Analysis
- max time kernel
151s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system - submitted
24/07/2022, 19:43
Behavioral task
behavioral1
Sample
57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe
Resource
win7-20220715-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
21 signatures
150 seconds
General
- Target 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe
- Size 1.5MB
- Sample220724-yfqffsecdq
- SHA256 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3
- MD5 f715f1684b2e0af14e6fd3013c2d8916
- SHA1 8909fe915a19e5f42d46034847671bcfb087c6db
- SHA512 6062be4f9bd466257fa1dc57c931e8b9e00a3eeec3d33b5ebc35098a401348fd61f53efef6302b786e628c173f77af58907f972d41b5ebcc1f0fc4e4477096dd
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
hawkeye_reborn
Version
-
9.0.1.6
Mutex
-
10fc6c49-5a08-4d6d-9fd8-637c88d50362
Attributes
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:3 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPort:0 _EmailSSL:false _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:10fc6c49-5a08-4d6d-9fd8-637c88d50362 _PanelSecret:521199b4-129c-520c-7e7e-4e9dbcf49467 _PanelURL:http://grindtreue.online/raz/ _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null
Signatures
- HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
- M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
resource yara_rule behavioral2/memory/456-133-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger - NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/4968-148-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/4968-150-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/4968-151-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView - NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/332-142-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/332-144-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/332-145-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView - Nirsoft 6 IoCs
resource yara_rule behavioral2/memory/332-142-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/332-144-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/332-145-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/4968-148-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/4968-150-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/4968-151-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft -
resource yara_rule behavioral2/memory/4928-130-0x0000000000760000-0x0000000000A81000-memory.dmp upx behavioral2/memory/4928-131-0x0000000000760000-0x0000000000A81000-memory.dmp upx - Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BcastDVRBroker.url 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe - Uses the VBS compiler for execution 1 TTPs
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe - AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4928-130-0x0000000000760000-0x0000000000A81000-memory.dmp autoit_exe behavioral2/memory/4928-131-0x0000000000760000-0x0000000000A81000-memory.dmp autoit_exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{8BAB9682-2137-43E3-9670-0AFD5C3B5E8E}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{4D70DC5B-629B-482A-A05F-7E346ACC20AF}.catalogItem svchost.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4928 set thread context of 456 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 75 PID 456 set thread context of 332 456 RegAsm.exe 77 PID 456 set thread context of 4968 456 RegAsm.exe 78 - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 456 RegAsm.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 456 RegAsm.exe - Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 4928 wrote to memory of 456 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 75 PID 4928 wrote to memory of 456 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 75 PID 4928 wrote to memory of 456 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 75 PID 4928 wrote to memory of 456 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 75 PID 4928 wrote to memory of 456 4928 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe 75 PID 456 wrote to memory of 332 456 RegAsm.exe 77 PID 456 wrote to memory of 332 456 RegAsm.exe 77 PID 456 wrote to memory of 332 456 RegAsm.exe 77 PID 456 wrote to memory of 332 456 RegAsm.exe 77 PID 456 wrote to memory of 332 456 RegAsm.exe 77 PID 456 wrote to memory of 332 456 RegAsm.exe 77 PID 456 wrote to memory of 332 456 RegAsm.exe 77 PID 456 wrote to memory of 332 456 RegAsm.exe 77 PID 456 wrote to memory of 332 456 RegAsm.exe 77 PID 456 wrote to memory of 4968 456 RegAsm.exe 78 PID 456 wrote to memory of 4968 456 RegAsm.exe 78 PID 456 wrote to memory of 4968 456 RegAsm.exe 78 PID 456 wrote to memory of 4968 456 RegAsm.exe 78 PID 456 wrote to memory of 4968 456 RegAsm.exe 78 PID 456 wrote to memory of 4968 456 RegAsm.exe 78 PID 456 wrote to memory of 4968 456 RegAsm.exe 78 PID 456 wrote to memory of 4968 456 RegAsm.exe 78 PID 456 wrote to memory of 4968 456 RegAsm.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe"C:\Users\Admin\AppData\Local\Temp\57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp167.tmp"3⤵PID:332
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp63B.tmp"3⤵
- Accesses Microsoft Outlook accounts
PID:4968
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:620
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\tmp167.tmp
- Size 4KB
- SHA256 66635dcdbf3439d7e09ac3f043c0ff6792f1ec281070fea4618d9b5fb287cb56
- MD5 a64ef19cb7924d0ef7b27699e0237041
- SHA1 b6392aa8451f0721fcadff793808f8630182e66e
- SHA512 66f6ae0b27227cfaf57a28e8f592a899375f763d0dc1e4f0199444b52e026f04243761bb20af127a7815a5c59db3c9fe1c1ff2a3ef069b8eccff3eef68da284b
- SSDEEP 48:wvvv0wQxfvvcwQxfdvv0wQxBvv0wQxakvv0wQ7:mvExvMp1vEPvEbvE7
- MD5 SHA1 SHA512 SSDEEP