1

      70ec9d06ecd975708e1589da9900a75c8846e843

      SHA256

      4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792

      SHA512

      a54bf8e35f1209b4a6f22eccbda4ff95071791c870c7b5b88f7c511f66b4c3e2055ee9b6dfebe02154898e494244eb3614927a1144537b9e7d890915301ded8a

    • memory/984-69-0x0000000008CA0000-0x0000000009798000-memory.dmp

      Filesize

      11.0MB

    • memory/984-77-0x0000000077100000-0x0000000077280000-memory.dmp

      Filesize

      1.5MB

    • memory/984-78-0x00000000742D0000-0x000000007487B000-memory.dmp

      Filesize

      5.7MB

    • memory/984-72-0x00000000742D0000-0x000000007487B000-memory.dmp

      Filesize

      5.7MB

    • memory/984-70-0x0000000077100000-0x0000000077280000-memory.dmp

      Filesize

      1.5MB

    • memory/984-71-0x00000000098C0000-0x0000000009A48000-memory.dmp

      Filesize

      1.5MB

    • memory/984-66-0x0000000002620000-0x00000000026B0000-memory.dmp

      Filesize

      576KB

    • memory/984-63-0x0000000000400000-0x0000000000477000-memory.dmp

      Filesize

      476KB

    • memory/1132-59-0x0000000077100000-0x0000000077280000-memory.dmp

      Filesize

      1.5MB

    • memory/1132-57-0x0000000074F41000-0x0000000074F43000-memory.dmp

      Filesize

      8KB

    • memory/1132-56-0x00000000002D0000-0x00000000002D7000-memory.dmp

      Filesize

      28KB

    • memory/1316-121-0x0000000074220000-0x00000000747CB000-memory.dmp

      Filesize

      5.7MB

    • memory/1316-106-0x0000000077100000-0x0000000077280000-memory.dmp

      Filesize

      1.5MB

    • memory/1316-95-0x0000000000230000-0x0000000000322000-memory.dmp

      Filesize

      968KB

    • memory/1316-98-0x0000000000400000-0x0000000000477000-memory.dmp

      Filesize

      476KB

    • memory/1316-102-0x00000000025A0000-0x0000000002630000-memory.dmp

      Filesize

      576KB

    • memory/1316-105-0x0000000008CD0000-0x00000000097C8000-memory.dmp

      Filesize

      11.0MB

    • memory/1316-118-0x0000000006C95000-0x0000000006CA6000-memory.dmp

      Filesize

      68KB

    • memory/1316-107-0x0000000077100000-0x0000000077280000-memory.dmp

      Filesize

      1.5MB

    • memory/1316-108-0x0000000074220000-0x00000000747CB000-memory.dmp

      Filesize

      5.7MB

    • memory/1316-109-0x0000000009BD0000-0x0000000009D60000-memory.dmp

      Filesize

      1.6MB

    • memory/1316-132-0x0000000006C95000-0x0000000006CA6000-memory.dmp

      Filesize

      68KB

    • memory/1316-111-0x0000000000230000-0x0000000000322000-memory.dmp

      Filesize

      968KB

    • memory/1316-120-0x0000000077100000-0x0000000077280000-memory.dmp

      Filesize

      1.5MB

    • memory/1552-89-0x0000000000230000-0x000000000023D000-memory.dmp

      Filesize

      52KB

    • memory/1552-94-0x0000000077100000-0x0000000077280000-memory.dmp

      Filesize

      1.5MB

    • memory/1552-85-0x0000000000230000-0x0000000000322000-memory.dmp

      Filesize

      968KB

    • memory/1604-129-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/1604-123-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/1604-127-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/1604-131-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/1960-112-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1960-122-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1960-116-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1960-119-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB