Malware Analysis Report

2025-01-02 14:12

Sample ID 220731-1k2emahef4
Target 5e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA256 5e033870891778609ff43626f637530e93531956256f914396417616058f1641
Tags
hawkeye collection keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5e033870891778609ff43626f637530e93531956256f914396417616058f1641

Threat Level: Known bad

The file 5e033870891778609ff43626f637530e93531956256f914396417616058f1641 was found to be: Known bad.

Malicious Activity Summary

hawkeye collection keylogger spyware stealer trojan

HawkEye

NirSoft MailPassView

Nirsoft

NirSoft WebBrowserPassView

Executes dropped EXE

Deletes itself

Checks computer location settings

Loads dropped DLL

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of UnmapMainImage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-31 21:43

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-31 21:43

Reported

2022-08-01 00:22

Platform

win7-20220718-en

Max time kernel

128s

Max time network

131s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe
PID 972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe
PID 972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe
PID 972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe
PID 1200 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1200 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1200 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1200 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1200 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1200 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1200 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2016 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2016 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2016 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2016 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2016 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2016 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2016 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1924 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe

"C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe"

C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe

C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

"C:\Users\Admin\AppData\Roaming\Windows Update.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

C:\Users\Admin\AppData\Roaming\Windows Update.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.154.36:80 whatismyipaddress.com tcp
US 104.16.154.36:443 whatismyipaddress.com tcp
US 104.16.154.36:443 whatismyipaddress.com tcp
US 8.8.8.8:53 smtp.yandex.com udp
RU 77.88.21.158:587 smtp.yandex.com tcp

Files

memory/972-56-0x0000000000280000-0x0000000000287000-memory.dmp

memory/972-57-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

memory/1200-58-0x00000000004D605F-mapping.dmp

memory/972-59-0x0000000077A60000-0x0000000077BE0000-memory.dmp

memory/1200-63-0x0000000000400000-0x0000000000477000-memory.dmp

memory/1200-66-0x0000000000370000-0x0000000000400000-memory.dmp

memory/1200-69-0x0000000077A60000-0x0000000077BE0000-memory.dmp

memory/1200-70-0x0000000077A60000-0x0000000077BE0000-memory.dmp

memory/1200-71-0x0000000074C30000-0x00000000751DB000-memory.dmp

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 e6350b9f4608bae0aab1347846407674
SHA1 08b77622b00a125e54f2c718eacc1c8f57b40b73
SHA256 5e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512 009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a

memory/2016-73-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 e6350b9f4608bae0aab1347846407674
SHA1 08b77622b00a125e54f2c718eacc1c8f57b40b73
SHA256 5e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512 009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 e6350b9f4608bae0aab1347846407674
SHA1 08b77622b00a125e54f2c718eacc1c8f57b40b73
SHA256 5e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512 009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a

memory/1200-76-0x0000000077A60000-0x0000000077BE0000-memory.dmp

memory/1200-78-0x0000000074C30000-0x00000000751DB000-memory.dmp

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 e6350b9f4608bae0aab1347846407674
SHA1 08b77622b00a125e54f2c718eacc1c8f57b40b73
SHA256 5e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512 009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 e6350b9f4608bae0aab1347846407674
SHA1 08b77622b00a125e54f2c718eacc1c8f57b40b73
SHA256 5e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512 009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 e6350b9f4608bae0aab1347846407674
SHA1 08b77622b00a125e54f2c718eacc1c8f57b40b73
SHA256 5e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512 009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 e6350b9f4608bae0aab1347846407674
SHA1 08b77622b00a125e54f2c718eacc1c8f57b40b73
SHA256 5e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512 009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a

memory/1924-85-0x00000000004D605F-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 e6350b9f4608bae0aab1347846407674
SHA1 08b77622b00a125e54f2c718eacc1c8f57b40b73
SHA256 5e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512 009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a

memory/2016-88-0x0000000077A60000-0x0000000077BE0000-memory.dmp

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 e6350b9f4608bae0aab1347846407674
SHA1 08b77622b00a125e54f2c718eacc1c8f57b40b73
SHA256 5e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512 009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 e6350b9f4608bae0aab1347846407674
SHA1 08b77622b00a125e54f2c718eacc1c8f57b40b73
SHA256 5e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512 009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 e6350b9f4608bae0aab1347846407674
SHA1 08b77622b00a125e54f2c718eacc1c8f57b40b73
SHA256 5e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512 009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a

memory/1924-94-0x0000000000400000-0x0000000000477000-memory.dmp

memory/1924-98-0x00000000005F0000-0x0000000000680000-memory.dmp

memory/1924-101-0x0000000008DA0000-0x0000000009898000-memory.dmp

memory/1924-102-0x0000000077A60000-0x0000000077BE0000-memory.dmp

memory/1924-103-0x0000000077A60000-0x0000000077BE0000-memory.dmp

memory/1924-104-0x0000000074550000-0x0000000074AFB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 25cdf976d80f34323c6a3bf8da3a2615
SHA1 c98ea23df04334af9967bcae6a82128c70538da6
SHA256 7dd8663d42227c110aea7418a5a8c5dd91904aacb18ab19151020dc396d0f848
SHA512 0c0acc0902d2584f96f771456964359fe0bb40810c1dabb1c5f2f33bff83d49101c4d88445ec5496aad7c40d1e172c6f79549a9183268bb383ca3ad90e27cfdd

memory/1668-106-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1668-107-0x0000000000411654-mapping.dmp

memory/1668-110-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1924-112-0x0000000006AC5000-0x0000000006AD6000-memory.dmp

memory/1668-113-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1924-114-0x0000000077A60000-0x0000000077BE0000-memory.dmp

memory/1924-115-0x0000000077A60000-0x0000000077BE0000-memory.dmp

memory/1924-116-0x0000000074550000-0x0000000074AFB000-memory.dmp

memory/1924-117-0x0000000074550000-0x0000000074AFB000-memory.dmp

memory/1668-118-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1616-119-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1616-120-0x0000000000442628-mapping.dmp

memory/1616-123-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/1616-126-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1924-127-0x0000000006AC5000-0x0000000006AD6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-31 21:43

Reported

2022-08-01 00:22

Platform

win10v2004-20220721-en

Max time kernel

137s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe N/A

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2060 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe
PID 2060 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe
PID 2060 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe
PID 1848 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1848 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1848 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2628 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2628 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 2628 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1484 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1484 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1484 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1484 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1484 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1484 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1484 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1484 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1484 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1484 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1484 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1484 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1484 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1484 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1484 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1484 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1484 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1484 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe

"C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe"

C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe

C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

"C:\Users\Admin\AppData\Roaming\Windows Update.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

C:\Users\Admin\AppData\Roaming\Windows Update.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

Network

Country Destination Domain Proto
IE 20.190.159.70:443 tcp
US 93.184.221.240:80 tcp
US 8.247.210.254:80 tcp
US 8.247.210.254:80 tcp
US 93.184.220.29:80 tcp
US 20.42.65.85:443 tcp
FR 2.18.109.224:443 tcp
US 8.247.210.254:80 tcp
US 8.247.210.254:80 tcp
IE 20.82.210.154:443 tcp
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.154.36:80 whatismyipaddress.com tcp
US 104.16.154.36:443 whatismyipaddress.com tcp
US 8.8.8.8:53 smtp.yandex.com udp
RU 77.88.21.158:587 smtp.yandex.com tcp

Files

memory/2060-132-0x00000000022B0000-0x00000000022B7000-memory.dmp

memory/1848-133-0x0000000000000000-mapping.dmp

memory/2060-134-0x00000000772F0000-0x0000000077493000-memory.dmp

memory/1848-137-0x0000000000400000-0x0000000000477000-memory.dmp

memory/1848-140-0x00000000772F0000-0x0000000077493000-memory.dmp

memory/1848-141-0x0000000006B30000-0x0000000006BC0000-memory.dmp

memory/1848-144-0x00000000772F0000-0x0000000077493000-memory.dmp

memory/1848-145-0x0000000074960000-0x0000000074F11000-memory.dmp

memory/2628-146-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 e6350b9f4608bae0aab1347846407674
SHA1 08b77622b00a125e54f2c718eacc1c8f57b40b73
SHA256 5e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512 009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 e6350b9f4608bae0aab1347846407674
SHA1 08b77622b00a125e54f2c718eacc1c8f57b40b73
SHA256 5e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512 009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a

memory/1848-149-0x00000000772F0000-0x0000000077493000-memory.dmp

memory/1848-151-0x0000000074960000-0x0000000074F11000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 e6350b9f4608bae0aab1347846407674
SHA1 08b77622b00a125e54f2c718eacc1c8f57b40b73
SHA256 5e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512 009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a

memory/2628-155-0x00000000772F0000-0x0000000077493000-memory.dmp

memory/1484-153-0x0000000000000000-mapping.dmp

memory/1484-161-0x0000000006AB0000-0x0000000006B40000-memory.dmp

memory/1484-164-0x00000000772F0000-0x0000000077493000-memory.dmp

memory/1484-165-0x0000000074960000-0x0000000074F11000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 25cdf976d80f34323c6a3bf8da3a2615
SHA1 c98ea23df04334af9967bcae6a82128c70538da6
SHA256 7dd8663d42227c110aea7418a5a8c5dd91904aacb18ab19151020dc396d0f848
SHA512 0c0acc0902d2584f96f771456964359fe0bb40810c1dabb1c5f2f33bff83d49101c4d88445ec5496aad7c40d1e172c6f79549a9183268bb383ca3ad90e27cfdd

memory/4780-167-0x0000000000000000-mapping.dmp

memory/4780-168-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4780-170-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4780-171-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1484-172-0x00000000772F0000-0x0000000077493000-memory.dmp

memory/1484-173-0x0000000074960000-0x0000000074F11000-memory.dmp

memory/1884-174-0x0000000000000000-mapping.dmp

memory/1884-175-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1884-177-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1884-178-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

MD5 f94dc819ca773f1e3cb27abbc9e7fa27
SHA1 9a7700efadc5ea09ab288544ef1e3cd876255086
SHA256 a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA512 72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

memory/1884-180-0x0000000000400000-0x0000000000458000-memory.dmp