Malware Analysis Report

2024-09-22 11:24

Sample ID 230921-jj8zmsgf24
Target NO#CU-92504 Xls_1.lzh
SHA256 c7448faf4e8737ed7260e0c0d48c56ba74b54e558805b869d28902d0b5a911eb
Tags
hawkeye collection evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c7448faf4e8737ed7260e0c0d48c56ba74b54e558805b869d28902d0b5a911eb

Threat Level: Known bad

The file NO#CU-92504 Xls_1.lzh was found to be: Known bad.

Malicious Activity Summary

hawkeye collection evasion keylogger persistence spyware stealer trojan

HawkEye

NirSoft MailPassView

Nirsoft

Looks for VirtualBox Guest Additions in registry

NirSoft WebBrowserPassView

Looks for VMWare Tools registry key

Checks BIOS information in registry

Checks computer location settings

Uses the VBS compiler for execution

Looks up external IP address via web service

Accesses Microsoft Outlook accounts

Adds Run key to start application

Maps connected drives based on registry

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2023-09-21 07:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-21 07:43

Reported

2023-09-21 07:46

Platform

win7-20230831-en

Max time kernel

150s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1496 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\SysWOW64\schtasks.exe
PID 1496 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\SysWOW64\schtasks.exe
PID 1496 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\SysWOW64\schtasks.exe
PID 1496 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\SysWOW64\schtasks.exe
PID 1496 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 1496 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 1496 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 1496 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 1496 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 1496 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 1496 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 1496 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 1496 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 2608 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2608 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe

"C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pbFphueKZdI" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDBFD.tmp"

C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe

"{path}"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.155.36:80 whatismyipaddress.com tcp
US 104.16.155.36:443 whatismyipaddress.com tcp
US 8.8.8.8:53 mail.lucd.shop udp
US 109.106.251.58:587 mail.lucd.shop tcp
US 8.8.8.8:53 apps.identrust.com udp
US 2.18.121.141:80 apps.identrust.com tcp

Files

memory/1496-0-0x0000000000830000-0x0000000000958000-memory.dmp

memory/1496-1-0x00000000749F0000-0x00000000750DE000-memory.dmp

memory/1496-2-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

memory/1496-3-0x00000000005E0000-0x00000000005EC000-memory.dmp

memory/1496-4-0x00000000749F0000-0x00000000750DE000-memory.dmp

memory/1496-5-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

memory/1496-6-0x0000000005C90000-0x0000000005D58000-memory.dmp

memory/1496-7-0x0000000005B00000-0x0000000005B88000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpDBFD.tmp

MD5 d1c5c68dc5031aca79a54ad239b4ebfa
SHA1 04b53e53bd8db03b17e6dae71f763b85ce3e2327
SHA256 e181a47de3ff19e905d9ce26548508db87b592f7a467e5b362937657c0981419
SHA512 aa8f74ee03a0e32597e820ddfd299bd5e97e78011ad8501d48b8c1c5122d7801c625178d3566e73e86f7f8fd44f72c663621087041f890a0441d3e6403ff29ea

memory/2608-11-0x0000000000400000-0x0000000000488000-memory.dmp

memory/2608-12-0x0000000000400000-0x0000000000488000-memory.dmp

memory/2608-13-0x0000000000400000-0x0000000000488000-memory.dmp

memory/2608-15-0x0000000000400000-0x0000000000488000-memory.dmp

memory/2608-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2608-19-0x0000000000400000-0x0000000000488000-memory.dmp

memory/2608-21-0x0000000000400000-0x0000000000488000-memory.dmp

memory/2608-23-0x0000000000400000-0x0000000000488000-memory.dmp

memory/2608-24-0x00000000749F0000-0x00000000750DE000-memory.dmp

memory/2608-25-0x0000000005160000-0x00000000051A0000-memory.dmp

memory/1496-26-0x00000000749F0000-0x00000000750DE000-memory.dmp

memory/2608-31-0x0000000000740000-0x0000000000748000-memory.dmp

memory/912-32-0x0000000000400000-0x000000000041B000-memory.dmp

memory/912-35-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2608-34-0x0000000005160000-0x00000000051A0000-memory.dmp

memory/912-36-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2608-37-0x00000000749F0000-0x00000000750DE000-memory.dmp

memory/2608-38-0x0000000005160000-0x00000000051A0000-memory.dmp

memory/912-40-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2608-41-0x0000000005160000-0x00000000051A0000-memory.dmp

memory/2948-44-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2948-42-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2948-45-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/2948-49-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab3E69.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\Local\Temp\Tar3F85.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 13243d59a53c066dc1ff8c0a7c4768d9
SHA1 a457736b9560c4c2ffdfabd7e8cf1eefd9db18ce
SHA256 e57cf526e8109e00dae549d2a33b06bd1b55e67568ff35da1230ab35e7c59ae1
SHA512 cc846eae039d6f84abf76b23589df656de64485266b61e4acc2800831ee2c76aecc53bbc058aa832420b3c90b901be03f32cd009077918461f0d68c1fa212227

Analysis: behavioral2

Detonation Overview

Submitted

2023-09-21 07:43

Reported

2023-09-21 07:47

Platform

win10v2004-20230915-en

Max time kernel

151s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1484 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\SysWOW64\schtasks.exe
PID 1484 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\SysWOW64\schtasks.exe
PID 1484 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\SysWOW64\schtasks.exe
PID 1484 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 1484 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 1484 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 1484 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 1484 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 1484 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 1484 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 1484 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 1484 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 1484 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 1484 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 3176 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3176 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3176 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3176 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3176 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3176 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3176 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3176 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3176 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3176 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3176 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3176 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3176 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3176 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3176 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3176 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3176 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3176 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe

"C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pbFphueKZdI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp96EC.tmp"

C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe

"{path}"

C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe

"{path}"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.154.36:80 whatismyipaddress.com tcp
US 104.16.154.36:443 whatismyipaddress.com tcp
US 8.8.8.8:53 36.154.16.104.in-addr.arpa udp
US 8.8.8.8:53 mail.lucd.shop udp
US 109.106.251.58:587 mail.lucd.shop tcp
US 8.8.8.8:53 58.251.106.109.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp

Files

memory/1484-0-0x0000000074E70000-0x0000000075620000-memory.dmp

memory/1484-1-0x0000000000EF0000-0x0000000001018000-memory.dmp

memory/1484-2-0x0000000005A20000-0x0000000005ABC000-memory.dmp

memory/1484-3-0x0000000006070000-0x0000000006614000-memory.dmp

memory/1484-4-0x0000000005B60000-0x0000000005BF2000-memory.dmp

memory/1484-5-0x00000000059C0000-0x00000000059D0000-memory.dmp

memory/1484-6-0x0000000005AC0000-0x0000000005ACA000-memory.dmp

memory/1484-7-0x0000000005CF0000-0x0000000005D46000-memory.dmp

memory/1484-8-0x0000000006DF0000-0x0000000006DFC000-memory.dmp

memory/1484-9-0x0000000074E70000-0x0000000075620000-memory.dmp

memory/1484-10-0x00000000059C0000-0x00000000059D0000-memory.dmp

memory/1484-11-0x0000000008960000-0x0000000008A28000-memory.dmp

memory/1484-12-0x0000000008710000-0x0000000008798000-memory.dmp

memory/1484-13-0x0000000008820000-0x0000000008886000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp96EC.tmp

MD5 84eb4f8731b42eec2524f185021f86de
SHA1 5fc9445e68ccd5fc93a74378bbab01781577c51e
SHA256 0a864471c4f171ff7d4fa6684b2560353e1feb9d620768489f147a7d5ac04337
SHA512 ca306802cafe653970ed85044877c42c438c8c14efbd42a1e220dc671ec26b9340a6952c2656b502ef746ffa7654c61ac00e3280378211020512f70dfcdc60fe

memory/3176-17-0x0000000000400000-0x0000000000488000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NO#CU-92504 Xls.exe.log

MD5 5200da2e50f24d5d543c3f10674acdcb
SHA1 b574a3336839882d799c0a7f635ea238efb934ee
SHA256 d2d81c1c9d35bc66149beaa77029bee68664d8512fc1efe373180bab77d61026
SHA512 24722a7de3250a6027a411c8b79d0720554c4efd59553f54b94ab77dc21efbf3191e0912901db475f08a6e9c1855d9e9594504d80d27300097418f4384a9d9cb

memory/3176-20-0x0000000074E70000-0x0000000075620000-memory.dmp

memory/1484-21-0x0000000074E70000-0x0000000075620000-memory.dmp

memory/3176-22-0x0000000005410000-0x0000000005420000-memory.dmp

memory/3176-27-0x00000000087F0000-0x00000000087F8000-memory.dmp

memory/1324-28-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3176-30-0x0000000005410000-0x0000000005420000-memory.dmp

memory/1324-31-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1324-32-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1324-34-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3176-35-0x0000000074E70000-0x0000000075620000-memory.dmp

memory/3176-36-0x0000000005410000-0x0000000005420000-memory.dmp

memory/3176-37-0x0000000005410000-0x0000000005420000-memory.dmp

memory/1628-38-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1628-40-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1628-41-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1628-47-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

MD5 f94dc819ca773f1e3cb27abbc9e7fa27
SHA1 9a7700efadc5ea09ab288544ef1e3cd876255086
SHA256 a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA512 72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196