Overview

overview

10

Static

static

7

9cc92274df...22.exe

windows7-x64

10

9cc92274df...22.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    154s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-11-2022 11:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9cc92274df864afffdc64af3537d37033aff710061b4cc1863153a4d5a435c22.exe

  • Size

    992KB

  • MD5

    f915f94f551c0c5371d093dbe27bbfaa

  • SHA1

    912941a11e2c924eceb37ac5928ba457a10d8512

  • SHA256

    9cc92274df864afffdc64af3537d37033aff710061b4cc1863153a4d5a435c22

  • SHA512

    a5eecf05caa8fab3e1f98b43b222b4c1ea2080d243e9601590342410eeb9f1481e7352ebed76a56849ffb8ed0481fcc06b136253701c879370b22b610abab786

  • SSDEEP

    24576:NaPY8FueJVd/IfHydpi7m4Qt/XZhGPUKcpO+gpqeDySVR+PJ:GTN8Ui7mh/DGSpO+gp5nP

Score
10/10
hawkeyeagilenetcollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    diamond7625w@gmail.com
  • Password:
    pdmiawgubaleywef

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye
  • NirSoft MailPassView 5 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9cc92274df864afffdc64af3537d37033aff710061b4cc1863153a4d5a435c22.exe
    "C:\Users\Admin\AppData\Local\Temp\9cc92274df864afffdc64af3537d37033aff710061b4cc1863153a4d5a435c22.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4308
    • C:\Users\Admin\AppData\Local\Temp\9cc92274df864afffdc64af3537d37033aff710061b4cc1863153a4d5a435c22.exe
      "C:\Users\Admin\AppData\Local\Temp\9cc92274df864afffdc64af3537d37033aff710061b4cc1863153a4d5a435c22.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1220
      • C:\Users\Admin\AppData\Local\Temp\9cc92274df864afffdc64af3537d37033aff710061b4cc1863153a4d5a435c22.exe
        "C:\Users\Admin\AppData\Local\Temp\9cc92274df864afffdc64af3537d37033aff710061b4cc1863153a4d5a435c22.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4752
        • C:\Users\Admin\AppData\Local\Temp\9cc92274df864afffdc64af3537d37033aff710061b4cc1863153a4d5a435c22.exe
          "C:\Users\Admin\AppData\Local\Temp\9cc92274df864afffdc64af3537d37033aff710061b4cc1863153a4d5a435c22.exe"
          4⤵
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3812
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
            5⤵
            • Accesses Microsoft Outlook accounts
            PID:3160
    • C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      PID:4844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\9cc92274df864afffdc64af3537d37033aff710061b4cc1863153a4d5a435c22.exe.log
    Filesize

    496B

    MD5

    cb76b18ebed3a9f05a14aed43d35fba6

    SHA1

    836a4b4e351846fca08b84149cb734cb59b8c0d6

    SHA256

    8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

    SHA512

    7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
    Filesize

    11KB

    MD5

    03c4f3f5cdbc342eb1c0349e001fdd0c

    SHA1

    7d45ed19db4eaed16d1985240c98fab7623798e5

    SHA256

    a395cb8bb6cdaa7f0dad2e012fb5107d0d307efea021be048bdd5b67479356bc

    SHA512

    d59ccd1ffffa884c8a7a96979ed19f0f8a586474c23d5b5ab23c235799044042f639e1834ee2e54a205a71caf97898ac8898d0da963fb006e443f3fb8f3c1162

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
    Filesize

    11KB

    MD5

    03c4f3f5cdbc342eb1c0349e001fdd0c

    SHA1

    7d45ed19db4eaed16d1985240c98fab7623798e5

    SHA256

    a395cb8bb6cdaa7f0dad2e012fb5107d0d307efea021be048bdd5b67479356bc

    SHA512

    d59ccd1ffffa884c8a7a96979ed19f0f8a586474c23d5b5ab23c235799044042f639e1834ee2e54a205a71caf97898ac8898d0da963fb006e443f3fb8f3c1162

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
    Filesize

    992KB

    MD5

    f915f94f551c0c5371d093dbe27bbfaa

    SHA1

    912941a11e2c924eceb37ac5928ba457a10d8512

    SHA256

    9cc92274df864afffdc64af3537d37033aff710061b4cc1863153a4d5a435c22

    SHA512

    a5eecf05caa8fab3e1f98b43b222b4c1ea2080d243e9601590342410eeb9f1481e7352ebed76a56849ffb8ed0481fcc06b136253701c879370b22b610abab786

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
    Filesize

    992KB

    MD5

    f915f94f551c0c5371d093dbe27bbfaa

    SHA1

    912941a11e2c924eceb37ac5928ba457a10d8512

    SHA256

    9cc92274df864afffdc64af3537d37033aff710061b4cc1863153a4d5a435c22

    SHA512

    a5eecf05caa8fab3e1f98b43b222b4c1ea2080d243e9601590342410eeb9f1481e7352ebed76a56849ffb8ed0481fcc06b136253701c879370b22b610abab786

    Download Submit
  • memory/1220-135-0x0000000000400000-0x00000000004E6000-memory.dmp
    Filesize

    920KB

    Download
  • memory/1220-136-0x0000000074BA0000-0x0000000075151000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1220-141-0x0000000074BA0000-0x0000000075151000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1220-134-0x0000000000000000-mapping.dmp
    Download
  • memory/1220-150-0x0000000074BA0000-0x0000000075151000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/3160-158-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

    Download
  • memory/3160-156-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

    Download
  • memory/3160-155-0x0000000000000000-mapping.dmp
    Download
  • memory/3160-159-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

    Download
  • memory/3812-152-0x0000000000000000-mapping.dmp
    Download
  • memory/3812-160-0x0000000074BA0000-0x0000000075151000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/3812-154-0x0000000074BA0000-0x0000000075151000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/3812-153-0x0000000000400000-0x0000000000484000-memory.dmp
    Filesize

    528KB

    Download
  • memory/4308-132-0x0000000074BA0000-0x0000000075151000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/4308-133-0x0000000074BA0000-0x0000000075151000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/4308-143-0x0000000074BA0000-0x0000000075151000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/4752-145-0x0000000000000000-mapping.dmp
    Download
  • memory/4752-146-0x0000000000400000-0x00000000004CE000-memory.dmp
    Filesize

    824KB

    Download
  • memory/4752-149-0x0000000074BA0000-0x0000000075151000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/4752-148-0x0000000074BA0000-0x0000000075151000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/4844-142-0x0000000074BA0000-0x0000000075151000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/4844-140-0x0000000074BA0000-0x0000000075151000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/4844-137-0x0000000000000000-mapping.dmp
    Download