Malware Analysis Report

2024-09-22 11:24

Sample ID 231011-2ca35sgb9v
Target c7448faf4e8737ed7260e0c0d48c56ba74b54e558805b869d28902d0b5a911eb_JC.lzh
SHA256 c7448faf4e8737ed7260e0c0d48c56ba74b54e558805b869d28902d0b5a911eb
Tags
hawkeye collection evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c7448faf4e8737ed7260e0c0d48c56ba74b54e558805b869d28902d0b5a911eb

Threat Level: Known bad

The file c7448faf4e8737ed7260e0c0d48c56ba74b54e558805b869d28902d0b5a911eb_JC.lzh was found to be: Known bad.

Malicious Activity Summary

hawkeye collection evasion keylogger persistence spyware stealer trojan

HawkEye

Nirsoft

NirSoft WebBrowserPassView

NirSoft MailPassView

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks BIOS information in registry

Checks computer location settings

Uses the VBS compiler for execution

Adds Run key to start application

Looks up external IP address via web service

Maps connected drives based on registry

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Modifies system certificate store

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2023-10-11 22:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-11 22:25

Reported

2023-10-12 19:10

Platform

win7-20230831-en

Max time kernel

157s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2116 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\SysWOW64\schtasks.exe
PID 2116 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\SysWOW64\schtasks.exe
PID 2116 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\SysWOW64\schtasks.exe
PID 2116 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\SysWOW64\schtasks.exe
PID 2116 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 2116 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 2116 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 2116 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 2116 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 2116 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 2116 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 2116 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 2116 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 2684 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2684 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe

"C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pbFphueKZdI" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF048.tmp"

C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe

"{path}"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.155.36:80 whatismyipaddress.com tcp
US 104.16.155.36:443 whatismyipaddress.com tcp
US 8.8.8.8:53 mail.lucd.shop udp
US 109.106.251.58:587 mail.lucd.shop tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 23.72.252.163:80 apps.identrust.com tcp

Files

memory/2116-0-0x0000000000DE0000-0x0000000000F08000-memory.dmp

memory/2116-1-0x0000000074420000-0x0000000074B0E000-memory.dmp

memory/2116-2-0x0000000004D60000-0x0000000004DA0000-memory.dmp

memory/2116-3-0x0000000000340000-0x000000000034C000-memory.dmp

memory/2116-4-0x0000000074420000-0x0000000074B0E000-memory.dmp

memory/2116-5-0x0000000004D60000-0x0000000004DA0000-memory.dmp

memory/2116-6-0x0000000007FA0000-0x0000000008068000-memory.dmp

memory/2116-7-0x0000000004F60000-0x0000000004FE8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpF048.tmp

MD5 b2a928d14756b4ef4b28a44a63f9f84f
SHA1 e552138a6d96f29d500b6eb51948a9e255052460
SHA256 7f6f31123aca39fbf895fa87a810e31bcf194ce81fca2cefacde151feb96a817
SHA512 99770819452327154c93ab0c12ccd48975eb2e83ccf1dfed1d45be9b1a42c66cb3ff863184b1d9ce93d1919cb47a1ef3022e5806da395e2f6683116e44e73d66

memory/2684-11-0x0000000000400000-0x0000000000488000-memory.dmp

memory/2684-17-0x0000000000400000-0x0000000000488000-memory.dmp

memory/2684-15-0x0000000000400000-0x0000000000488000-memory.dmp

memory/2684-13-0x0000000000400000-0x0000000000488000-memory.dmp

memory/2684-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2684-21-0x0000000000400000-0x0000000000488000-memory.dmp

memory/2684-25-0x0000000000400000-0x0000000000488000-memory.dmp

memory/2684-23-0x0000000000400000-0x0000000000488000-memory.dmp

memory/2684-26-0x0000000074420000-0x0000000074B0E000-memory.dmp

memory/2684-27-0x0000000004FC0000-0x0000000005000000-memory.dmp

memory/2116-28-0x0000000074420000-0x0000000074B0E000-memory.dmp

memory/2684-33-0x00000000003F0000-0x00000000003F8000-memory.dmp

memory/2396-34-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2684-36-0x0000000004FC0000-0x0000000005000000-memory.dmp

memory/2396-37-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2684-38-0x0000000074420000-0x0000000074B0E000-memory.dmp

memory/2396-39-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2684-40-0x0000000004FC0000-0x0000000005000000-memory.dmp

memory/2396-42-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2684-43-0x0000000004FC0000-0x0000000005000000-memory.dmp

memory/1952-46-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1952-44-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1952-47-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1952-51-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Temp\Cab9916.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\Local\Temp\Tar99A6.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 621aebf9003e30f4229bd1d1f3e5df64
SHA1 339544fbf297401cb0f6827771172d3002f44403
SHA256 8cd5f8ea4596b43c741724f5ff801893c664f9feb9df2f2017497fc98914b91b
SHA512 f50405117e136af8a50035a84ad3569cbf79ac5f82a09bf0eae7f632364dc7856aa971ef1d4b6755097ecac16161afdbcedd2e13efcb949eb1c9006970d3d676

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-11 22:25

Reported

2023-10-12 19:11

Platform

win10v2004-20230915-en

Max time kernel

144s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2080 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\SysWOW64\schtasks.exe
PID 2080 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\SysWOW64\schtasks.exe
PID 2080 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\SysWOW64\schtasks.exe
PID 2080 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 2080 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 2080 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 2080 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 2080 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 2080 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 2080 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 2080 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe
PID 3140 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3140 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe

"C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pbFphueKZdI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7337.tmp"

C:\Users\Admin\AppData\Local\Temp\NO#CU-92504 Xls.exe

"{path}"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt" /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt" /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3140 -ip 3140

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 2576

Network

Country Destination Domain Proto
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 254.1.248.8.in-addr.arpa udp
US 8.8.8.8:53 10.226.21.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 54.120.234.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 254.177.238.8.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.154.36:80 whatismyipaddress.com tcp
US 104.16.154.36:443 whatismyipaddress.com tcp
US 8.8.8.8:53 36.154.16.104.in-addr.arpa udp
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp

Files

memory/2080-0-0x0000000074BE0000-0x0000000075390000-memory.dmp

memory/2080-1-0x0000000000660000-0x0000000000788000-memory.dmp

memory/2080-2-0x00000000050F0000-0x000000000518C000-memory.dmp

memory/2080-3-0x0000000005760000-0x0000000005D04000-memory.dmp

memory/2080-4-0x0000000005250000-0x00000000052E2000-memory.dmp

memory/2080-5-0x0000000005400000-0x0000000005410000-memory.dmp

memory/2080-7-0x0000000005470000-0x00000000054C6000-memory.dmp

memory/2080-6-0x0000000005220000-0x000000000522A000-memory.dmp

memory/2080-8-0x0000000074BE0000-0x0000000075390000-memory.dmp

memory/2080-9-0x0000000005400000-0x0000000005410000-memory.dmp

memory/2080-10-0x0000000005750000-0x000000000575C000-memory.dmp

memory/2080-11-0x00000000081C0000-0x0000000008288000-memory.dmp

memory/2080-12-0x000000000A730000-0x000000000A7B8000-memory.dmp

memory/2080-13-0x0000000008150000-0x00000000081B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp7337.tmp

MD5 4fbfb6e89dd0f7c60cedce2fad2ab454
SHA1 8eb45ae4d26278318663726e107468a4374af17a
SHA256 f842087f709ec6881aaf15fe1e212cfceddc0df7efa88ce603a5c64e4fc25588
SHA512 f2a9d2872fbeb3cac72bd91fad66425cf73f149cce049b874649a4cb96ae3c0ac0a92639c5c9f9a332793b9c22c6b7637d68a15815e0c133b74e268a09894510

memory/3140-17-0x0000000000400000-0x0000000000488000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NO#CU-92504 Xls.exe.log

MD5 5200da2e50f24d5d543c3f10674acdcb
SHA1 b574a3336839882d799c0a7f635ea238efb934ee
SHA256 d2d81c1c9d35bc66149beaa77029bee68664d8512fc1efe373180bab77d61026
SHA512 24722a7de3250a6027a411c8b79d0720554c4efd59553f54b94ab77dc21efbf3191e0912901db475f08a6e9c1855d9e9594504d80d27300097418f4384a9d9cb

memory/3140-20-0x0000000074BE0000-0x0000000075390000-memory.dmp

memory/2080-21-0x0000000074BE0000-0x0000000075390000-memory.dmp

memory/3140-22-0x0000000005690000-0x00000000056A0000-memory.dmp

memory/3140-25-0x0000000074BE0000-0x0000000075390000-memory.dmp

memory/3140-26-0x0000000005690000-0x00000000056A0000-memory.dmp

memory/3140-29-0x0000000008200000-0x0000000008208000-memory.dmp

memory/5064-31-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1148-36-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1148-39-0x0000000000420000-0x00000000004E9000-memory.dmp

memory/1148-40-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1148-38-0x0000000000400000-0x000000000041B000-memory.dmp

memory/5064-35-0x0000000000400000-0x0000000000458000-memory.dmp

memory/3140-37-0x0000000005690000-0x00000000056A0000-memory.dmp

memory/5064-44-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1148-30-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2136-45-0x00000000023D0000-0x00000000023E0000-memory.dmp

memory/5064-48-0x0000000000400000-0x0000000000458000-memory.dmp

memory/3140-49-0x0000000005690000-0x00000000056A0000-memory.dmp