Find similar analyses in TI Lookup

Analysis date (UTC): 24 March 2022, 07:18Analysis environment: Windows 7 Pro, build 7601, x86

tkraw_Protected99.exe

MD5:71826BA081E303866CE2A2534491A2F7

SHA1:B482D64A43F6BFBF758166ECBA680B7F0C59A4F7

SHA256:62099532750DAD1054B127689680C38590033FA0BDFA4FB40C7B4DCB2607FB11

Analysis result

Threat level:Malicious activity

Tags:

keyloggerhawkeyestealer

Full analysis:Analysis tkraw_Protected99.exe (MD5: 71826BA081E303866CE2A2534491A2F7) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Writes to a start menu file

tkraw_Protected99.exe (PID: 3588)

Steals credentials from Web Browsers

vbc.exe (PID: 3080)

Actions looks like stealing of personal data

vbc.exe (PID: 4048)
RegAsm.exe (PID: 3852)
vbc.exe (PID: 3080)

Stealing of credential data

vbc.exe (PID: 4048)
vbc.exe (PID: 3080)

Drops executable file immediately after starts

tkraw_Protected99.exe (PID: 3588)

Uses NirSoft utilities to collect credentials

vbc.exe (PID: 4048)
vbc.exe (PID: 3080)

Detected Hawkeye Keylogger

RegAsm.exe (PID: 3852)

SUSPICIOUS

Creates files in the user directory

tkraw_Protected99.exe (PID: 3588)

Checks supported languages

tkraw_Protected99.exe (PID: 3588)
RegAsm.exe (PID: 3852)
vbc.exe (PID: 3080)
vbc.exe (PID: 4048)

Reads mouse settings

tkraw_Protected99.exe (PID: 3588)

Reads the computer name

RegAsm.exe (PID: 3852)
vbc.exe (PID: 3080)
vbc.exe (PID: 4048)

Executes scripts

RegAsm.exe (PID: 3852)

Loads DLL from Mozilla Firefox

vbc.exe (PID: 3080)

Executable content was dropped or overwritten

tkraw_Protected99.exe (PID: 3588)

Reads Environment values

RegAsm.exe (PID: 3852)

INFO

No info indicators.

Threats

No threats detected