678900.pdf.exe
802KB
26-05-2020 13:19
behavioral2
109964ff67ad854a737b1cd1902a5424
afcf13c1f3e3d4e19f20e8449302e429e10c5d7c
a5a00f206182c8e732f580b520af49f2b5a33c93676f15e8eadb5d1eba6ed497
501b5bb9825fd116882863688f72f4d1cc03e64d10c8d3706b5870f48415f6b87675e17a4548e3da2e8d820d529ba1ffc806ddd0926fd2ac67b2be46c0b5003a
Extracted
Family | hawkeye_reborn |
Version | 10.1.0.0 |
Credentials | Protocol: smtp Host: mail.3enaluminyum.com.tr Port: 587 Username: ihgungor@3enaluminyum.com.tr Password: 3eN13579? |
Attributes |
fields map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:3eN13579? _EmailPort:587 _EmailSSL:true _EmailServer:mail.3enaluminyum.com.tr _EmailUsername:ihgungor@3enaluminyum.com.tr _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:1278e7d4-dcd9-4a7a-8780-d6f5636aa3de _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.1.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name HawkEye Keylogger - RebornX, Version=10.1.0.0, Culture=neutral, PublicKeyToken=null |
Filter: none
-
HawkEye Reborn
Description
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
Tags
-
Uses the VBS compiler for execution
TTPs
-
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Suspicious use of WriteProcessMemory678900.pdf.exe678900.pdf.exe
Reported IOCs
description pid process target process PID 1312 wrote to memory of 1712 1312 678900.pdf.exe 678900.pdf.exe PID 1312 wrote to memory of 1712 1312 678900.pdf.exe 678900.pdf.exe PID 1312 wrote to memory of 1712 1312 678900.pdf.exe 678900.pdf.exe PID 1312 wrote to memory of 1836 1312 678900.pdf.exe 678900.pdf.exe PID 1312 wrote to memory of 1836 1312 678900.pdf.exe 678900.pdf.exe PID 1312 wrote to memory of 1836 1312 678900.pdf.exe 678900.pdf.exe PID 1312 wrote to memory of 1836 1312 678900.pdf.exe 678900.pdf.exe PID 1312 wrote to memory of 1836 1312 678900.pdf.exe 678900.pdf.exe PID 1312 wrote to memory of 1836 1312 678900.pdf.exe 678900.pdf.exe PID 1312 wrote to memory of 1836 1312 678900.pdf.exe 678900.pdf.exe PID 1312 wrote to memory of 1836 1312 678900.pdf.exe 678900.pdf.exe PID 1836 wrote to memory of 3544 1836 678900.pdf.exe vbc.exe PID 1836 wrote to memory of 3544 1836 678900.pdf.exe vbc.exe PID 1836 wrote to memory of 3544 1836 678900.pdf.exe vbc.exe PID 1836 wrote to memory of 3544 1836 678900.pdf.exe vbc.exe PID 1836 wrote to memory of 3544 1836 678900.pdf.exe vbc.exe PID 1836 wrote to memory of 3544 1836 678900.pdf.exe vbc.exe PID 1836 wrote to memory of 3544 1836 678900.pdf.exe vbc.exe PID 1836 wrote to memory of 3544 1836 678900.pdf.exe vbc.exe PID 1836 wrote to memory of 3544 1836 678900.pdf.exe vbc.exe PID 1836 wrote to memory of 4080 1836 678900.pdf.exe vbc.exe PID 1836 wrote to memory of 4080 1836 678900.pdf.exe vbc.exe PID 1836 wrote to memory of 4080 1836 678900.pdf.exe vbc.exe PID 1836 wrote to memory of 4080 1836 678900.pdf.exe vbc.exe PID 1836 wrote to memory of 4080 1836 678900.pdf.exe vbc.exe PID 1836 wrote to memory of 4080 1836 678900.pdf.exe vbc.exe PID 1836 wrote to memory of 4080 1836 678900.pdf.exe vbc.exe PID 1836 wrote to memory of 4080 1836 678900.pdf.exe vbc.exe PID 1836 wrote to memory of 4080 1836 678900.pdf.exe vbc.exe -
Suspicious use of SetWindowsHookEx678900.pdf.exe
Reported IOCs
pid process 1836 678900.pdf.exe -
Suspicious use of SetThreadContext678900.pdf.exe678900.pdf.exe
Reported IOCs
description pid process target process PID 1312 set thread context of 1836 1312 678900.pdf.exe 678900.pdf.exe PID 1836 set thread context of 3544 1836 678900.pdf.exe vbc.exe PID 1836 set thread context of 4080 1836 678900.pdf.exe vbc.exe -
Looks up external IP address via web service
Description
Uses a legitimate IP lookup service to find the infected system's external IP.
Reported IOCs
flow ioc 5 bot.whatismyipaddress.com -
Suspicious use of AdjustPrivilegeToken678900.pdf.exe678900.pdf.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 1312 678900.pdf.exe Token: SeDebugPrivilege 1836 678900.pdf.exe -
Suspicious behavior: EnumeratesProcesses678900.pdf.exevbc.exe678900.pdf.exe
Reported IOCs
pid process 1312 678900.pdf.exe 1312 678900.pdf.exe 1312 678900.pdf.exe 1312 678900.pdf.exe 1312 678900.pdf.exe 1312 678900.pdf.exe 3544 vbc.exe 3544 vbc.exe 3544 vbc.exe 3544 vbc.exe 1836 678900.pdf.exe 1836 678900.pdf.exe
-
C:\Users\Admin\AppData\Local\Temp\678900.pdf.exe"C:\Users\Admin\AppData\Local\Temp\678900.pdf.exe"Suspicious use of WriteProcessMemorySuspicious use of SetThreadContextSuspicious use of AdjustPrivilegeTokenSuspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\678900.pdf.exe"{path}"
-
C:\Users\Admin\AppData\Local\Temp\678900.pdf.exe"{path}"Suspicious use of WriteProcessMemorySuspicious use of SetWindowsHookExSuspicious use of SetThreadContextSuspicious use of AdjustPrivilegeTokenSuspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp1728.tmp"Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp1B3F.tmp"
-
C:\Users\Admin\AppData\Local\Temp\tmp1728.tmp
-
memory/1836-0-0x0000000000400000-0x00000000004AA000-memory.dmp
-
memory/3544-1-0x0000000000400000-0x0000000000477000-memory.dmp
-
memory/3544-2-0x0000000000400000-0x0000000000477000-memory.dmp
-
memory/4080-4-0x0000000000400000-0x0000000000455000-memory.dmp
-
memory/4080-5-0x0000000000400000-0x0000000000455000-memory.dmp