analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PO.exe

Full analysis: https://app.any.run/tasks/bc98bce4-550f-4841-a013-9dd54a9f7db7
Verdict: Malicious activity
Threats:

Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions.

Analysis date: December 18, 2018, 07:35:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
stealer
keylogger
hawkeye
evasion
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

CECDB998BFDA4AA80315FC39E54121EF

SHA1:

9A8BEF9EBE770EEF4809DC83092187328BDDD6E1

SHA256:

B734AAD330E24D173944AC7A455D08610E0B2F81CED85E6EE6369E6793C71481

SSDEEP:

12288:BzCuaEnZxFyYCE53LzamdvwVX4zEzCoaxnLyjM21:BzCgZvdtLza2vdALp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Detected Hawkeye Keylogger

      • Windows Update.exe (PID: 2916)
    • Actions looks like stealing of personal data

      • vbc.exe (PID: 2316)
  • SUSPICIOUS

    • Creates files in the user directory

      • PO.exe (PID: 2704)
      • Windows Update.exe (PID: 2916)
    • Executable content was dropped or overwritten

      • PO.exe (PID: 2704)
    • Checks for external IP

      • Windows Update.exe (PID: 2916)
    • Application launched itself

      • PO.exe (PID: 2068)
      • Windows Update.exe (PID: 264)
    • Starts itself from another location

      • PO.exe (PID: 2704)
    • Executes scripts

      • Windows Update.exe (PID: 2916)
    • Connects to unusual port

      • Windows Update.exe (PID: 2916)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (90.6)
.exe | Win32 Executable (generic) (4.9)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

OriginalFileName: FADGE2.exe
InternalName: FADGE2
ProductVersion: 4.04.0005
FileVersion: 4.04.0005
ProductName: Tatemichi
LegalTrademarks: racisms
LegalCopyright: rode
FileDescription: CORSON5
CompanyName: SOJOURNMENT10
Comments: MANSARD
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 4.4.0.5
FileVersionNumber: 4.4.0.5
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 4.4
OSVersion: 4
EntryPoint: 0x1490
UninitializedDataSize: -
InitializedDataSize: 16384
CodeSize: 757760
LinkerVersion: 6
PEType: PE32
TimeStamp: 1998:01:30 05:33:35+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 30-Jan-1998 04:33:35
Detected languages:
  • English - United States
Comments: MANSARD
CompanyName: SOJOURNMENT10
FileDescription: CORSON5
LegalCopyright: rode
LegalTrademarks: racisms
ProductName: Tatemichi
FileVersion: 4.04.0005
ProductVersion: 4.04.0005
InternalName: FADGE2
OriginalFilename: FADGE2.exe

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000B8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 30-Jan-1998 04:33:35
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000B8D90
0x000B9000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.4219
.data
0x000BA000
0x00000ABC
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x000BB000
0x00002FAE
0x00003000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.93958

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.37347
752
Unicode (UTF 16LE)
English - United States
RT_VERSION
30001
4.76962
5672
Unicode (UTF 16LE)
UNKNOWN
RT_ICON
30002
5.3725
2216
Unicode (UTF 16LE)
UNKNOWN
RT_ICON
30003
5.36524
1736
Unicode (UTF 16LE)
UNKNOWN
RT_ICON
30004
3.69909
1384
Unicode (UTF 16LE)
UNKNOWN
RT_ICON

Imports

MSVBVM60.DLL
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start po.exe no specs po.exe windows update.exe no specs windows update.exe #HAWKEYE windows update.exe vbc.exe vbc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2068"C:\Users\admin\Desktop\PO.exe" C:\Users\admin\Desktop\PO.exeexplorer.exe
User:
admin
Company:
SOJOURNMENT10
Integrity Level:
MEDIUM
Description:
CORSON5
Exit code:
0
Version:
4.04.0005
2704C:\Users\admin\Desktop\PO.exe" C:\Users\admin\Desktop\PO.exe
PO.exe
User:
admin
Company:
SOJOURNMENT10
Integrity Level:
MEDIUM
Description:
CORSON5
Exit code:
0
Version:
4.04.0005
2544"C:\Users\admin\AppData\Roaming\Windows Update.exe" C:\Users\admin\AppData\Roaming\Windows Update.exePO.exe
User:
admin
Company:
SOJOURNMENT10
Integrity Level:
MEDIUM
Description:
CORSON5
Exit code:
3221226540
Version:
4.04.0005
264"C:\Users\admin\AppData\Roaming\Windows Update.exe" C:\Users\admin\AppData\Roaming\Windows Update.exe
PO.exe
User:
admin
Company:
SOJOURNMENT10
Integrity Level:
HIGH
Description:
CORSON5
Exit code:
0
Version:
4.04.0005
2916C:\Users\admin\AppData\Roaming\Windows Update.exe" C:\Users\admin\AppData\Roaming\Windows Update.exe
Windows Update.exe
User:
admin
Company:
SOJOURNMENT10
Integrity Level:
HIGH
Description:
CORSON5
Version:
4.04.0005
2316C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holdermail.txt"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Windows Update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5483
2492C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holderwb.txt"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeWindows Update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5483
Total events
401
Read events
379
Write events
22
Delete events
0

Modification events

(PID) Process:(2704) PO.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2704) PO.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2704) PO.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2704) PO.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2916) Windows Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2916) Windows Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Windows Update_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2916) Windows Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Windows Update_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2916) Windows Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Windows Update_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2916) Windows Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Windows Update_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(2916) Windows Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Windows Update_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
1
Suspicious files
2
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2316vbc.exeC:\Users\admin\AppData\Local\Temp\holdermail.txt
MD5:
SHA256:
2492vbc.exeC:\Users\admin\AppData\Local\Temp\holderwb.txt
MD5:
SHA256:
2916Windows Update.exeC:\Users\admin\AppData\Roaming\pid.txttext
MD5:340A39045C40D50DDA207BCFDECE883A
SHA256:D8A1082B68A287D591A958486DC8E132B2EF7673A21EC940917A6BA13FAB69DA
2068PO.exeC:\Users\admin\AppData\Local\Temp\~DFA00223B0371CFAFE.TMPbinary
MD5:17A3CF5323CD01187AC4703BDB27FBA4
SHA256:A5973BA793EC3A709FFD722476CF187EF2EEA3649CC1467D90C58D2AC6B99E46
2704PO.exeC:\Users\admin\AppData\Roaming\Windows Update.exeexecutable
MD5:CECDB998BFDA4AA80315FC39E54121EF
SHA256:B734AAD330E24D173944AC7A455D08610E0B2F81CED85E6EE6369E6793C71481
2704PO.exeC:\Users\admin\AppData\Local\Temp\SysInfo.txttext
MD5:153074824A075699D831EEF1764D8B7F
SHA256:FC8DCB0D02742EA5F9E902EA366F97AC993931E444E1AFB1B28A1E34DA80F242
264Windows Update.exeC:\Users\admin\AppData\Local\Temp\~DF38ED369C58F11627.TMPbinary
MD5:17A3CF5323CD01187AC4703BDB27FBA4
SHA256:A5973BA793EC3A709FFD722476CF187EF2EEA3649CC1467D90C58D2AC6B99E46
2916Windows Update.exeC:\Users\admin\AppData\Roaming\pidloc.txttext
MD5:E9FAEE87A060C806E7234779CFF7B480
SHA256:CE744D98EF602BA5FE207C4C064DA0075A1BB9BF303E53CA86AF1025AD3AFBF3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2916
Windows Update.exe
GET
403
104.16.18.96:80
http://whatismyipaddress.com/
US
text
100 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2916
Windows Update.exe
45.58.142.254:40027
Sharktech
US
malicious
2916
Windows Update.exe
104.16.18.96:80
whatismyipaddress.com
Cloudflare Inc
US
shared
2916
Windows Update.exe
45.58.142.254:21
Sharktech
US
malicious

DNS requests

Domain
IP
Reputation
whatismyipaddress.com
  • 104.16.18.96
  • 104.16.17.96
  • 104.16.16.96
  • 104.16.20.96
  • 104.16.19.96
shared

Threats

PID
Process
Class
Message
2916
Windows Update.exe
A Network Trojan was detected
MALWARE [PTsecurity] Spyware.HawkEyeKeyLogger (IP Chck)
2916
Windows Update.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2916
Windows Update.exe
A Network Trojan was detected
ET TROJAN HawkEye Keylogger FTP
3 ETPRO signatures available at the full report
No debug info