Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 10:12
Static task
static1
Behavioral task
behavioral1
Sample
fdf.exe
Resource
win7-20240903-en
General
-
Target
fdf.exe
-
Size
506KB
-
MD5
f36535a73f8c6869ded283234f2a923f
-
SHA1
9444e7fe027d743af732a27be3a4ae9dc0de1ced
-
SHA256
23127973f0d6b1322ccf49e092cb5ff53e4859fb31ee6b09b6f9c8b5d3e19073
-
SHA512
66e4af59d35a9f33cfe598c3664eb2e7d7f80ed54b6bc49ad97b3baec15accb78e4f926b6d6f921ece628381e85879a6ca435cbee6c74f60e3f4ba4235417fda
-
SSDEEP
6144:WysbS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx9/II:rsQtqB5urTIoYWBQk1E+VF9mOx9t
Malware Config
Extracted
Protocol: smtp- Host:
smtp.mail.com - Port:
587 - Username:
[email protected] - Password:
FDGDFG34T43TT345T345TT3
Signatures
-
Hawkeye family
-
Detected Nirsoft tools 8 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral2/memory/3172-6-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/3172-8-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/3172-9-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/3172-12-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/2016-15-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/2016-17-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/2016-18-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/2016-26-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/3172-6-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/3172-8-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/3172-9-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/3172-12-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/2016-15-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/2016-17-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/2016-18-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/2016-26-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 whatismyipaddress.com 10 whatismyipaddress.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4568 set thread context of 3172 4568 fdf.exe 86 PID 4568 set thread context of 2016 4568 fdf.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2016 vbc.exe 2016 vbc.exe 4568 fdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4568 fdf.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4568 fdf.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4568 wrote to memory of 3172 4568 fdf.exe 86 PID 4568 wrote to memory of 3172 4568 fdf.exe 86 PID 4568 wrote to memory of 3172 4568 fdf.exe 86 PID 4568 wrote to memory of 3172 4568 fdf.exe 86 PID 4568 wrote to memory of 3172 4568 fdf.exe 86 PID 4568 wrote to memory of 3172 4568 fdf.exe 86 PID 4568 wrote to memory of 3172 4568 fdf.exe 86 PID 4568 wrote to memory of 3172 4568 fdf.exe 86 PID 4568 wrote to memory of 3172 4568 fdf.exe 86 PID 4568 wrote to memory of 2016 4568 fdf.exe 90 PID 4568 wrote to memory of 2016 4568 fdf.exe 90 PID 4568 wrote to memory of 2016 4568 fdf.exe 90 PID 4568 wrote to memory of 2016 4568 fdf.exe 90 PID 4568 wrote to memory of 2016 4568 fdf.exe 90 PID 4568 wrote to memory of 2016 4568 fdf.exe 90 PID 4568 wrote to memory of 2016 4568 fdf.exe 90 PID 4568 wrote to memory of 2016 4568 fdf.exe 90 PID 4568 wrote to memory of 2016 4568 fdf.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdf.exe"C:\Users\Admin\AppData\Local\Temp\fdf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"2⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:3172
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196