File name: | REQUEST FOR QUOTATION,BOQ & DRAWING.rar |
Full analysis: | https://app.any.run/tasks/3a682561-89fb-4689-aab6-fe865ad94fbf |
Verdict: | Malicious activity |
Threats: | Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions. |
Analysis date: | February 19, 2019, 05:48:32 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | D275FB6084AC707A19C3BF1E7305DC05 |
SHA1: | 3B86A309B7BAB82635F3274E354D20A4C5015F29 |
SHA256: | 38E7FBE4F8CC87E3EF412D1B9E1574C2E8A09497D1E08C2FB1A0900240800683 |
SSDEEP: | 12288:Onf97oCzZrZtDc2zmXywWA/zPYlsORi9wWPFC5+X+59i0lL:k71lrZtDc2zmXyPAElsORkbn+5A4L |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2988 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\REQUEST FOR QUOTATION,BOQ & DRAWING.rar" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
2936 | "C:\Users\admin\Desktop\REQUEST FOR QUOTATION,BOQ & DRAWING.exe" | C:\Users\admin\Desktop\REQUEST FOR QUOTATION,BOQ & DRAWING.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3104 | "C:\Users\admin\Desktop\REQUEST FOR QUOTATION,BOQ & DRAWING.exe" | C:\Users\admin\Desktop\REQUEST FOR QUOTATION,BOQ & DRAWING.exe | REQUEST FOR QUOTATION,BOQ & DRAWING.exe | |
User: admin Integrity Level: MEDIUM | ||||
2996 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holdermail.txt" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | REQUEST FOR QUOTATION,BOQ & DRAWING.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 8.0.50727.5420 | ||||
2780 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holderwb.txt" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | — | REQUEST FOR QUOTATION,BOQ & DRAWING.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 8.0.50727.5420 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2988 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2988.33967\REQUEST FOR QUOTATION,BOQ & DRAWING.exe | — | |
MD5:— | SHA256:— | |||
2996 | vbc.exe | C:\Users\admin\AppData\Local\Temp\holdermail.txt | — | |
MD5:— | SHA256:— | |||
2780 | vbc.exe | C:\Users\admin\AppData\Local\Temp\holderwb.txt | — | |
MD5:— | SHA256:— | |||
3104 | REQUEST FOR QUOTATION,BOQ & DRAWING.exe | C:\Users\admin\AppData\Roaming\pid.txt | text | |
MD5:75B9B6DC7FE44437C6E0A69FD863DBAB | SHA256:8E2D91DA4E36F2D82D3DF133AC8F1F274430573C394B0B4A86CF18190E51CD5A | |||
3104 | REQUEST FOR QUOTATION,BOQ & DRAWING.exe | C:\Users\admin\AppData\Roaming\pidloc.txt | text | |
MD5:31C80498231731F39323C7EBA44E5896 | SHA256:00DC54381A7538082E835041F939B791224A5477072AA96A8D27B548661F10F3 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3104 | REQUEST FOR QUOTATION,BOQ & DRAWING.exe | GET | 403 | 104.16.154.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3104 | REQUEST FOR QUOTATION,BOQ & DRAWING.exe | 208.91.198.143:587 | smtp.t1si.com | PDR | US | shared |
3104 | REQUEST FOR QUOTATION,BOQ & DRAWING.exe | 104.16.154.36:80 | whatismyipaddress.com | Cloudflare Inc | US | shared |
Domain | IP | Reputation |
---|---|---|
whatismyipaddress.com |
| shared |
smtp.t1si.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
3104 | REQUEST FOR QUOTATION,BOQ & DRAWING.exe | A Network Trojan was detected | MALWARE [PTsecurity] Spyware.HawkEyeKeyLogger (IP Chck) |
3104 | REQUEST FOR QUOTATION,BOQ & DRAWING.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
3104 | REQUEST FOR QUOTATION,BOQ & DRAWING.exe | A Network Trojan was detected | MALWARE [PTsecurity] MSIL/Golroted.B/Hawkeye Keylogger Sending Data via SMTP |
3104 | REQUEST FOR QUOTATION,BOQ & DRAWING.exe | A Network Trojan was detected | MALWARE [PTsecurity] MSIL/Golroted.B/Hawkeye Keylogger Sending Data via SMTP |