Malware Analysis Report

2025-01-02 14:20

Sample ID 220801-v9wmsafdd7
Target 5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265
SHA256 5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265
Tags
hawkeye collection keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265

Threat Level: Known bad

The file 5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265 was found to be: Known bad.

Malicious Activity Summary

hawkeye collection keylogger persistence spyware stealer trojan

HawkEye

Modifies WinLogon for persistence

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Uses the VBS compiler for execution

Reads local data of messenger clients

Checks computer location settings

Accesses Microsoft Outlook accounts

Looks up external IP address via web service

Drops desktop.ini file(s)

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-08-01 17:41

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-08-01 17:41

Reported

2022-08-01 19:49

Platform

win7-20220718-en

Max time kernel

133s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\FolderName\\file.exe" C:\Windows\SysWOW64\reg.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Reads local data of messenger clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1596 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 1596 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 1596 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 1596 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 1596 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 1596 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 1596 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 1596 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 1596 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 1596 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 1596 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 1596 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 1596 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 1596 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 1140 wrote to memory of 1472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1140 wrote to memory of 1472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1140 wrote to memory of 1472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1140 wrote to memory of 1472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1140 wrote to memory of 1472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1140 wrote to memory of 1472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1140 wrote to memory of 1472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1596 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 1596 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 1596 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 1596 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 1596 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 1472 wrote to memory of 1748 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1472 wrote to memory of 1748 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1472 wrote to memory of 1748 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1472 wrote to memory of 1748 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1472 wrote to memory of 1748 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1472 wrote to memory of 1748 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1472 wrote to memory of 1748 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1748 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1748 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1748 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1748 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1748 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1748 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1748 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1596 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 1596 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 1596 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 1596 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 1596 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 1596 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 1596 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Roaming\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1928 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Roaming\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1928 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Roaming\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1928 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Roaming\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1928 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Roaming\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1928 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Roaming\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1928 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Roaming\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1928 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Roaming\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1928 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Roaming\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1928 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Roaming\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1928 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Roaming\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1928 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Roaming\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1928 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Roaming\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1928 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Roaming\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1928 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Roaming\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1928 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Roaming\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1928 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Roaming\svhost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe

"C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Roaming\FolderName\mata.bat

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Roaming\FolderName\invs.vbs" "C:\Users\Admin\AppData\Roaming\FolderName\mata2.bat"

C:\Users\Admin\AppData\Roaming\svhost.exe

C:\Users\Admin\AppData\Roaming\svhost.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\FolderName\mata2.bat" "

C:\Windows\SysWOW64\reg.exe

reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderName\file.exe" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Roaming\FolderName\melt.bat

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.154.36:80 whatismyipaddress.com tcp
US 104.16.154.36:443 whatismyipaddress.com tcp
US 104.16.154.36:443 whatismyipaddress.com tcp
US 8.8.8.8:53 serve9.serve-hosting.net udp

Files

memory/1596-54-0x0000000076871000-0x0000000076873000-memory.dmp

memory/1596-55-0x0000000074800000-0x0000000074DAB000-memory.dmp

memory/1140-56-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\FolderName\mata.bat

MD5 5e57f6f4e3242ad9719ed5e65346e83e
SHA1 72346d0208c5edeb69f41ddb4374d56d87221dad
SHA256 4ffb3e764dfbc48145231f19e2217f666bc88a44c6f29adec6a5728223048d0c
SHA512 7dcd8a5a95965b94bf26ec02ab68b8f854f399d41fb713e4387f6fddb9914c465ccf909f92ee6704e9c0397a77f11f2ca803d68184aa414651988d95824a209f

\Users\Admin\AppData\Roaming\svhost.exe

MD5 278edbd499374bf73621f8c1f969d894
SHA1 a81170af14747781c5f5f51bb1215893136f0bc0
SHA256 c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391
SHA512 93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

memory/1472-60-0x0000000000000000-mapping.dmp

memory/1928-63-0x0000000000400000-0x0000000000522000-memory.dmp

memory/1928-62-0x0000000000400000-0x0000000000522000-memory.dmp

memory/1928-65-0x0000000000400000-0x0000000000522000-memory.dmp

C:\Users\Admin\AppData\Roaming\svhost.exe

MD5 278edbd499374bf73621f8c1f969d894
SHA1 a81170af14747781c5f5f51bb1215893136f0bc0
SHA256 c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391
SHA512 93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

memory/1928-69-0x000000000051BB1E-mapping.dmp

memory/1928-68-0x0000000000400000-0x0000000000522000-memory.dmp

memory/1928-74-0x0000000000400000-0x0000000000522000-memory.dmp

memory/1928-72-0x0000000000400000-0x0000000000522000-memory.dmp

memory/1928-67-0x0000000000400000-0x0000000000522000-memory.dmp

\Users\Admin\AppData\Roaming\svhost.exe

MD5 278edbd499374bf73621f8c1f969d894
SHA1 a81170af14747781c5f5f51bb1215893136f0bc0
SHA256 c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391
SHA512 93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

C:\Users\Admin\AppData\Roaming\svhost.exe

MD5 278edbd499374bf73621f8c1f969d894
SHA1 a81170af14747781c5f5f51bb1215893136f0bc0
SHA256 c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391
SHA512 93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

\Users\Admin\AppData\Roaming\svhost.exe

MD5 278edbd499374bf73621f8c1f969d894
SHA1 a81170af14747781c5f5f51bb1215893136f0bc0
SHA256 c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391
SHA512 93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

C:\Users\Admin\AppData\Roaming\FolderName\invs.vbs

MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

memory/1748-81-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\FolderName\mata2.bat

MD5 8368aae9800dbd35798fdded529c0ccf
SHA1 e34b13938e84712286dadd071e3e3d1950127c7c
SHA256 6eb3672d26aa25f9deedb05dfd2c43e13f871039c94335a8f88511cfa4f0cdfe
SHA512 ef49e8382ab9b2c32c1f97d27b459d9c830ccb74fddc734ca549f0541d798ddbecb314b50aba4b555af48cd885e64c1343ddabe405beb76a8d9f5f124cf2c16a

memory/680-83-0x0000000000000000-mapping.dmp

memory/1928-85-0x0000000074800000-0x0000000074DAB000-memory.dmp

memory/1052-87-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\FolderName\file.exe

MD5 5687085673a9d92c724dcadc69468181
SHA1 e35f1aaccabdc6ba6a71c2e426fedf7fecd00e5a
SHA256 5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265
SHA512 6639f671e2b53fc19602428ad0163a4d9609e3c47b5f6bf0aed6a8c4dbcb3263eefa606690305cbc3312ccab1ac8d3d7963eed00848b1648332ba598b9839ef8

memory/1596-90-0x0000000074800000-0x0000000074DAB000-memory.dmp

C:\Users\Admin\AppData\Roaming\FolderName\melt.bat

MD5 51df7bf7bd7d076d968cc73b46e7d817
SHA1 172f701c5f5e21a6e7ff7346a5bb4d8b569f148b
SHA256 ea54fe5ed3f5d54b9c638225e3384818b3c4240d03f9f521d60529849225458d
SHA512 cd4dd89e4fd8c78afd7b3dc13cdeb88782167d2e0fb52b5b29033e0fd0604ca54667581fe8c7e749904f1b60f6014c6b743aa8031bb9247e846641cf9209ee8f

memory/1928-91-0x0000000074800000-0x0000000074DAB000-memory.dmp

memory/1716-92-0x0000000000400000-0x000000000048E000-memory.dmp

memory/1716-93-0x0000000000400000-0x000000000048E000-memory.dmp

memory/1716-95-0x0000000000400000-0x000000000048E000-memory.dmp

memory/1716-97-0x0000000000400000-0x000000000048E000-memory.dmp

memory/1716-99-0x0000000000400000-0x000000000048E000-memory.dmp

memory/1716-100-0x0000000000400000-0x000000000048E000-memory.dmp

memory/1716-101-0x0000000000462B6D-mapping.dmp

memory/1716-104-0x0000000000400000-0x000000000048E000-memory.dmp

memory/1716-106-0x0000000000400000-0x000000000048E000-memory.dmp

memory/1688-107-0x0000000000400000-0x000000000048B000-memory.dmp

memory/1688-108-0x0000000000400000-0x000000000048B000-memory.dmp

memory/1688-110-0x0000000000400000-0x000000000048B000-memory.dmp

memory/1688-112-0x0000000000400000-0x000000000048B000-memory.dmp

memory/1688-114-0x0000000000400000-0x000000000048B000-memory.dmp

memory/1688-116-0x0000000000460E2D-mapping.dmp

memory/1688-115-0x0000000000400000-0x000000000048B000-memory.dmp

memory/1688-119-0x0000000000400000-0x000000000048B000-memory.dmp

memory/1688-121-0x0000000000400000-0x000000000048B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holdermail.txt

MD5 1265c5140a2f68b05b92aa1a25a2abb6
SHA1 627a660e9d2a41c8c4a662ca44fdb68a1356bc82
SHA256 694bae0c1ebf6f8eeb8d902b1bfad57ed9a42dea6d3e327a0137a1c9f4f0c6b9
SHA512 ad6a1dd57ec84459f28926d07e25f2c4f49dc67ff95b8400e85c3bcb8eccc471dbac5e2b1a2758fb563866ecacc2fae4657dfb85197fb4cd2547eef334b8a216

memory/1716-123-0x0000000000400000-0x000000000048E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-08-01 17:41

Reported

2022-08-01 19:48

Platform

win10v2004-20220722-en

Max time kernel

144s

Max time network

163s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\wscript.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe N/A
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1124 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 1124 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 1124 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2404 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2404 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1124 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 1124 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 1124 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 1124 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 1124 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe
PID 1124 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe

"C:\Users\Admin\AppData\Local\Temp\5b76d300f910dc3a2f6687e5e104fff1e78f637894f5516a7e28054145c5a265.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\FolderName\mata.bat

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Roaming\FolderName\invs.vbs" "C:\Users\Admin\AppData\Roaming\FolderName\mata2.bat"

C:\Users\Admin\AppData\Roaming\svhost.exe

C:\Users\Admin\AppData\Roaming\svhost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\FolderName\melt.bat

Network

Country Destination Domain Proto
US 8.253.209.121:80 tcp
US 8.253.209.121:80 tcp
US 8.253.209.121:80 tcp
GB 104.75.172.68:443 tcp
GB 104.75.172.68:443 tcp

Files

memory/1124-132-0x00000000748C0000-0x0000000074E71000-memory.dmp

memory/1124-133-0x00000000748C0000-0x0000000074E71000-memory.dmp

memory/2404-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\FolderName\mata.bat

MD5 5e57f6f4e3242ad9719ed5e65346e83e
SHA1 72346d0208c5edeb69f41ddb4374d56d87221dad
SHA256 4ffb3e764dfbc48145231f19e2217f666bc88a44c6f29adec6a5728223048d0c
SHA512 7dcd8a5a95965b94bf26ec02ab68b8f854f399d41fb713e4387f6fddb9914c465ccf909f92ee6704e9c0397a77f11f2ca803d68184aa414651988d95824a209f

memory/3636-136-0x0000000000000000-mapping.dmp

memory/4808-137-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\FolderName\invs.vbs

MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

memory/4304-139-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\FolderName\melt.bat

MD5 51df7bf7bd7d076d968cc73b46e7d817
SHA1 172f701c5f5e21a6e7ff7346a5bb4d8b569f148b
SHA256 ea54fe5ed3f5d54b9c638225e3384818b3c4240d03f9f521d60529849225458d
SHA512 cd4dd89e4fd8c78afd7b3dc13cdeb88782167d2e0fb52b5b29033e0fd0604ca54667581fe8c7e749904f1b60f6014c6b743aa8031bb9247e846641cf9209ee8f

memory/1124-141-0x00000000748C0000-0x0000000074E71000-memory.dmp