URL:	http://185.164.72.213/ANI13.exe
Full analysis:	https://app.any.run/tasks/b6564815-1438-407e-93fc-cd0922db0083
Verdict:	Malicious activity
Threats:	Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions. A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. Malware Trends Tracker >>>
Analysis date:	June 13, 2019, 23:07:21
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:	loader keylogger hawkeye stealer evasion trojan opendir
Indicators:
MD5:	178F96082BE7FC7736F134493EADEC5B
SHA1:	3644E593D5AC54B77CC5C9376FD336F25E5232A4
SHA256:	A32A9643875DBA7103373D1DA1CF6943C4649C72D7C3EFD5E592A5868DD4FEB5
SSDEEP:	3:N1KlnaP/rssCn:ClaP/4R


(PID) Process:	(1688) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:	write	Name:	NTPDaysSinceLastAutoMigration
Value: 2
(PID) Process:	(1688) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:	write	Name:	NTPLastLaunchLowDateTime
Value: 3396740192
(PID) Process:	(1688) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:	write	Name:	NTPLastLaunchHighDateTime
Value: 30745148
(PID) Process:	(1688) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:	write	Name:	NextCheckForUpdateLowDateTime
Value: 3696902692
(PID) Process:	(1688) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:	write	Name:	NextCheckForUpdateHighDateTime
Value: 30745148
(PID) Process:	(1688) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(1688) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(1688) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(1688) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:	write	Name:	CompatibilityFlags
Value: 0
(PID) Process:	(1688) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:	write	Name:	ProxyEnable
Value: 0

PID	Process	Filename		Type
1688	iexplore.exe	C:\Users\admin\AppData\Local\Temp\~DF6A663EEDD9D29EA7.TMP		—
		MD5:—	SHA256:—
1688	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\ANI13.exe.212bmed.partial:Zone.Identifier		—
		MD5:—	SHA256:—
2456	vbc.exe	C:\Users\admin\AppData\Local\Temp\bhv8FE8.tmp		—
		MD5:—	SHA256:—
1688	iexplore.exe	C:\Users\admin\AppData\Local\Temp\~DFF9946F3C108FF538.TMP		—
		MD5:—	SHA256:—
1688	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{0812182F-8E30-11E9-8447-5254004AAD21}.dat		—
		MD5:—	SHA256:—
2708	ANI13.exe	C:\Users\admin\AppData\Local\Temp\CabC8DC.tmp		—
		MD5:—	SHA256:—
2708	ANI13.exe	C:\Users\admin\AppData\Local\Temp\TarC8DD.tmp		—
		MD5:—	SHA256:—
2396	IEXPLORE.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\ANI13.exe.212bmed.partial		executable
		MD5:—	SHA256:—
1688	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{08121831-8E30-11E9-8447-5254004AAD21}.dat		binary
		MD5:—	SHA256:—
2272	ANI13.exe	C:\Users\admin\AppData\Roaming\Z426sPaOxdzsYJQ6\cco2YAdLfmgE.exe		executable
		MD5:—	SHA256:—

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2708	ANI13.exe	GET	200	66.171.248.178:80	http://bot.whatismyipaddress.com/	US	text	15 b	shared
2708	ANI13.exe	GET	200	192.35.177.64:80	http://apps.identrust.com/roots/dstrootcax3.p7c	US	cat	893 b	shared
2708	ANI13.exe	GET	200	93.184.221.240:80	http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e63d172ea3093c0f	US	compressed	56.2 Kb	whitelisted
2396	IEXPLORE.EXE	GET	200	185.164.72.213:80	http://185.164.72.213/ANI13.exe	IR	executable	634 Kb	suspicious

Domain	IP	Reputation
iecvlist.microsoft.com	152.199.19.161	whitelisted
r20swj13mr.microsoft.com	152.199.19.161	whitelisted
bot.whatismyipaddress.com	66.171.248.178	shared
mail.cofcoainternational.com	199.79.62.11	malicious
apps.identrust.com	192.35.177.64	shared
ctldl.windowsupdate.com	93.184.221.240	whitelisted

PID	Process	Class	Message
2396	IEXPLORE.EXE	A Network Trojan was detected	ET INFO Executable Download from dotted-quad Host
2396	IEXPLORE.EXE	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
2396	IEXPLORE.EXE	Potentially Bad Traffic	ET INFO SUSPICIOUS Dotted Quad Host MZ Response
2708	ANI13.exe	A Network Trojan was detected	MALWARE [PTsecurity] Spy.HawkEye IP Check
2708	ANI13.exe	Generic Protocol Command Decode	SURICATA Applayer Detect protocol only one direction

PID	Process	IP	Domain	ASN	CN	Reputation
2396	IEXPLORE.EXE	185.164.72.213:80	—	Sepehr sabz Khavarmianeh International engineers PJSC	IR	suspicious
1688	iexplore.exe	152.199.19.161:443	iecvlist.microsoft.com	MCI Communications Services, Inc. d/b/a Verizon Business	US	whitelisted
2708	ANI13.exe	66.171.248.178:80	bot.whatismyipaddress.com	Alchemy Communications, Inc.	US	malicious
2708	ANI13.exe	192.35.177.64:80	apps.identrust.com	IdenTrust	US	malicious
2708	ANI13.exe	199.79.62.11:587	mail.cofcoainternational.com	PDR	US	malicious
2708	ANI13.exe	93.184.221.240:80	ctldl.windowsupdate.com	MCI Communications Services, Inc. d/b/a Verizon Business	US	whitelisted

General Info

http://185.164.72.213/ANI13.exe

178F96082BE7FC7736F134493EADEC5B

3644E593D5AC54B77CC5C9376FD336F25E5232A4

A32A9643875DBA7103373D1DA1CF6943C4649C72D7C3EFD5E592A5868DD4FEB5

3:N1KlnaP/rssCn:ClaP/4R

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Downloads executable files from IP

Downloads executable files from the Internet

Application was dropped or rewritten from another process

Detected Hawkeye Keylogger

Changes the login/logoff helper path in the registry

Actions looks like stealing of personal data

Stealing of credential data

SUSPICIOUS

Executable content was dropped or overwritten

Cleans NTFS data-stream (Zone Identifier)

Creates files in the user directory

Application launched itself

Executes scripts

INFO

Changes internet zones settings

Reads Internet Cache Settings

Reads the machine GUID from the registry

Reads settings of System Certificates

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings