Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7 -
submitted
26-06-2020 15:29
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT.exe
Resource
win7
Behavioral task
behavioral2
Sample
SWIFT.exe
Resource
win10v200430
General
-
Target
SWIFT.exe
-
Size
798KB
-
MD5
2964939592941753fa4294aa4e1389e8
-
SHA1
ec6966f36bb3e2dbf698e4984faac9e8a311a1c3
-
SHA256
cf079000d12cefafc5b2d251df1bd9a8ee96a62a67062f22dd9027693adfeeea
-
SHA512
8c01f9faefd3b761f5d810e84c6088600a77bdd8c55d93b4a18dd67ac4d04189e5c9fcd4e07a770d72dac2a09b260d5e3a47722e1f1db972fb62a189e56fdb99
Malware Config
Extracted
hawkeye_reborn
9.0.1.6
Protocol: smtp- Host:
mail.djindustries.net - Port:
587 - Username:
[email protected] - Password:
dj123
7c6f1211-8a47-40f9-9379-74b0ebf28256
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:dj123 _EmailPort:587 _EmailSSL:false _EmailServer:mail.djindustries.net _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:7c6f1211-8a47-40f9-9379-74b0ebf28256 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null
Signatures
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
SWIFT.exeRegSvcs.exedescription pid process target process PID 1768 set thread context of 1224 1768 SWIFT.exe RegSvcs.exe PID 1224 set thread context of 860 1224 RegSvcs.exe vbc.exe PID 1224 set thread context of 1100 1224 RegSvcs.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
vbc.exepid process 860 vbc.exe 860 vbc.exe 860 vbc.exe 860 vbc.exe 860 vbc.exe -
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
SWIFT.exeRegSvcs.exedescription pid process target process PID 1768 wrote to memory of 2036 1768 SWIFT.exe schtasks.exe PID 1768 wrote to memory of 2036 1768 SWIFT.exe schtasks.exe PID 1768 wrote to memory of 2036 1768 SWIFT.exe schtasks.exe PID 1768 wrote to memory of 2036 1768 SWIFT.exe schtasks.exe PID 1768 wrote to memory of 1224 1768 SWIFT.exe RegSvcs.exe PID 1768 wrote to memory of 1224 1768 SWIFT.exe RegSvcs.exe PID 1768 wrote to memory of 1224 1768 SWIFT.exe RegSvcs.exe PID 1768 wrote to memory of 1224 1768 SWIFT.exe RegSvcs.exe PID 1768 wrote to memory of 1224 1768 SWIFT.exe RegSvcs.exe PID 1768 wrote to memory of 1224 1768 SWIFT.exe RegSvcs.exe PID 1768 wrote to memory of 1224 1768 SWIFT.exe RegSvcs.exe PID 1768 wrote to memory of 1224 1768 SWIFT.exe RegSvcs.exe PID 1768 wrote to memory of 1224 1768 SWIFT.exe RegSvcs.exe PID 1768 wrote to memory of 1224 1768 SWIFT.exe RegSvcs.exe PID 1768 wrote to memory of 1224 1768 SWIFT.exe RegSvcs.exe PID 1768 wrote to memory of 1224 1768 SWIFT.exe RegSvcs.exe PID 1224 wrote to memory of 860 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 860 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 860 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 860 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 860 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 860 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 860 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 860 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 860 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 860 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 1100 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 1100 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 1100 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 1100 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 1100 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 1100 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 1100 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 1100 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 1100 1224 RegSvcs.exe vbc.exe PID 1224 wrote to memory of 1100 1224 RegSvcs.exe vbc.exe -
M00nD3v Logger Payload 3 IoCs
Detects M00nD3v Logger payload in memory.
Processes:
resource yara_rule behavioral1/memory/1224-2-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger behavioral1/memory/1224-4-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger behavioral1/memory/1224-5-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger
Processes
-
C:\Users\Admin\AppData\Local\Temp\SWIFT.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pobRvAxlXl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp113E.tmp"2⤵
- Creates scheduled task(s)
PID:2036 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp3EC4.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:860 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp30A1.tmp"3⤵PID:1100