Malware Analysis Report

2025-01-02 14:09

Sample ID 221001-2cq5csbcej
Target 9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9
SHA256 9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9
Tags
hawkeye collection keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9

Threat Level: Known bad

The file 9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9 was found to be: Known bad.

Malicious Activity Summary

hawkeye collection keylogger persistence spyware stealer trojan

HawkEye

Uses the VBS compiler for execution

Reads user/profile data of web browsers

Drops startup file

Reads local data of messenger clients

Loads dropped DLL

Accesses Microsoft Outlook accounts

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-01 22:26

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-01 22:26

Reported

2022-10-02 00:28

Platform

win7-20220812-en

Max time kernel

143s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DbIXtKRzHJkl.lnk C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe N/A

Reads local data of messenger clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1604 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1604 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1604 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1604 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1604 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1604 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1604 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1604 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1604 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1604 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1604 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1604 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1756 wrote to memory of 1308 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1308 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1308 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1308 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1308 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1308 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1308 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1308 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1308 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1308 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1772 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1772 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1772 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1772 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1772 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1772 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1772 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1772 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1772 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1756 wrote to memory of 1772 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe

"C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.155.36:80 whatismyipaddress.com tcp
US 104.16.155.36:443 whatismyipaddress.com tcp
US 104.16.155.36:443 whatismyipaddress.com tcp
US 8.8.8.8:53 smtp.refreshme.pw udp

Files

memory/1604-54-0x0000000075601000-0x0000000075603000-memory.dmp

memory/1604-55-0x00000000741C0000-0x000000007476B000-memory.dmp

memory/1756-56-0x0000000000400000-0x00000000004E6000-memory.dmp

memory/1756-57-0x0000000000400000-0x00000000004E6000-memory.dmp

memory/1756-60-0x0000000000400000-0x00000000004E6000-memory.dmp

memory/1756-61-0x0000000000400000-0x00000000004E6000-memory.dmp

memory/1756-59-0x0000000000400000-0x00000000004E6000-memory.dmp

memory/1756-62-0x00000000004E1EDE-mapping.dmp

memory/1756-66-0x0000000000400000-0x00000000004E6000-memory.dmp

memory/1756-64-0x0000000000400000-0x00000000004E6000-memory.dmp

memory/1756-68-0x00000000741C0000-0x000000007476B000-memory.dmp

\Users\Admin\AppData\Roaming\nSILlzCwXB\iSrQ1Vb72t6.exe

MD5 750d4ec8af418683740a36f716146e80
SHA1 368fb54cc61f1af20b07d22c6577fa6ff90fd456
SHA256 9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9
SHA512 39826fbc055396a9d41009d061a538d06dc4feedc2b5c0dd8c6179487268f1cc511beca95b070a9e3a087ab4d2011cd714894996479a6268c2a520c97e72b1c4

memory/1604-70-0x00000000741C0000-0x000000007476B000-memory.dmp

memory/1756-71-0x00000000741C0000-0x000000007476B000-memory.dmp

memory/1308-72-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1308-73-0x0000000000442FBF-mapping.dmp

memory/1308-76-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1308-78-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1756-77-0x0000000000386000-0x0000000000397000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holdermail.txt

MD5 e62221a3bb549a72fcc4afa60d34e620
SHA1 d60b16b540e0e3ed459a30cce0678d1fc8a1989a
SHA256 587f8f51485b575f30e5e1608f70b31b9d8bb384318802373cc52cbdf2a4aa95
SHA512 5b6f6a3a88961b62870e486b02e41d065b3f054f3ad45f7c7e01aff3ba151893e36fd3c13771ed9e3738aaa525296a8ee72adc05fb32932ec3af259404172aed

memory/1308-80-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1772-82-0x0000000000442C62-mapping.dmp

memory/1772-81-0x0000000000400000-0x000000000046F000-memory.dmp

memory/1772-85-0x0000000000400000-0x000000000046F000-memory.dmp

memory/1772-87-0x0000000000400000-0x000000000046F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holdermail.txt

MD5 c3609e29395ccd5fd8407fed36414e75
SHA1 04c0c5dc3fcced0c5581c44af17fa60260fb591a
SHA256 a32df1c247d5738af4241edc4aa520dbb21013d05d47cac5db96ccfb48de7857
SHA512 8bbd7b458f2be6e91c46cad8f682e109c7a7317f9ae89e5ce889ae7d4db5775b83d03016f47b56aa75bd5646a50c06ae7adbf2fc8af6b9f8a976f2ce30de3533

memory/1756-88-0x0000000000386000-0x0000000000397000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-01 22:26

Reported

2022-10-02 00:29

Platform

win10v2004-20220812-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DbIXtKRzHJkl.lnk C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe N/A

Reads local data of messenger clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4512 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4512 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4512 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4512 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4512 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4512 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4512 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4512 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4656 wrote to memory of 260 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4656 wrote to memory of 260 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4656 wrote to memory of 260 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4656 wrote to memory of 260 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4656 wrote to memory of 260 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4656 wrote to memory of 260 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4656 wrote to memory of 260 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4656 wrote to memory of 260 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4656 wrote to memory of 260 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4656 wrote to memory of 2864 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4656 wrote to memory of 2864 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4656 wrote to memory of 2864 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4656 wrote to memory of 2864 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4656 wrote to memory of 2864 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4656 wrote to memory of 2864 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4656 wrote to memory of 2864 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4656 wrote to memory of 2864 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4656 wrote to memory of 2864 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe

"C:\Users\Admin\AppData\Local\Temp\9c82e7cd7d5ed83a86fc07167c2a5245b23930f77087ecbeb6ecb8f17cb833f9.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

Network

Country Destination Domain Proto
US 209.197.3.8:80 tcp
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.155.36:80 whatismyipaddress.com tcp
US 104.16.155.36:443 whatismyipaddress.com tcp
US 8.8.8.8:53 smtp.refreshme.pw udp
US 52.242.97.97:443 tcp
US 8.8.8.8:53 smtp.refreshme.pw udp
DE 51.116.253.168:443 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
NL 104.80.225.205:443 tcp
US 8.8.8.8:53 15.89.54.20.in-addr.arpa udp
US 93.184.220.29:80 tcp

Files

memory/4512-132-0x0000000074D20000-0x00000000752D1000-memory.dmp

memory/4656-133-0x0000000000000000-mapping.dmp

memory/4656-134-0x0000000000400000-0x00000000004E6000-memory.dmp

memory/4656-135-0x0000000074D20000-0x00000000752D1000-memory.dmp

memory/4512-136-0x0000000074D20000-0x00000000752D1000-memory.dmp

memory/260-138-0x0000000000400000-0x000000000046E000-memory.dmp

memory/260-137-0x0000000000000000-mapping.dmp

memory/260-139-0x0000000000400000-0x000000000046E000-memory.dmp

memory/260-140-0x0000000000400000-0x000000000046E000-memory.dmp

memory/260-141-0x0000000000400000-0x000000000046E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holdermail.txt

MD5 e62221a3bb549a72fcc4afa60d34e620
SHA1 d60b16b540e0e3ed459a30cce0678d1fc8a1989a
SHA256 587f8f51485b575f30e5e1608f70b31b9d8bb384318802373cc52cbdf2a4aa95
SHA512 5b6f6a3a88961b62870e486b02e41d065b3f054f3ad45f7c7e01aff3ba151893e36fd3c13771ed9e3738aaa525296a8ee72adc05fb32932ec3af259404172aed

memory/4656-143-0x0000000074D20000-0x00000000752D1000-memory.dmp

memory/2864-144-0x0000000000000000-mapping.dmp

memory/2864-145-0x0000000000400000-0x000000000046F000-memory.dmp

memory/2864-146-0x0000000000400000-0x000000000046F000-memory.dmp

memory/2864-147-0x0000000000400000-0x000000000046F000-memory.dmp

memory/2864-148-0x0000000000400000-0x000000000046F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holdermail.txt

MD5 c3609e29395ccd5fd8407fed36414e75
SHA1 04c0c5dc3fcced0c5581c44af17fa60260fb591a
SHA256 a32df1c247d5738af4241edc4aa520dbb21013d05d47cac5db96ccfb48de7857
SHA512 8bbd7b458f2be6e91c46cad8f682e109c7a7317f9ae89e5ce889ae7d4db5775b83d03016f47b56aa75bd5646a50c06ae7adbf2fc8af6b9f8a976f2ce30de3533

memory/2864-150-0x0000000000400000-0x000000000046F000-memory.dmp