Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    06-05-2020 14:40

General

  • Target

    07675566556 PURCHASE ORDERpdf.exe

  • Size

    876KB

  • MD5

    b274988968c4256575dd4c4403838324

  • SHA1

    a62d5ceb57ddec5dcffe768c6f48ff1dae66db67

  • SHA256

    bbf613ce1f6850b2b62c6f55082ab7b9bcc7f92db0a8ec8f0b495e29cb4988ae

  • SHA512

    abc5906d8e1e69ff1b33c61db06c4802e370efc8c15db8742092148fbb57aa8df3bd70e6b54fcf6b9a232642318510a4b352ce9810fbd7a1904b6f806d379978

Malware Config

Extracted

Credentials

Protocol: ftp

Host: ftp.gracexmhk.info

Port: 21

Username: stanzo@gracexmhk.info

Password: Success2020

Extracted

Family

hawkeye_reborn

Version

10.0.0.1

Credentials

Protocol: ftp

Host: ftp.gracexmhk.info

Port: 21

Username: stanzo@gracexmhk.info

Password: Success2020

Attributes
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:false _Delivery:2 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPort:0 _EmailSSL:false _ExecutionDelay:10 _FTPPassword:Success2020 _FTPPort:21 _FTPSFTP:true _FTPServer:ftp.gracexmhk.info _FTPUsername:stanzo@gracexmhk.info _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:10 _MeltFile:false _Mutex:860e38e2-ebad-459f-9a9b-df55993f73fe _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.0.0.1 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.1, Culture=neutral, PublicKeyToken=null

Signatures

  • Suspicious use of SetThreadContext ⋅ 3 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 1 IoCs
  • Uses the VBS compiler for execution ⋅ 1 TTPs
  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service ⋅ 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Creates scheduled task(s) ⋅ 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

  • Suspicious use of WriteProcessMemory ⋅ 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07675566556 PURCHASE ORDERpdf.exe
    "C:\Users\Admin\AppData\Local\Temp\07675566556 PURCHASE ORDERpdf.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:288
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eLajqaT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC551.tmp"
      Creates scheduled task(s)
      PID:532
    • C:\Users\Admin\AppData\Local\Temp\07675566556 PURCHASE ORDERpdf.exe
      "{path}"
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1060
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpFC67.tmp"
        Suspicious behavior: EnumeratesProcesses
        PID:1880
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpEE45.tmp"
        PID:1732

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

    Discovery

      Execution

        Exfiltration

          Impact

            Initial Access

              Lateral Movement

                Persistence

                Privilege Escalation

                  Replay Monitor

                  00:00 00:00

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\tmpC551.tmp
                  • C:\Users\Admin\AppData\Local\Temp\tmpFC67.tmp
                  • memory/1060-1-0x0000000000400000-0x0000000000490000-memory.dmp
                  • memory/1060-2-0x0000000000400000-0x0000000000490000-memory.dmp
                  • memory/1060-3-0x0000000000400000-0x0000000000490000-memory.dmp
                  • memory/1732-7-0x0000000000400000-0x000000000041C000-memory.dmp
                  • memory/1732-8-0x0000000000400000-0x000000000041C000-memory.dmp
                  • memory/1880-4-0x0000000000400000-0x000000000045C000-memory.dmp
                  • memory/1880-5-0x0000000000400000-0x000000000045C000-memory.dmp