Loading... Additional Content is being loaded
Windows Analysis Report RpDMpvgd55
Overview
General Information
| Sample Name: | RpDMpvgd55 (renamed file extension from none to exe) |
| Analysis ID: | 478945 |
| MD5: | 0e569851a5caffd0924437714db46abe |
| SHA1: | 32fe45fbef9753d08978ad11a0001b29f032ba34 |
| SHA256: | 8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94 |
| Tags: | exeHawkEye |
| Infos: | |
|
Most interesting Screenshot:  |
|
Detection
HawkEye MailPassView
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Yara detected MailPassView
Multi AV Scanner detection for submitted file
Yara detected HawkEye Keylogger
Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Detected HawkEye Rat
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Sample uses process hollowing technique
Writes to foreign memory regions
.NET source code references suspicious native API functions
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Yara detected WebBrowserPassView password recovery tool
PE file has nameless sections
Machine Learning detection for dropped file
Hides that the sample has been downloaded from the Internet (zone.identifier)
Tries to steal Mail credentials (via file access)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to steal Instant Messenger accounts or passwords
Tries to harvest and steal browser information (history, passwords, etc)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
Contains long sleeps (>= 3 min)
Enables debug privileges
AV process strings found (often used to terminate AV products)
Sample file is different than original file name gathered from version info
Drops PE files
Contains capabilities to detect virtual machines
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Classification
AV Detection: |
  |
|---|
| Multi AV Scanner detection for submitted file |
| Source: |
ReversingLabs: |
||
| Antivirus / Scanner detection for submitted sample |
| Source: |
Avira: |
||
| Antivirus detection for dropped file |
| Source: |
Avira: |
||
| Multi AV Scanner detection for dropped file |
| Source: |
ReversingLabs: |
||
| Machine Learning detection for sample |
| Source: |
Joe Sandbox ML: |
||
| Machine Learning detection for dropped file |
| Source: |
Joe Sandbox ML: |
||
| Antivirus or Machine Learning detection for unpacked file |
| Source: |
Avira: |
||
| Source: |
Avira: |
||
| Source: |
Avira: |
||
| Source: |
Avira: |
||
| Source: |
Avira: |
||
| Source: |
Avira: |
||
| Source: |
Avira: |
||
Compliance: |
|
|---|
| Uses 32bit PE files |
| Source: |
Static PE information: |
||
| Source: |
Static PE information: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
File opened: |
||
| Source: |
File opened: |
||
| Source: |
File opened: |
||
| Source: |
File opened: |
||
| Source: |
File opened: |
||
| Source: |
File opened: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: | ||