Malware Analysis Report

2025-01-02 14:13

Sample ID 220801-sf4p7abddk
Target 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA256 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
Tags
hawkeye keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b

Threat Level: Known bad

The file 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b was found to be: Known bad.

Malicious Activity Summary

hawkeye keylogger spyware stealer trojan

HawkEye

NirSoft MailPassView

Nirsoft

NirSoft WebBrowserPassView

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Deletes itself

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of UnmapMainImage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-08-01 15:04

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-08-01 15:04

Reported

2022-08-01 15:16

Platform

win7-20220718-en

Max time kernel

150s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 964 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe
PID 964 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe
PID 964 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe
PID 964 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe
PID 952 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 952 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 952 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 952 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 952 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 952 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 952 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 868 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 868 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 868 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 868 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 868 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 868 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe
PID 868 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe C:\Users\Admin\AppData\Roaming\Windows Update.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe

"C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe"

C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe

C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

"C:\Users\Admin\AppData\Roaming\Windows Update.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

C:\Users\Admin\AppData\Roaming\Windows Update.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.154.36:80 whatismyipaddress.com tcp

Files

memory/964-56-0x00000000003E0000-0x00000000003E7000-memory.dmp

memory/964-57-0x00000000769D1000-0x00000000769D3000-memory.dmp

memory/952-58-0x00000000004D11BD-mapping.dmp

memory/964-59-0x0000000077E00000-0x0000000077F80000-memory.dmp

memory/952-63-0x0000000000400000-0x0000000000477000-memory.dmp

memory/952-67-0x0000000000480000-0x0000000000510000-memory.dmp

memory/952-66-0x0000000000482000-0x000000000050A000-memory.dmp

memory/952-69-0x00000000067E0000-0x00000000068A1000-memory.dmp

memory/952-70-0x0000000077E00000-0x0000000077F80000-memory.dmp

memory/952-71-0x0000000077E00000-0x0000000077F80000-memory.dmp

memory/952-72-0x0000000074FD0000-0x000000007557B000-memory.dmp

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 510f9e146edd3103ddd4b7da3f6521ee
SHA1 affc015f99525fd0884c06812a54af3557331a5e
SHA256 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512 b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231

memory/868-74-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 510f9e146edd3103ddd4b7da3f6521ee
SHA1 affc015f99525fd0884c06812a54af3557331a5e
SHA256 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512 b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 510f9e146edd3103ddd4b7da3f6521ee
SHA1 affc015f99525fd0884c06812a54af3557331a5e
SHA256 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512 b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231

memory/952-77-0x0000000077E00000-0x0000000077F80000-memory.dmp

memory/952-78-0x0000000074FD0000-0x000000007557B000-memory.dmp

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 510f9e146edd3103ddd4b7da3f6521ee
SHA1 affc015f99525fd0884c06812a54af3557331a5e
SHA256 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512 b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 510f9e146edd3103ddd4b7da3f6521ee
SHA1 affc015f99525fd0884c06812a54af3557331a5e
SHA256 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512 b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 510f9e146edd3103ddd4b7da3f6521ee
SHA1 affc015f99525fd0884c06812a54af3557331a5e
SHA256 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512 b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231

memory/868-85-0x00000000002D0000-0x00000000003BF000-memory.dmp

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 510f9e146edd3103ddd4b7da3f6521ee
SHA1 affc015f99525fd0884c06812a54af3557331a5e
SHA256 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512 b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231

memory/868-87-0x0000000077E00000-0x0000000077F80000-memory.dmp

memory/1568-88-0x00000000004D11BD-mapping.dmp

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 510f9e146edd3103ddd4b7da3f6521ee
SHA1 affc015f99525fd0884c06812a54af3557331a5e
SHA256 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512 b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 510f9e146edd3103ddd4b7da3f6521ee
SHA1 affc015f99525fd0884c06812a54af3557331a5e
SHA256 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512 b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231

\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 510f9e146edd3103ddd4b7da3f6521ee
SHA1 affc015f99525fd0884c06812a54af3557331a5e
SHA256 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512 b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231

memory/868-90-0x0000000077E00000-0x0000000077F80000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 510f9e146edd3103ddd4b7da3f6521ee
SHA1 affc015f99525fd0884c06812a54af3557331a5e
SHA256 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512 b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231

memory/1568-97-0x0000000000400000-0x0000000000477000-memory.dmp

memory/1568-102-0x00000000009B0000-0x0000000000A40000-memory.dmp

memory/1568-104-0x0000000077E00000-0x0000000077F80000-memory.dmp

memory/1568-105-0x0000000077E00000-0x0000000077F80000-memory.dmp

memory/1568-106-0x0000000074F50000-0x00000000754FB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 77e59d559fcd40ef905a3a09bdca6c87
SHA1 2f36517d4388f4c50fe3f1012d6dee451b5ccef2
SHA256 7bb228ee03097c93bcdefca40280a7a7aa9a05e150266c0ec694345fd3a62483
SHA512 aaf452fbf90b6382809f6e99a96f471d3f1b735106f4876c3d7070fae70b95791c6a7ac4f7a5475dbdb7a28228587e6f3282397dcca9413a4585f5756fb275b7

Analysis: behavioral2

Detonation Overview

Submitted

2022-08-01 15:04

Reported

2022-08-01 15:16

Platform

win10v2004-20220721-en

Max time kernel

153s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe"

Signatures

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe

"C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe"

C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe

C:\Users\Admin\AppData\Local\Temp\5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b.exe"

C:\Users\Admin\AppData\Roaming\Windows Update.exe

"C:\Users\Admin\AppData\Roaming\Windows Update.exe"

Network

Country Destination Domain Proto
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 20.42.65.84:443 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 204.79.197.203:80 tcp

Files

memory/4952-132-0x00000000006F0000-0x00000000006F7000-memory.dmp

memory/2444-133-0x0000000000000000-mapping.dmp

memory/4952-134-0x00000000775C0000-0x0000000077763000-memory.dmp

memory/2444-135-0x00000000775C0000-0x0000000077763000-memory.dmp

memory/2444-138-0x0000000000400000-0x0000000000477000-memory.dmp

memory/2444-141-0x00000000775C0000-0x0000000077763000-memory.dmp

memory/2444-142-0x00000000775C0000-0x0000000077763000-memory.dmp

memory/2444-143-0x00000000775C0000-0x0000000077763000-memory.dmp

memory/2444-144-0x0000000002190000-0x0000000002220000-memory.dmp

memory/2444-147-0x0000000074C30000-0x00000000751E1000-memory.dmp

memory/1948-148-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 510f9e146edd3103ddd4b7da3f6521ee
SHA1 affc015f99525fd0884c06812a54af3557331a5e
SHA256 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512 b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231

C:\Users\Admin\AppData\Roaming\Windows Update.exe

MD5 510f9e146edd3103ddd4b7da3f6521ee
SHA1 affc015f99525fd0884c06812a54af3557331a5e
SHA256 5c4a994d5c837fd1f9acfe9961bbb4bd5f01d4e6e9b6f2d0ff20d812bb38a33b
SHA512 b2e94a1f2f169d0275102072644b6ff8729a74acadfa0328ac7baca6bec198ce119556e8719c015bb205f437fbd4ad9973875f9d5c82dc89f9841303914c6231

memory/2444-153-0x00000000775C0000-0x0000000077763000-memory.dmp

memory/2444-154-0x0000000074C30000-0x00000000751E1000-memory.dmp