Malware Analysis Report

2025-01-02 14:17

Sample ID 220731-f1f4eabchr
Target 83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b
SHA256 83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b
Tags
hawkeye collection keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b

Threat Level: Known bad

The file 83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b was found to be: Known bad.

Malicious Activity Summary

hawkeye collection keylogger spyware stealer trojan

HawkEye

NirSoft MailPassView

Nirsoft

NirSoft WebBrowserPassView

Executes dropped EXE

Uses the VBS compiler for execution

Loads dropped DLL

Deletes itself

Checks computer location settings

Accesses Microsoft Outlook accounts

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of UnmapMainImage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-31 05:20

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-31 05:20

Reported

2022-07-31 07:51

Platform

win7-20220718-en

Max time kernel

147s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1356 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe
PID 1356 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe
PID 1356 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe
PID 1356 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe
PID 896 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 896 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 896 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 896 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 896 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 896 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 896 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1564 wrote to memory of 668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1564 wrote to memory of 668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1564 wrote to memory of 668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1564 wrote to memory of 668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1564 wrote to memory of 668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1564 wrote to memory of 668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1564 wrote to memory of 668 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 668 wrote to memory of 760 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 760 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 760 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 760 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 760 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 760 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 760 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 760 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 760 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 760 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 760 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 760 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 760 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe

"C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe"

C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe

C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

"C:\Users\Admin\AppData\Roaming\Windows Update.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

C:\Users\Admin\AppData\Roaming\Windows Update.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.154.36:80 whatismyipaddress.com tcp
US 104.16.154.36:443 whatismyipaddress.com tcp
US 104.16.154.36:443 whatismyipaddress.com tcp
US 8.8.8.8:53 smtp.yandex.com udp
RU 77.88.21.158:587 smtp.yandex.com tcp

Files

memory/1356-56-0x00000000003E0000-0x00000000003E7000-memory.dmp

memory/1356-57-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

memory/896-58-0x00000000004D32D2-mapping.dmp

memory/1356-59-0x0000000076FC0000-0x0000000077140000-memory.dmp

memory/896-63-0x0000000000400000-0x0000000000477000-memory.dmp

memory/896-66-0x0000000002580000-0x0000000002610000-memory.dmp

memory/896-69-0x0000000076FC0000-0x0000000077140000-memory.dmp

memory/896-70-0x0000000076FC0000-0x0000000077140000-memory.dmp

memory/896-71-0x0000000008A40000-0x0000000009538000-memory.dmp

memory/896-72-0x0000000074190000-0x000000007473B000-memory.dmp

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 a469bc3854c73406e2c2a533cf60de93
SHA1 f3e4070d2f091e44068349e07ffe5532ac1b80b8
SHA256 83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b
SHA512 02146bd2d7c094e4470e330028c8e9a06d755f0d85aab6eca3426486eb3f478571fbc5bf74489b7439d299f96d438a3d558eacddee82869246dff00c05ac1b3b

memory/1564-74-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 a469bc3854c73406e2c2a533cf60de93
SHA1 f3e4070d2f091e44068349e07ffe5532ac1b80b8
SHA256 83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b
SHA512 02146bd2d7c094e4470e330028c8e9a06d755f0d85aab6eca3426486eb3f478571fbc5bf74489b7439d299f96d438a3d558eacddee82869246dff00c05ac1b3b

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 a469bc3854c73406e2c2a533cf60de93
SHA1 f3e4070d2f091e44068349e07ffe5532ac1b80b8
SHA256 83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b
SHA512 02146bd2d7c094e4470e330028c8e9a06d755f0d85aab6eca3426486eb3f478571fbc5bf74489b7439d299f96d438a3d558eacddee82869246dff00c05ac1b3b

memory/896-77-0x0000000076FC0000-0x0000000077140000-memory.dmp

memory/896-79-0x0000000074190000-0x000000007473B000-memory.dmp

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 a469bc3854c73406e2c2a533cf60de93
SHA1 f3e4070d2f091e44068349e07ffe5532ac1b80b8
SHA256 83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b
SHA512 02146bd2d7c094e4470e330028c8e9a06d755f0d85aab6eca3426486eb3f478571fbc5bf74489b7439d299f96d438a3d558eacddee82869246dff00c05ac1b3b

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 a469bc3854c73406e2c2a533cf60de93
SHA1 f3e4070d2f091e44068349e07ffe5532ac1b80b8
SHA256 83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b
SHA512 02146bd2d7c094e4470e330028c8e9a06d755f0d85aab6eca3426486eb3f478571fbc5bf74489b7439d299f96d438a3d558eacddee82869246dff00c05ac1b3b

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 a469bc3854c73406e2c2a533cf60de93
SHA1 f3e4070d2f091e44068349e07ffe5532ac1b80b8
SHA256 83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b
SHA512 02146bd2d7c094e4470e330028c8e9a06d755f0d85aab6eca3426486eb3f478571fbc5bf74489b7439d299f96d438a3d558eacddee82869246dff00c05ac1b3b

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 a469bc3854c73406e2c2a533cf60de93
SHA1 f3e4070d2f091e44068349e07ffe5532ac1b80b8
SHA256 83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b
SHA512 02146bd2d7c094e4470e330028c8e9a06d755f0d85aab6eca3426486eb3f478571fbc5bf74489b7439d299f96d438a3d558eacddee82869246dff00c05ac1b3b

memory/668-86-0x00000000004D32D2-mapping.dmp

memory/1564-89-0x0000000076FC0000-0x0000000077140000-memory.dmp

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 a469bc3854c73406e2c2a533cf60de93
SHA1 f3e4070d2f091e44068349e07ffe5532ac1b80b8
SHA256 83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b
SHA512 02146bd2d7c094e4470e330028c8e9a06d755f0d85aab6eca3426486eb3f478571fbc5bf74489b7439d299f96d438a3d558eacddee82869246dff00c05ac1b3b

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 a469bc3854c73406e2c2a533cf60de93
SHA1 f3e4070d2f091e44068349e07ffe5532ac1b80b8
SHA256 83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b
SHA512 02146bd2d7c094e4470e330028c8e9a06d755f0d85aab6eca3426486eb3f478571fbc5bf74489b7439d299f96d438a3d558eacddee82869246dff00c05ac1b3b

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 a469bc3854c73406e2c2a533cf60de93
SHA1 f3e4070d2f091e44068349e07ffe5532ac1b80b8
SHA256 83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b
SHA512 02146bd2d7c094e4470e330028c8e9a06d755f0d85aab6eca3426486eb3f478571fbc5bf74489b7439d299f96d438a3d558eacddee82869246dff00c05ac1b3b

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 a469bc3854c73406e2c2a533cf60de93
SHA1 f3e4070d2f091e44068349e07ffe5532ac1b80b8
SHA256 83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b
SHA512 02146bd2d7c094e4470e330028c8e9a06d755f0d85aab6eca3426486eb3f478571fbc5bf74489b7439d299f96d438a3d558eacddee82869246dff00c05ac1b3b

memory/668-95-0x0000000000400000-0x0000000000477000-memory.dmp

memory/668-99-0x0000000001FC0000-0x0000000002050000-memory.dmp

memory/668-102-0x0000000009090000-0x0000000009220000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 a9dab103e6e15bfde37c1840dac641fa
SHA1 e0daf2f6a1b16eacc062a7f1451ea16664dcc28d
SHA256 b8eadf4478db0a4b8e9b499374757b992f938aa0d3beb672a3fc6299434fa05d
SHA512 db0af41e5aa3f27d679ae21cb872db3372e38fe6a2ada45ec94dcd67e567265c22507d5f5b549f7294be6789edbbb0edb19e30e47902fff5c96a82d77c2951c7

memory/668-104-0x0000000076FC0000-0x0000000077140000-memory.dmp

memory/668-105-0x0000000076FC0000-0x0000000077140000-memory.dmp

memory/668-106-0x0000000074110000-0x00000000746BB000-memory.dmp

memory/760-108-0x0000000000411654-mapping.dmp

memory/760-107-0x0000000000400000-0x000000000041B000-memory.dmp

memory/668-110-0x00000000005A5000-0x00000000005B6000-memory.dmp

memory/760-112-0x0000000000400000-0x000000000041B000-memory.dmp

memory/760-114-0x0000000000400000-0x000000000041B000-memory.dmp

memory/668-115-0x0000000076FC0000-0x0000000077140000-memory.dmp

memory/668-116-0x0000000076FC0000-0x0000000077140000-memory.dmp

memory/668-117-0x0000000074110000-0x00000000746BB000-memory.dmp

memory/668-118-0x0000000074110000-0x00000000746BB000-memory.dmp

memory/1712-119-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1712-120-0x0000000000442628-mapping.dmp

memory/1712-123-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1712-125-0x0000000000400000-0x0000000000458000-memory.dmp

memory/760-126-0x0000000000400000-0x000000000041B000-memory.dmp

memory/668-127-0x00000000005A5000-0x00000000005B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/1712-129-0x0000000000400000-0x0000000000458000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-31 05:20

Reported

2022-07-31 07:52

Platform

win10v2004-20220722-en

Max time kernel

157s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe"

Signatures

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2392 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe
PID 2392 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe
PID 2392 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe
PID 380 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 380 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 380 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1672 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1672 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 1672 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe

Processes

C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe

"C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe"

C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe

C:\Users\Admin\AppData\Local\Temp\83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

"C:\Users\Admin\AppData\Roaming\Windows Update.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

C:\Users\Admin\AppData\Roaming\Windows Update.exe"

Network

Country Destination Domain Proto
BE 8.238.111.254:80 tcp
BE 8.238.111.254:80 tcp
BE 8.238.111.254:80 tcp

Files

memory/2392-134-0x00000000022D0000-0x00000000022D7000-memory.dmp

memory/380-135-0x0000000000000000-mapping.dmp

memory/2392-136-0x0000000076FC0000-0x0000000077163000-memory.dmp

memory/380-139-0x0000000000400000-0x0000000000477000-memory.dmp

memory/380-142-0x0000000076FC0000-0x0000000077163000-memory.dmp

memory/380-143-0x0000000002B20000-0x0000000002BB0000-memory.dmp

memory/380-146-0x0000000074630000-0x0000000074BE1000-memory.dmp

memory/380-147-0x0000000076FC0000-0x0000000077163000-memory.dmp

memory/380-148-0x0000000074630000-0x0000000074BE1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 a469bc3854c73406e2c2a533cf60de93
SHA1 f3e4070d2f091e44068349e07ffe5532ac1b80b8
SHA256 83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b
SHA512 02146bd2d7c094e4470e330028c8e9a06d755f0d85aab6eca3426486eb3f478571fbc5bf74489b7439d299f96d438a3d558eacddee82869246dff00c05ac1b3b

memory/1672-149-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 a469bc3854c73406e2c2a533cf60de93
SHA1 f3e4070d2f091e44068349e07ffe5532ac1b80b8
SHA256 83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b
SHA512 02146bd2d7c094e4470e330028c8e9a06d755f0d85aab6eca3426486eb3f478571fbc5bf74489b7439d299f96d438a3d558eacddee82869246dff00c05ac1b3b

memory/380-154-0x0000000076FC0000-0x0000000077163000-memory.dmp

memory/380-155-0x0000000074630000-0x0000000074BE1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 a469bc3854c73406e2c2a533cf60de93
SHA1 f3e4070d2f091e44068349e07ffe5532ac1b80b8
SHA256 83e2a7ad036af18cfadc0a723ce688507f2079f05f20ef3678708f80322c6d5b
SHA512 02146bd2d7c094e4470e330028c8e9a06d755f0d85aab6eca3426486eb3f478571fbc5bf74489b7439d299f96d438a3d558eacddee82869246dff00c05ac1b3b

memory/3736-156-0x0000000000000000-mapping.dmp

memory/1672-158-0x0000000076FC0000-0x0000000077163000-memory.dmp