hawkeye_reborn | 4079b905c14bcd57863427984c40576431f6ab57b93da741fc2cefc4ea08eb42

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2025 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4079b905c14bcd57863427984c40576431f6ab57b93da741fc2cefc4ea08eb42.exe
Size

1.9MB
MD5

5bb90670c7168f1b5fb4c1cd732183e1
SHA1

69c940c3c8f25e2d8fd21249aa7afb2d77412982
SHA256

4079b905c14bcd57863427984c40576431f6ab57b93da741fc2cefc4ea08eb42
SHA512

ea488e76546caff0836c311a2aeb4a38381b0c5e38402ce5d2e3391b3b17f097e557e59d9036266dde9ff1393cd1f3258440c84b703db1251e48f80daa367f13
SSDEEP

24576:uAHnh+eWsN3skA4RV1Hom2KXMmHaYpdcW1Ebbw+kFJkY0Pcx0c7PXa3Dm3NXO45L:Zh+ZkldoPK8YasbFL

Score

10^/10

hawkeye_reborn m00nd3v_logger collection discovery infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
femo12345

Mutex

8c27cae2-a758-426b-8ec9-feb715214fd5

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:femo12345 _EmailPort:587 _EmailSSL:true _EmailServer:smtp.yandex.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:8c27cae2-a758-426b-8ec9-feb715214fd5 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
Hawkeye_reborn family
hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger
M00nd3v_logger family
m00nd3v_logger

Detected Nirsoft tools 14 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4448-14-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/4448-16-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/4448-17-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/4448-24-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/752-26-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/752-27-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/752-29-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4876-38-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/4876-44-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/4600-48-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/1828-56-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/1828-61-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/4060-64-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4060-66-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

M00nD3v Logger payload 1 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral2/memory/2920-1-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 6 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/752-26-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/752-27-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/752-29-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4600-48-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4060-64-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4060-66-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 8 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4448-14-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/4448-16-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/4448-17-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/4448-24-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/4876-38-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/4876-44-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/1828-56-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/1828-61-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	4079b905c14bcd57863427984c40576431f6ab57b93da741fc2cefc4ea08eb42.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	isoburn.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	isoburn.exe

Executes dropped EXE 2 IoCs

pid	Process
2120	isoburn.exe
3152	isoburn.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Accesses Microsoft Outlook accounts 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
36	bot.whatismyipaddress.com
41	bot.whatismyipaddress.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000023c97-30.dat	autoit_exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 4752 set thread context of 2920	4752	4079b905c14bcd57863427984c40576431f6ab57b93da741fc2cefc4ea08eb42.exe	82
PID 2920 set thread context of 4448	2920	RegAsm.exe	92
PID 2920 set thread context of 752	2920	RegAsm.exe	93
PID 2120 set thread context of 2432	2120	isoburn.exe	97
PID 2432 set thread context of 4876	2432	RegAsm.exe	100
PID 2432 set thread context of 4600	2432	RegAsm.exe	101
PID 3152 set thread context of 3608	3152	isoburn.exe	103
PID 3608 set thread context of 1828	3608	RegAsm.exe	106
PID 3608 set thread context of 4060	3608	RegAsm.exe	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4079b905c14bcd57863427984c40576431f6ab57b93da741fc2cefc4ea08eb42.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	isoburn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	isoburn.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
528	schtasks.exe
1872	schtasks.exe
380	schtasks.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
4448	vbc.exe
4448	vbc.exe
4448	vbc.exe
4448	vbc.exe
4448	vbc.exe
4448	vbc.exe
4448	vbc.exe
4448	vbc.exe
4448	vbc.exe
4448	vbc.exe
4448	vbc.exe
4448	vbc.exe
4876	vbc.exe
4876	vbc.exe
4876	vbc.exe
4876	vbc.exe
4876	vbc.exe
4876	vbc.exe
4876	vbc.exe
4876	vbc.exe
4876	vbc.exe
4876	vbc.exe
4876	vbc.exe
4876	vbc.exe
2920	RegAsm.exe
2920	RegAsm.exe
1828	vbc.exe
1828	vbc.exe
1828	vbc.exe
1828	vbc.exe
1828	vbc.exe
1828	vbc.exe
1828	vbc.exe
1828	vbc.exe
1828	vbc.exe
1828	vbc.exe
1828	vbc.exe
1828	vbc.exe
2432	RegAsm.exe
2432	RegAsm.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
2432	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	RegAsm.exe
Token: SeDebugPrivilege	2432	RegAsm.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2920	RegAsm.exe
2432	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 2920	4752	4079b905c14bcd57863427984c40576431f6ab57b93da741fc2cefc4ea08eb42.exe	82
PID 4752 wrote to memory of 2920	4752	4079b905c14bcd57863427984c40576431f6ab57b93da741fc2cefc4ea08eb42.exe	82
PID 4752 wrote to memory of 2920	4752	4079b905c14bcd57863427984c40576431f6ab57b93da741fc2cefc4ea08eb42.exe	82
PID 4752 wrote to memory of 2920	4752	4079b905c14bcd57863427984c40576431f6ab57b93da741fc2cefc4ea08eb42.exe	82
PID 4752 wrote to memory of 2920	4752	4079b905c14bcd57863427984c40576431f6ab57b93da741fc2cefc4ea08eb42.exe	82
PID 4752 wrote to memory of 528	4752	4079b905c14bcd57863427984c40576431f6ab57b93da741fc2cefc4ea08eb42.exe	83
PID 4752 wrote to memory of 528	4752	4079b905c14bcd57863427984c40576431f6ab57b93da741fc2cefc4ea08eb42.exe	83
PID 4752 wrote to memory of 528	4752	4079b905c14bcd57863427984c40576431f6ab57b93da741fc2cefc4ea08eb42.exe	83
PID 2920 wrote to memory of 4448	2920	RegAsm.exe	92
PID 2920 wrote to memory of 4448	2920	RegAsm.exe	92
PID 2920 wrote to memory of 4448	2920	RegAsm.exe	92
PID 2920 wrote to memory of 4448	2920	RegAsm.exe	92
PID 2920 wrote to memory of 4448	2920	RegAsm.exe	92
PID 2920 wrote to memory of 4448	2920	RegAsm.exe	92
PID 2920 wrote to memory of 4448	2920	RegAsm.exe	92
PID 2920 wrote to memory of 4448	2920	RegAsm.exe	92
PID 2920 wrote to memory of 4448	2920	RegAsm.exe	92
PID 2920 wrote to memory of 752	2920	RegAsm.exe	93
PID 2920 wrote to memory of 752	2920	RegAsm.exe	93
PID 2920 wrote to memory of 752	2920	RegAsm.exe	93
PID 2920 wrote to memory of 752	2920	RegAsm.exe	93
PID 2920 wrote to memory of 752	2920	RegAsm.exe	93
PID 2920 wrote to memory of 752	2920	RegAsm.exe	93
PID 2920 wrote to memory of 752	2920	RegAsm.exe	93
PID 2920 wrote to memory of 752	2920	RegAsm.exe	93
PID 2920 wrote to memory of 752	2920	RegAsm.exe	93
PID 2120 wrote to memory of 2432	2120	isoburn.exe	97
PID 2120 wrote to memory of 2432	2120	isoburn.exe	97
PID 2120 wrote to memory of 2432	2120	isoburn.exe	97
PID 2120 wrote to memory of 2432	2120	isoburn.exe	97
PID 2120 wrote to memory of 2432	2120	isoburn.exe	97
PID 2120 wrote to memory of 1872	2120	isoburn.exe	98
PID 2120 wrote to memory of 1872	2120	isoburn.exe	98
PID 2120 wrote to memory of 1872	2120	isoburn.exe	98
PID 2432 wrote to memory of 4876	2432	RegAsm.exe	100
PID 2432 wrote to memory of 4876	2432	RegAsm.exe	100
PID 2432 wrote to memory of 4876	2432	RegAsm.exe	100
PID 2432 wrote to memory of 4876	2432	RegAsm.exe	100
PID 2432 wrote to memory of 4876	2432	RegAsm.exe	100
PID 2432 wrote to memory of 4876	2432	RegAsm.exe	100
PID 2432 wrote to memory of 4876	2432	RegAsm.exe	100
PID 2432 wrote to memory of 4876	2432	RegAsm.exe	100
PID 2432 wrote to memory of 4876	2432	RegAsm.exe	100
PID 2432 wrote to memory of 4600	2432	RegAsm.exe	101
PID 2432 wrote to memory of 4600	2432	RegAsm.exe	101
PID 2432 wrote to memory of 4600	2432	RegAsm.exe	101
PID 2432 wrote to memory of 4600	2432	RegAsm.exe	101
PID 2432 wrote to memory of 4600	2432	RegAsm.exe	101
PID 2432 wrote to memory of 4600	2432	RegAsm.exe	101
PID 2432 wrote to memory of 4600	2432	RegAsm.exe	101
PID 2432 wrote to memory of 4600	2432	RegAsm.exe	101
PID 2432 wrote to memory of 4600	2432	RegAsm.exe	101
PID 3152 wrote to memory of 3608	3152	isoburn.exe	103
PID 3152 wrote to memory of 3608	3152	isoburn.exe	103
PID 3152 wrote to memory of 3608	3152	isoburn.exe	103
PID 3152 wrote to memory of 3608	3152	isoburn.exe	103
PID 3152 wrote to memory of 3608	3152	isoburn.exe	103
PID 3152 wrote to memory of 380	3152	isoburn.exe	104
PID 3152 wrote to memory of 380	3152	isoburn.exe	104
PID 3152 wrote to memory of 380	3152	isoburn.exe	104
PID 3608 wrote to memory of 1828	3608	RegAsm.exe	106
PID 3608 wrote to memory of 1828	3608	RegAsm.exe	106
PID 3608 wrote to memory of 1828	3608	RegAsm.exe	106
PID 3608 wrote to memory of 1828	3608	RegAsm.exe	106

C:\Users\Admin\AppData\Local\Temp\4079b905c14bcd57863427984c40576431f6ab57b93da741fc2cefc4ea08eb42.exe
"C:\Users\Admin\AppData\Local\Temp\4079b905c14bcd57863427984c40576431f6ab57b93da741fc2cefc4ea08eb42.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpED1F.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4448
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpF127.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:752
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn capisp /tr "C:\Users\Admin\ActivationManager\isoburn.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:528

C:\Users\Admin\ActivationManager\isoburn.exe
C:\Users\Admin\ActivationManager\isoburn.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: SetClipboardViewer
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpDA9C.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4876
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpDE94.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:4600
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn capisp /tr "C:\Users\Admin\ActivationManager\isoburn.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1872

C:\Users\Admin\ActivationManager\isoburn.exe
C:\Users\Admin\ActivationManager\isoburn.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpC2BA.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1828
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpC6B2.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:4060
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn capisp /tr "C:\Users\Admin\ActivationManager\isoburn.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\ActivationManager\isoburn.exe

Filesize
1.9MB

MD5
982635af8efc5c5e242ac1d1d98450ef

SHA1
20c2ab3989fefae9e831c43cef81f980c47ef76e

SHA256
aab0c24169c0bceaf4c2b7950d19d7b59b2623ddd4ceb0f184cd419c0e92ebd1

SHA512
2c86d93886c3dc6d43210ff4d0499d8421367806b5641a03024221551dd495a4b7779c7cc763a7b502258a31881c3f11486e4f758166b93656d2e343fe849d00

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpED1F.tmp

Filesize
4KB

MD5
75379d3dcbcea6a69bc75b884816dd40

SHA1
7e073a03c3bdbbc60375ddbe56bba211c3d412a6

SHA256
cab559f3bbe4a0beb194dffca723b3072184b92687100462eaab04d66fff8de9

SHA512
710c2cee369a57a0039fc0d0c59de6118780210ef60ad0daf374f03ba94ab08039bc2aff821f7c99a0ecd0e16189c52e5b6d630b3d541f7b11375f134b985e8c

Download Submit
memory/752-29-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/752-27-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/752-26-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1828-61-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1828-56-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2920-12-0x00000000743D0000-0x0000000074981000-memory.dmp

Filesize
5.7MB

Download
memory/2920-6-0x00000000743D2000-0x00000000743D3000-memory.dmp

Filesize
4KB

Download
memory/2920-1-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2920-7-0x00000000743D0000-0x0000000074981000-memory.dmp

Filesize
5.7MB

Download
memory/2920-8-0x00000000743D0000-0x0000000074981000-memory.dmp

Filesize
5.7MB

Download
memory/2920-11-0x00000000743D2000-0x00000000743D3000-memory.dmp

Filesize
4KB

Download
memory/4060-64-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4060-66-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4448-14-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4448-24-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4448-22-0x0000000000460000-0x0000000000529000-memory.dmp

Filesize
804KB

Download
memory/4448-16-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4448-17-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4600-48-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4752-0-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/4876-38-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4876-44-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download