Malware Analysis Report

2025-01-02 14:19

Sample ID 220727-azmxnsbeg7
Target 53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd
SHA256 53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd
Tags
hawkeye collection keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd

Threat Level: Known bad

The file 53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd was found to be: Known bad.

Malicious Activity Summary

hawkeye collection keylogger spyware stealer trojan

HawkEye

NirSoft MailPassView

NirSoft WebBrowserPassView

Nirsoft

Executes dropped EXE

Checks computer location settings

Uses the VBS compiler for execution

Loads dropped DLL

Deletes itself

Accesses Microsoft Outlook accounts

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of UnmapMainImage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-27 00:39

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-27 00:39

Reported

2022-07-27 00:43

Platform

win7-20220718-en

Max time kernel

150s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2004 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe
PID 2004 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe
PID 2004 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe
PID 2004 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe
PID 956 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 956 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 956 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 956 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 956 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 956 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 956 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1920 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1920 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1920 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1920 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1920 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1920 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1920 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1420 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1420 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe

"C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe"

C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe

C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

"C:\Users\Admin\AppData\Roaming\Windows Update.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

C:\Users\Admin\AppData\Roaming\Windows Update.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.154.36:80 whatismyipaddress.com tcp
US 104.16.154.36:443 whatismyipaddress.com tcp
US 104.16.154.36:443 whatismyipaddress.com tcp

Files

memory/2004-56-0x00000000760F1000-0x00000000760F3000-memory.dmp

memory/2004-57-0x0000000000360000-0x0000000000366000-memory.dmp

memory/956-58-0x00000000004D5544-mapping.dmp

memory/2004-59-0x0000000077DF0000-0x0000000077F70000-memory.dmp

memory/956-63-0x0000000000400000-0x0000000000477000-memory.dmp

memory/956-67-0x0000000000480000-0x0000000000510000-memory.dmp

memory/956-66-0x0000000000482000-0x000000000050A000-memory.dmp

memory/956-69-0x0000000077DF0000-0x0000000077F70000-memory.dmp

memory/956-70-0x0000000077DF0000-0x0000000077F70000-memory.dmp

memory/956-71-0x0000000008C50000-0x0000000008D11000-memory.dmp

memory/956-72-0x0000000074FC0000-0x000000007556B000-memory.dmp

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 ee98a661933b0bb6753035ec8d4896eb
SHA1 8883c2fb226406f940ea18b9802f81fc7fb088c3
SHA256 53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd
SHA512 d8f6e18bee761645754819e4e66ada9df97d27c3e2fec494275a1f17140f2eed4de832d4b22e397ab5594f2f1dc5201e9212a8e998ff450acec507f0d68f9c88

memory/1920-74-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 ee98a661933b0bb6753035ec8d4896eb
SHA1 8883c2fb226406f940ea18b9802f81fc7fb088c3
SHA256 53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd
SHA512 d8f6e18bee761645754819e4e66ada9df97d27c3e2fec494275a1f17140f2eed4de832d4b22e397ab5594f2f1dc5201e9212a8e998ff450acec507f0d68f9c88

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 ee98a661933b0bb6753035ec8d4896eb
SHA1 8883c2fb226406f940ea18b9802f81fc7fb088c3
SHA256 53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd
SHA512 d8f6e18bee761645754819e4e66ada9df97d27c3e2fec494275a1f17140f2eed4de832d4b22e397ab5594f2f1dc5201e9212a8e998ff450acec507f0d68f9c88

memory/956-77-0x0000000077DF0000-0x0000000077F70000-memory.dmp

memory/956-78-0x0000000074FC0000-0x000000007556B000-memory.dmp

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 ee98a661933b0bb6753035ec8d4896eb
SHA1 8883c2fb226406f940ea18b9802f81fc7fb088c3
SHA256 53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd
SHA512 d8f6e18bee761645754819e4e66ada9df97d27c3e2fec494275a1f17140f2eed4de832d4b22e397ab5594f2f1dc5201e9212a8e998ff450acec507f0d68f9c88

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 ee98a661933b0bb6753035ec8d4896eb
SHA1 8883c2fb226406f940ea18b9802f81fc7fb088c3
SHA256 53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd
SHA512 d8f6e18bee761645754819e4e66ada9df97d27c3e2fec494275a1f17140f2eed4de832d4b22e397ab5594f2f1dc5201e9212a8e998ff450acec507f0d68f9c88

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 ee98a661933b0bb6753035ec8d4896eb
SHA1 8883c2fb226406f940ea18b9802f81fc7fb088c3
SHA256 53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd
SHA512 d8f6e18bee761645754819e4e66ada9df97d27c3e2fec494275a1f17140f2eed4de832d4b22e397ab5594f2f1dc5201e9212a8e998ff450acec507f0d68f9c88

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 ee98a661933b0bb6753035ec8d4896eb
SHA1 8883c2fb226406f940ea18b9802f81fc7fb088c3
SHA256 53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd
SHA512 d8f6e18bee761645754819e4e66ada9df97d27c3e2fec494275a1f17140f2eed4de832d4b22e397ab5594f2f1dc5201e9212a8e998ff450acec507f0d68f9c88

memory/1420-86-0x00000000004D5544-mapping.dmp

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 ee98a661933b0bb6753035ec8d4896eb
SHA1 8883c2fb226406f940ea18b9802f81fc7fb088c3
SHA256 53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd
SHA512 d8f6e18bee761645754819e4e66ada9df97d27c3e2fec494275a1f17140f2eed4de832d4b22e397ab5594f2f1dc5201e9212a8e998ff450acec507f0d68f9c88

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 ee98a661933b0bb6753035ec8d4896eb
SHA1 8883c2fb226406f940ea18b9802f81fc7fb088c3
SHA256 53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd
SHA512 d8f6e18bee761645754819e4e66ada9df97d27c3e2fec494275a1f17140f2eed4de832d4b22e397ab5594f2f1dc5201e9212a8e998ff450acec507f0d68f9c88

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 ee98a661933b0bb6753035ec8d4896eb
SHA1 8883c2fb226406f940ea18b9802f81fc7fb088c3
SHA256 53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd
SHA512 d8f6e18bee761645754819e4e66ada9df97d27c3e2fec494275a1f17140f2eed4de832d4b22e397ab5594f2f1dc5201e9212a8e998ff450acec507f0d68f9c88

memory/1920-88-0x0000000077DF0000-0x0000000077F70000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 ee98a661933b0bb6753035ec8d4896eb
SHA1 8883c2fb226406f940ea18b9802f81fc7fb088c3
SHA256 53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd
SHA512 d8f6e18bee761645754819e4e66ada9df97d27c3e2fec494275a1f17140f2eed4de832d4b22e397ab5594f2f1dc5201e9212a8e998ff450acec507f0d68f9c88

memory/1420-95-0x0000000000400000-0x0000000000477000-memory.dmp

memory/1420-99-0x0000000002540000-0x00000000025D0000-memory.dmp

memory/1420-102-0x0000000077DF0000-0x0000000077F70000-memory.dmp

memory/1420-103-0x0000000074F40000-0x00000000754EB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 f31a0d0cceaf8532fbecff7ad1977066
SHA1 ea46adb0e21a3d8c3fc660b33ad9ca6477386ef2
SHA256 c73156ed3bd755cbd1f73567bd1fac1098d60d412cf8ef8b0cb3c74b87830a72
SHA512 58c868f1f409ebd4c65f46a284bcbe2a59f9b7d74669f2027b5ef82af4ed90ead9483eb2e4b00791af8855dfb8ea9bb73220a37cea2dd5d0f9fc6167e2413fbf

memory/860-106-0x0000000000411654-mapping.dmp

memory/860-105-0x0000000000400000-0x000000000041B000-memory.dmp

memory/860-109-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1420-111-0x00000000008C5000-0x00000000008D6000-memory.dmp

memory/860-112-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1420-113-0x0000000074F40000-0x00000000754EB000-memory.dmp

memory/1476-115-0x0000000000442628-mapping.dmp

memory/1476-114-0x0000000000400000-0x0000000000458000-memory.dmp

memory/860-119-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1476-118-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1476-121-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/1476-123-0x0000000000400000-0x0000000000458000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-27 00:39

Reported

2022-07-27 00:43

Platform

win10v2004-20220721-en

Max time kernel

134s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe N/A

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1204 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe
PID 1204 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe
PID 1204 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe
PID 4664 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 4664 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 4664 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2772 wrote to memory of 3720 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2772 wrote to memory of 3720 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2772 wrote to memory of 3720 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 3720 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3720 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3720 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3720 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3720 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3720 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3720 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3720 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3720 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3720 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3720 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3720 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3720 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3720 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3720 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3720 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3720 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3720 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe

"C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe"

C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe

C:\Users\Admin\AppData\Local\Temp\53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

"C:\Users\Admin\AppData\Roaming\Windows Update.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

C:\Users\Admin\AppData\Roaming\Windows Update.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

Network

Country Destination Domain Proto
NL 178.79.208.1:80 tcp
IE 40.126.31.67:443 tcp
IE 20.190.159.64:443 tcp
AU 104.46.162.226:443 tcp
FR 2.18.109.224:443 tcp
US 8.8.8.8:53 15.89.54.20.in-addr.arpa udp
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.155.36:80 whatismyipaddress.com tcp
US 104.16.155.36:443 whatismyipaddress.com tcp
US 8.8.8.8:53 smtp.yandex.com udp
RU 77.88.21.158:587 smtp.yandex.com tcp

Files

memory/1204-132-0x0000000003300000-0x0000000003306000-memory.dmp

memory/4664-133-0x0000000000000000-mapping.dmp

memory/1204-134-0x0000000077490000-0x0000000077633000-memory.dmp

memory/1204-135-0x0000000077490000-0x0000000077633000-memory.dmp

memory/4664-138-0x0000000000400000-0x0000000000477000-memory.dmp

memory/4664-141-0x0000000002320000-0x00000000023B0000-memory.dmp

memory/4664-144-0x0000000077490000-0x0000000077633000-memory.dmp

memory/4664-145-0x0000000077490000-0x0000000077633000-memory.dmp

memory/4664-146-0x0000000074B00000-0x00000000750B1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 ee98a661933b0bb6753035ec8d4896eb
SHA1 8883c2fb226406f940ea18b9802f81fc7fb088c3
SHA256 53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd
SHA512 d8f6e18bee761645754819e4e66ada9df97d27c3e2fec494275a1f17140f2eed4de832d4b22e397ab5594f2f1dc5201e9212a8e998ff450acec507f0d68f9c88

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 ee98a661933b0bb6753035ec8d4896eb
SHA1 8883c2fb226406f940ea18b9802f81fc7fb088c3
SHA256 53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd
SHA512 d8f6e18bee761645754819e4e66ada9df97d27c3e2fec494275a1f17140f2eed4de832d4b22e397ab5594f2f1dc5201e9212a8e998ff450acec507f0d68f9c88

memory/2772-147-0x0000000000000000-mapping.dmp

memory/4664-151-0x0000000077490000-0x0000000077633000-memory.dmp

memory/4664-153-0x0000000074B00000-0x00000000750B1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 ee98a661933b0bb6753035ec8d4896eb
SHA1 8883c2fb226406f940ea18b9802f81fc7fb088c3
SHA256 53ae04a065c7d89624e604ef7474e22a02cb2d35c40696e3b6844c49261bcbfd
SHA512 d8f6e18bee761645754819e4e66ada9df97d27c3e2fec494275a1f17140f2eed4de832d4b22e397ab5594f2f1dc5201e9212a8e998ff450acec507f0d68f9c88

memory/3720-154-0x0000000000000000-mapping.dmp

memory/2772-156-0x0000000077490000-0x0000000077633000-memory.dmp

memory/3720-162-0x0000000006B00000-0x0000000006B90000-memory.dmp

memory/3720-165-0x0000000077490000-0x0000000077633000-memory.dmp

memory/3720-166-0x0000000074B00000-0x00000000750B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 f31a0d0cceaf8532fbecff7ad1977066
SHA1 ea46adb0e21a3d8c3fc660b33ad9ca6477386ef2
SHA256 c73156ed3bd755cbd1f73567bd1fac1098d60d412cf8ef8b0cb3c74b87830a72
SHA512 58c868f1f409ebd4c65f46a284bcbe2a59f9b7d74669f2027b5ef82af4ed90ead9483eb2e4b00791af8855dfb8ea9bb73220a37cea2dd5d0f9fc6167e2413fbf

memory/3720-168-0x0000000077490000-0x0000000077633000-memory.dmp

memory/3720-169-0x0000000074B00000-0x00000000750B1000-memory.dmp

memory/2396-170-0x0000000000000000-mapping.dmp

memory/2396-171-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2396-173-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2396-174-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2168-175-0x0000000000000000-mapping.dmp

memory/2168-176-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2168-178-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2168-179-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

MD5 f94dc819ca773f1e3cb27abbc9e7fa27
SHA1 9a7700efadc5ea09ab288544ef1e3cd876255086
SHA256 a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA512 72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

memory/2168-181-0x0000000000400000-0x0000000000458000-memory.dmp