Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2025, 05:50

General

  • Target

    2c01b007729230c415420ad641ad92eb.exe

  • Size

    1.3MB

  • MD5

    daef338f9c47d5394b7e1e60ce38d02d

  • SHA1

    c0a07e8c32528d29aae26aaecbf6a67ed95b8c8e

  • SHA256

    5d03fd083b626a5516194d5e94576349100c9c98ca7d6845642ed9579980ca58

  • SHA512

    d0f4050fc2c5f38ab598729fb6930c84bf779d47b5a8b4e860bc0e9ca8be454ad5dce001d8f88299d8a079eafd4c26efcdd2d196352acfe45e940cc107fcebf4

  • SSDEEP

    24576:W85y6Jwdt8jtWoJpXWHALGX+C1Co3aP8jvuC7g6zwm4m53Sb21SR:HXsSGuC/MIvuC5kFm53Sy1SR

Malware Config

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • Hawkeye family
  • Detected Nirsoft tools 7 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 4 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 4 IoCs

    Password recovery tool for various web browsers

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe
    "C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3400
    • C:\Users\Admin\AppData\Roaming\wou\odm.exe
      "C:\Users\Admin\AppData\Roaming\wou\odm.exe" kja-pex
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4648
      • C:\Users\Admin\AppData\Roaming\wou\odm.exe
        C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\QGGXV
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:5048
    • C:\Users\Admin\AppData\Roaming\wou\odm.exe
      "C:\Users\Admin\AppData\Roaming\wou\odm.exe" kja-pex
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4696
      • C:\Users\Admin\AppData\Roaming\wou\odm.exe
        C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\RGVCN
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3384
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
          4⤵
            PID:1608
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 80
              5⤵
              • Program crash
              PID:432
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
            C:\Users\Admin\AppData\Roaming\wou\RGVCN
            4⤵
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5496
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
              5⤵
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:508
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
                6⤵
                • Accesses Microsoft Outlook accounts
                • System Location Discovery: System Language Discovery
                PID:5704
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:5452
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
              C:\Users\Admin\AppData\Roaming\wou\RGVCN
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3480
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3260
      • C:\Users\Admin\AppData\Roaming\wou\odm.exe
        C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:64
        • C:\Users\Admin\AppData\Roaming\wou\odm.exe
          C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\NFLDD
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:5456
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1608 -ip 1608
      1⤵
        PID:5284

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\holderwb.txt

              Filesize

              3KB

              MD5

              f94dc819ca773f1e3cb27abbc9e7fa27

              SHA1

              9a7700efadc5ea09ab288544ef1e3cd876255086

              SHA256

              a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

              SHA512

              72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

            • C:\Users\Admin\AppData\Roaming\wou\RGVCN

              Filesize

              91KB

              MD5

              9375872d82fbfe00eb4f6e608aa170d8

              SHA1

              b6d6f7059c025075141293cc0c1f80c1063ef75b

              SHA256

              a1b44347af8b2b2bf0409bb96e99f012035dc494ef44db409dbcd2bb726ff2e9

              SHA512

              f05e7f8c5d4edc6c41c0a2e4c63492a8578a4ae44e093396214fe422b90bd6e6d5fc98e1d8c4ee2253845a8b1a0bf202cd27450f641a8261d7f660b26162b863

            • C:\Users\Admin\AppData\Roaming\wou\odm.exe

              Filesize

              732KB

              MD5

              71d8f6d5dc35517275bc38ebcc815f9f

              SHA1

              cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

              SHA256

              fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

              SHA512

              4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

            • C:\Users\Admin\AppData\Roaming\wou\rid.ico

              Filesize

              1.2MB

              MD5

              a5f2dcee6a2a6047aa8fdde1ae2ce290

              SHA1

              7a082661c9a3431cd89ed4d9959178d60b9570f7

              SHA256

              7da78e767ff859970c8dae593b62f1366c2c651500eb280f0077a2245a9a8625

              SHA512

              e001300fc56f9bc8e9d61cb904ea6dec5ca447729015c9ff3dccc021f319fcce57ebaabb196a56f80d249dfbb88b4a0a273858cf14c7b9a93c10c9c8bc243d0a

            • C:\Users\Admin\AppData\Roaming\wou\spd

              Filesize

              4B

              MD5

              098f6bcd4621d373cade4e832627b4f6

              SHA1

              a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

              SHA256

              9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

              SHA512

              ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

            • memory/508-99-0x0000000000400000-0x0000000000484000-memory.dmp

              Filesize

              528KB

            • memory/3480-102-0x0000000001030000-0x00000000010FC000-memory.dmp

              Filesize

              816KB

            • memory/3480-101-0x0000000001030000-0x00000000010FC000-memory.dmp

              Filesize

              816KB

            • memory/5452-110-0x0000000000400000-0x0000000000458000-memory.dmp

              Filesize

              352KB

            • memory/5452-109-0x0000000000400000-0x0000000000458000-memory.dmp

              Filesize

              352KB

            • memory/5452-116-0x0000000000400000-0x0000000000458000-memory.dmp

              Filesize

              352KB

            • memory/5496-98-0x0000000000E20000-0x0000000000EEC000-memory.dmp

              Filesize

              816KB

            • memory/5496-97-0x0000000000E20000-0x0000000000EEC000-memory.dmp

              Filesize

              816KB

            • memory/5704-105-0x0000000000400000-0x000000000041B000-memory.dmp

              Filesize

              108KB

            • memory/5704-106-0x0000000000400000-0x000000000041B000-memory.dmp

              Filesize

              108KB

            • memory/5704-108-0x0000000000400000-0x000000000041B000-memory.dmp

              Filesize

              108KB