Analysis

  • max time kernel
    82s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220718-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-07-2022 20:20

General

  • Target

    4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792.exe

  • Size

    970KB

  • MD5

    7368657baf850ecfd5d70e1f8e2a0fcd

  • SHA1

    70ec9d06ecd975708e1589da9900a75c8846e843

  • SHA256

    4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792

  • SHA512

    a54bf8e35f1209b4a6f22eccbda4ff95071791c870c7b5b88f7c511f66b4c3e2055ee9b6dfebe02154898e494244eb3614927a1144537b9e7d890915301ded8a

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    alibaba1234

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • NirSoft MailPassView 6 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 7 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 11 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792.exe
    "C:\Users\Admin\AppData\Local\Temp\4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4192
    • C:\Users\Admin\AppData\Local\Temp\4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792.exe
      C:\Users\Admin\AppData\Local\Temp\4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:5044
      • C:\Users\Admin\AppData\Roaming\Windows Update.exe
        "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3112
        • C:\Users\Admin\AppData\Roaming\Windows Update.exe
          C:\Users\Admin\AppData\Roaming\Windows Update.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1028
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
            5⤵
            • Accesses Microsoft Outlook accounts
            PID:3336
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:828

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

    Filesize

    102B

    MD5

    789604969bcc4a6b979d79fef4470935

    SHA1

    d29d62732533dec35a81559259de1b4e7c2cfe9e

    SHA256

    172c35024fde99fd313b733a569270c0648f9f366e8d03370d11ff5cfe0bd1cb

    SHA512

    a971a46171714fab7ff4ed02ae12a1b2320fbd9faf90ea49f428ec5d1368cbf947bdd3bdd97fa16217b5de491dcb660f132896724139494377f3ae1ed74217ef

  • C:\Users\Admin\AppData\Local\Temp\holderwb.txt

    Filesize

    3KB

    MD5

    f94dc819ca773f1e3cb27abbc9e7fa27

    SHA1

    9a7700efadc5ea09ab288544ef1e3cd876255086

    SHA256

    a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

    SHA512

    72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

  • C:\Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    970KB

    MD5

    7368657baf850ecfd5d70e1f8e2a0fcd

    SHA1

    70ec9d06ecd975708e1589da9900a75c8846e843

    SHA256

    4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792

    SHA512

    a54bf8e35f1209b4a6f22eccbda4ff95071791c870c7b5b88f7c511f66b4c3e2055ee9b6dfebe02154898e494244eb3614927a1144537b9e7d890915301ded8a

  • C:\Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    970KB

    MD5

    7368657baf850ecfd5d70e1f8e2a0fcd

    SHA1

    70ec9d06ecd975708e1589da9900a75c8846e843

    SHA256

    4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792

    SHA512

    a54bf8e35f1209b4a6f22eccbda4ff95071791c870c7b5b88f7c511f66b4c3e2055ee9b6dfebe02154898e494244eb3614927a1144537b9e7d890915301ded8a

  • C:\Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    970KB

    MD5

    7368657baf850ecfd5d70e1f8e2a0fcd

    SHA1

    70ec9d06ecd975708e1589da9900a75c8846e843

    SHA256

    4fcf6a0b40b045b1ce5c37c912989ad0f8a26f5eb18dde467ab5565c09b90792

    SHA512

    a54bf8e35f1209b4a6f22eccbda4ff95071791c870c7b5b88f7c511f66b4c3e2055ee9b6dfebe02154898e494244eb3614927a1144537b9e7d890915301ded8a

  • memory/828-180-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/828-179-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/828-177-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/828-175-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/1028-161-0x0000000006B30000-0x0000000006BC0000-memory.dmp

    Filesize

    576KB

  • memory/1028-173-0x0000000074710000-0x0000000074CC1000-memory.dmp

    Filesize

    5.7MB

  • memory/1028-159-0x00000000770A0000-0x0000000077243000-memory.dmp

    Filesize

    1.6MB

  • memory/1028-172-0x00000000770A0000-0x0000000077243000-memory.dmp

    Filesize

    1.6MB

  • memory/1028-164-0x00000000770A0000-0x0000000077243000-memory.dmp

    Filesize

    1.6MB

  • memory/1028-165-0x0000000074710000-0x0000000074CC1000-memory.dmp

    Filesize

    5.7MB

  • memory/3112-154-0x00000000770A0000-0x0000000077243000-memory.dmp

    Filesize

    1.6MB

  • memory/3336-171-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3336-168-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3336-170-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4192-132-0x00000000022E0000-0x00000000022E7000-memory.dmp

    Filesize

    28KB

  • memory/4192-134-0x00000000770A0000-0x0000000077243000-memory.dmp

    Filesize

    1.6MB

  • memory/5044-151-0x0000000074710000-0x0000000074CC1000-memory.dmp

    Filesize

    5.7MB

  • memory/5044-149-0x00000000770A0000-0x0000000077243000-memory.dmp

    Filesize

    1.6MB

  • memory/5044-144-0x0000000074710000-0x0000000074CC1000-memory.dmp

    Filesize

    5.7MB

  • memory/5044-143-0x00000000770A0000-0x0000000077243000-memory.dmp

    Filesize

    1.6MB

  • memory/5044-140-0x0000000006B10000-0x0000000006BA0000-memory.dmp

    Filesize

    576KB

  • memory/5044-137-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB