Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report M9RhKQ1G91

Overview

General Information

Sample Name:M9RhKQ1G91 (renamed file extension from none to exe)
Analysis ID:317008
MD5:ba6d7442594e9953cde6bc7f376ccbb6
SHA1:933aaccb99adb26e2061e89294649e633899cce4
SHA256:6144777174bede752f4db8fdddbccd2aa5fe4532491b8b351bd3a67bc1f0de2b
Tags:HawkEye

Most interesting Screenshot:

Detection

HawkEye MailPassView
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected HawkEye Rat
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected HawkEye Keylogger
Yara detected MailPassView
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Changes the view of files in windows explorer (hidden files and folders)
Contains functionality to detect sleep reduction / modifications
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
May check the online IP address of the machine
Sample uses process hollowing technique
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Yara detected WebBrowserPassView password recovery tool
Antivirus or Machine Learning detection for unpacked file
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to detect sandboxes (mouse cursor move detection)
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May check if the current machine is a sandbox (GetTickCount - Sleep)
May infect USB drives
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains strange resources
Queries disk information (often used to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Stores large binary data to the registry
Tries to load missing DLLs
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic
Yara signature match

Classification

Startup

  • System is w10x64
  • M9RhKQ1G91.exe (PID: 6980 cmdline: 'C:\Users\user\Desktop\M9RhKQ1G91.exe' MD5: BA6D7442594E9953CDE6BC7F376CCBB6)
    • M9RhKQ1G91.exe (PID: 7000 cmdline: 'C:\Users\user\Desktop\M9RhKQ1G91.exe' MD5: BA6D7442594E9953CDE6BC7F376CCBB6)
      • Windows Update.exe (PID: 7144 cmdline: 'C:\Users\user\AppData\Roaming\Windows Update.exe' MD5: BA6D7442594E9953CDE6BC7F376CCBB6)
        • Windows Update.exe (PID: 7164 cmdline: 'C:\Users\user\AppData\Roaming\Windows Update.exe' MD5: BA6D7442594E9953CDE6BC7F376CCBB6)
          • dw20.exe (PID: 1472 cmdline: dw20.exe -x -s 2260 MD5: 8D10DA8A3E11747E51F23C882C22BBC3)
          • vbc.exe (PID: 6284 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)
          • vbc.exe (PID: 6416 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)
          • WerFault.exe (PID: 6680 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7164 -s 2256 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
  • WindowsUpdate.exe (PID: 6640 cmdline: 'C:\Users\user\AppData\Roaming\WindowsUpdate.exe' MD5: BA6D7442594E9953CDE6BC7F376CCBB6)
    • WindowsUpdate.exe (PID: 6820 cmdline: 'C:\Users\user\AppData\Roaming\WindowsUpdate.exe' MD5: BA6D7442594E9953CDE6BC7F376CCBB6)
  • WindowsUpdate.exe (PID: 6860 cmdline: 'C:\Users\user\AppData\Roaming\WindowsUpdate.exe' MD5: BA6D7442594E9953CDE6BC7F376CCBB6)
    • WindowsUpdate.exe (PID: 4588 cmdline: 'C:\Users\user\AppData\Roaming\WindowsUpdate.exe' MD5: BA6D7442594E9953CDE6BC7F376CCBB6)
  • cleanup

Malware Configuration

Threatname: HawkEye

{"Modules": ["Mail PassView", "mailpv"], "Version": ""}

Yara Overview

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Windows Update.e_3375289624822549e92c4134e6a9b5b51738d14e_6f3ec437_1a51a96c\Report.werSUSP_WER_Suspicious_Crash_DirectoryDetects a crashed application executed in a suspicious directoryFlorian Roth
  • 0x11c:$a1: ReportIdentifier=
  • 0x19e:$a1: ReportIdentifier=
  • 0x75c:$a2: .Name=Fault Module Name
  • 0x4ada:$a3: AppPath=
  • 0x4ada:$l4: AppPath=C:\Users\
  • 0x4ada:$s8: AppPath=C:\Users\user\AppData\Roaming\Windows Update.exe
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7675.tmp.mdmpRAT_HawkEyeDetects HawkEye RATKevin Breen <kevin@techanarchy.net>
  • 0x5afdeb:$key: HawkEyeKeylogger
  • 0x5b2055:$salt: 099u787978786
  • 0x5b0448:$string1: HawkEye_Keylogger
  • 0x5b1287:$string1: HawkEye_Keylogger
  • 0x5b1fb5:$string1: HawkEye_Keylogger
  • 0x5b081d:$string2: holdermail.txt
  • 0x5b083d:$string2: holdermail.txt
  • 0x5b075f:$string3: wallet.dat
  • 0x5b0777:$string3: wallet.dat
  • 0x5b078d:$string3: wallet.dat
  • 0x5b1b79:$string4: Keylog Records
  • 0x5b1e91:$string4: Keylog Records
  • 0x5b20ad:$string5: do not script -->
  • 0x5afdd3:$string6: \pidloc.txt
  • 0x5afe61:$string7: BSPLIT
  • 0x5afe71:$string7: BSPLIT
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7675.tmp.mdmpJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
    C:\ProgramData\Microsoft\Windows\WER\Temp\WER7675.tmp.mdmpJoeSecurity_HawkEyeYara detected HawkEye KeyloggerJoe Security
      C:\ProgramData\Microsoft\Windows\WER\Temp\WER7675.tmp.mdmpHawkeyedetect HawkEye in memoryJPCERT/CC Incident Response Group
      • 0x5b04a0:$hawkstr1: HawkEye Keylogger
      • 0x5b12cd:$hawkstr1: HawkEye Keylogger
      • 0x5b15fc:$hawkstr1: HawkEye Keylogger
      • 0x5b1757:$hawkstr1: HawkEye Keylogger
      • 0x5b18ba:$hawkstr1: HawkEye Keylogger
      • 0x5b1b51:$hawkstr1: HawkEye Keylogger
      • 0x5b0012:$hawkstr2: Dear HawkEye Customers!
      • 0x5b164f:$hawkstr2: Dear HawkEye Customers!
      • 0x5b17a6:$hawkstr2: Dear HawkEye Customers!
      • 0x5b190d:$hawkstr2: Dear HawkEye Customers!
      • 0x5b0133:$hawkstr3: HawkEye Logger Details:

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      0000000F.00000002.741502717.00000000022F2000.00000040.00000001.sdmpRAT_HawkEyeDetects HawkEye RATKevin Breen <kevin@techanarchy.net>
      • 0x7b6b3:$key: HawkEyeKeylogger
      • 0x7d91d:$salt: 099u787978786
      • 0x7bd10:$string1: HawkEye_Keylogger
      • 0x7cb4f:$string1: HawkEye_Keylogger
      • 0x7d87d:$string1: HawkEye_Keylogger
      • 0x7c0e5:$string2: holdermail.txt
      • 0x7c105:$string2: holdermail.txt
      • 0x7c027:$string3: wallet.dat
      • 0x7c03f:$string3: wallet.dat
      • 0x7c055:$string3: wallet.dat
      • 0x7d441:$string4: Keylog Records
      • 0x7d759:$string4: Keylog Records
      • 0x7d975:$string5: do not script -->
      • 0x7b69b:$string6: \pidloc.txt
      • 0x7b729:$string7: BSPLIT
      • 0x7b739:$string7: BSPLIT
      0000000F.00000002.741502717.00000000022F2000.00000040.00000001.sdmpJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
        0000000F.00000002.741502717.00000000022F2000.00000040.00000001.sdmpJoeSecurity_HawkEyeYara detected HawkEye KeyloggerJoe Security
          0000000F.00000002.741502717.00000000022F2000.00000040.00000001.sdmpJoeSecurity_WebBrowserPassViewYara detected WebBrowserPassView password recovery toolJoe Security
            0000000F.00000002.741502717.00000000022F2000.00000040.00000001.sdmpHawkeyedetect HawkEye in memoryJPCERT/CC Incident Response Group
            • 0x7bd68:$hawkstr1: HawkEye Keylogger
            • 0x7cb95:$hawkstr1: HawkEye Keylogger
            • 0x7cec4:$hawkstr1: HawkEye Keylogger
            • 0x7d01f:$hawkstr1: HawkEye Keylogger
            • 0x7d182:$hawkstr1: HawkEye Keylogger
            • 0x7d419:$hawkstr1: HawkEye Keylogger
            • 0x7b8da:$hawkstr2: Dear HawkEye Customers!
            • 0x7cf17:$hawkstr2: Dear HawkEye Customers!
            • 0x7d06e:$hawkstr2: Dear HawkEye Customers!
            • 0x7d1d5:$hawkstr2: Dear HawkEye Customers!
            • 0x7b9fb:$hawkstr3: HawkEye Logger Details:
            Click to see the 195 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            15.2.WindowsUpdate.exe.22f0000.3.unpackRAT_HawkEyeDetects HawkEye RATKevin Breen <kevin@techanarchy.net>
            • 0x7b8b3:$key: HawkEyeKeylogger
            • 0x7db1d:$salt: 099u787978786
            • 0x7bf10:$string1: HawkEye_Keylogger
            • 0x7cd4f:$string1: HawkEye_Keylogger
            • 0x7da7d:$string1: HawkEye_Keylogger
            • 0x7c2e5:$string2: holdermail.txt
            • 0x7c305:$string2: holdermail.txt
            • 0x7c227:$string3: wallet.dat
            • 0x7c23f:$string3: wallet.dat
            • 0x7c255:$string3: wallet.dat
            • 0x7d641:$string4: Keylog Records
            • 0x7d959:$string4: Keylog Records
            • 0x7db75:$string5: do not script -->
            • 0x7b89b:$string6: \pidloc.txt
            • 0x7b929:$string7: BSPLIT
            • 0x7b939:$string7: BSPLIT
            15.2.WindowsUpdate.exe.22f0000.3.unpackJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
              15.2.WindowsUpdate.exe.22f0000.3.unpackJoeSecurity_HawkEyeYara detected HawkEye KeyloggerJoe Security
                15.2.WindowsUpdate.exe.22f0000.3.unpackJoeSecurity_WebBrowserPassViewYara detected WebBrowserPassView password recovery toolJoe Security
                  15.2.WindowsUpdate.exe.22f0000.3.unpackHawkeyedetect HawkEye in memoryJPCERT/CC Incident Response Group
                  • 0x7bf68:$hawkstr1: HawkEye Keylogger
                  • 0x7cd95:$hawkstr1: HawkEye Keylogger
                  • 0x7d0c4:$hawkstr1: HawkEye Keylogger
                  • 0x7d21f:$hawkstr1: HawkEye Keylogger
                  • 0x7d382:$hawkstr1: HawkEye Keylogger
                  • 0x7d619:$hawkstr1: HawkEye Keylogger
                  • 0x7bada:$hawkstr2: Dear HawkEye Customers!
                  • 0x7d117:$hawkstr2: Dear HawkEye Customers!
                  • 0x7d26e:$hawkstr2: Dear HawkEye Customers!
                  • 0x7d3d5:$hawkstr2: Dear HawkEye Customers!
                  • 0x7bbfb:$hawkstr3: HawkEye Logger Details: