Malware Analysis Report

2025-01-02 14:19

Sample ID 220720-wm4wbaedfl
Target 4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42
SHA256 4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42
Tags
hawkeye keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42

Threat Level: Known bad

The file 4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42 was found to be: Known bad.

Malicious Activity Summary

hawkeye keylogger spyware stealer trojan

HawkEye

NirSoft MailPassView

Nirsoft

NirSoft WebBrowserPassView

Executes dropped EXE

Deletes itself

Loads dropped DLL

Checks computer location settings

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of UnmapMainImage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-20 18:03

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-20 18:03

Reported

2022-07-20 20:42

Platform

win7-20220718-en

Max time kernel

149s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1364 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe
PID 1364 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe
PID 1364 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe
PID 1364 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe
PID 1328 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1328 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1328 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1328 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1328 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1328 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1328 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1968 wrote to memory of 544 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1968 wrote to memory of 544 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1968 wrote to memory of 544 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1968 wrote to memory of 544 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1968 wrote to memory of 544 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1968 wrote to memory of 544 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1968 wrote to memory of 544 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe

"C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe"

C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe

C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

"C:\Users\Admin\AppData\Roaming\Windows Update.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

C:\Users\Admin\AppData\Roaming\Windows Update.exe"

Network

N/A

Files

memory/1364-56-0x0000000000300000-0x0000000000307000-memory.dmp

memory/1364-57-0x0000000075C91000-0x0000000075C93000-memory.dmp

memory/1364-59-0x00000000779D0000-0x0000000077B50000-memory.dmp

memory/1328-58-0x00000000004D15CB-mapping.dmp

memory/1328-63-0x0000000000400000-0x0000000000477000-memory.dmp

memory/1328-66-0x0000000001CE0000-0x0000000001D70000-memory.dmp

memory/1328-69-0x00000000779D0000-0x0000000077B50000-memory.dmp

memory/1328-70-0x00000000779D0000-0x0000000077B50000-memory.dmp

memory/1328-71-0x0000000074BA0000-0x000000007514B000-memory.dmp

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 72a29aa3364417f3194f8e34fad82668
SHA1 cf4940254b4e130addb8b76f6d654bd423fc341c
SHA256 4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42
SHA512 0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 72a29aa3364417f3194f8e34fad82668
SHA1 cf4940254b4e130addb8b76f6d654bd423fc341c
SHA256 4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42
SHA512 0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

memory/1968-73-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 72a29aa3364417f3194f8e34fad82668
SHA1 cf4940254b4e130addb8b76f6d654bd423fc341c
SHA256 4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42
SHA512 0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

memory/1328-76-0x00000000779D0000-0x0000000077B50000-memory.dmp

memory/1328-77-0x0000000074BA0000-0x000000007514B000-memory.dmp

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 72a29aa3364417f3194f8e34fad82668
SHA1 cf4940254b4e130addb8b76f6d654bd423fc341c
SHA256 4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42
SHA512 0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 72a29aa3364417f3194f8e34fad82668
SHA1 cf4940254b4e130addb8b76f6d654bd423fc341c
SHA256 4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42
SHA512 0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 72a29aa3364417f3194f8e34fad82668
SHA1 cf4940254b4e130addb8b76f6d654bd423fc341c
SHA256 4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42
SHA512 0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 72a29aa3364417f3194f8e34fad82668
SHA1 cf4940254b4e130addb8b76f6d654bd423fc341c
SHA256 4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42
SHA512 0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

memory/544-85-0x00000000004D15CB-mapping.dmp

memory/1968-88-0x00000000779D0000-0x0000000077B50000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 72a29aa3364417f3194f8e34fad82668
SHA1 cf4940254b4e130addb8b76f6d654bd423fc341c
SHA256 4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42
SHA512 0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 72a29aa3364417f3194f8e34fad82668
SHA1 cf4940254b4e130addb8b76f6d654bd423fc341c
SHA256 4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42
SHA512 0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 72a29aa3364417f3194f8e34fad82668
SHA1 cf4940254b4e130addb8b76f6d654bd423fc341c
SHA256 4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42
SHA512 0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 72a29aa3364417f3194f8e34fad82668
SHA1 cf4940254b4e130addb8b76f6d654bd423fc341c
SHA256 4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42
SHA512 0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

memory/544-94-0x0000000000400000-0x0000000000477000-memory.dmp

memory/544-98-0x00000000025B0000-0x0000000002640000-memory.dmp

memory/544-101-0x0000000008D90000-0x0000000009888000-memory.dmp

memory/544-103-0x00000000779D0000-0x0000000077B50000-memory.dmp

memory/544-102-0x00000000779D0000-0x0000000077B50000-memory.dmp

memory/544-104-0x00000000744C0000-0x0000000074A6B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 9f4ef3b0f356638ebb3f2a3e8ab0eb0c
SHA1 c11bf6ee80afb55b1435789775e2aa753c90c8dd
SHA256 6d580e6f0efd757b2480a5168b47229c5580cd0b17af19a08d23a1a343d30e88
SHA512 8c0f79b4254df77a0830dde96b6b2d60584537dd6233da004d71c6c68e468ceee0f3c2c66edb1981d4cf0a475a0ae737f9054f90016439d5387fa5fd8ef00114

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-20 18:03

Reported

2022-07-20 20:42

Platform

win10v2004-20220718-en

Max time kernel

130s

Max time network

76s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe"

Signatures

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1178428168-2939480073-3055857545-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3224 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe
PID 3224 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe
PID 3224 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe
PID 2564 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2564 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2564 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2608 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2608 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2608 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe

"C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe"

C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe

C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

"C:\Users\Admin\AppData\Roaming\Windows Update.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

C:\Users\Admin\AppData\Roaming\Windows Update.exe"

Network

Country Destination Domain Proto
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 13.89.179.8:443 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp

Files

memory/3224-132-0x00000000022C0000-0x00000000022C7000-memory.dmp

memory/2564-133-0x0000000000000000-mapping.dmp

memory/3224-134-0x00000000777C0000-0x0000000077963000-memory.dmp

memory/2564-137-0x0000000000400000-0x0000000000477000-memory.dmp

memory/2564-140-0x00000000021F0000-0x0000000002280000-memory.dmp

memory/2564-143-0x00000000777C0000-0x0000000077963000-memory.dmp

memory/2564-144-0x00000000777C0000-0x0000000077963000-memory.dmp

memory/2564-145-0x0000000074E30000-0x00000000753E1000-memory.dmp

memory/2608-146-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 72a29aa3364417f3194f8e34fad82668
SHA1 cf4940254b4e130addb8b76f6d654bd423fc341c
SHA256 4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42
SHA512 0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 72a29aa3364417f3194f8e34fad82668
SHA1 cf4940254b4e130addb8b76f6d654bd423fc341c
SHA256 4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42
SHA512 0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

memory/2564-151-0x00000000777C0000-0x0000000077963000-memory.dmp

memory/2564-152-0x0000000074E30000-0x00000000753E1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 72a29aa3364417f3194f8e34fad82668
SHA1 cf4940254b4e130addb8b76f6d654bd423fc341c
SHA256 4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42
SHA512 0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

memory/2044-153-0x0000000000000000-mapping.dmp

memory/2608-155-0x00000000777C0000-0x0000000077963000-memory.dmp