Analysis
-
max time kernel
133s -
max time network
135s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 19:50
Static task
static1
Behavioral task
behavioral1
Sample
ZWW7W8kgYJXXKvy.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
ZWW7W8kgYJXXKvy.exe
Resource
win10v20201028
General
-
Target
ZWW7W8kgYJXXKvy.exe
-
Size
675KB
-
MD5
4137666f6fa8f8808fdc9cecc70b579d
-
SHA1
1c0c7105841a54e2dc2ed061584c485f64f1d871
-
SHA256
d3ab37684a8e03ae11189f172203d088e599045c3d0af5ebc4f6aef315cb45fd
-
SHA512
869c2570a2286074d28b53814724f4fc89305023687d581a031bee6a5f18b3183aa228d70ff353d7ba114f1cd2cbe97c1f413a2f3092944ef0ed58fb91727904
Malware Config
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
cjmyguy@yandex.com - Password:
@@Io419090@@
Extracted
hawkeye_reborn
10.1.2.2
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
cjmyguy@yandex.com - Password:
@@Io419090@@
1d23a5c9-2af1-40d7-b0b2-0b06b74ad1ec
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:@@Io419090@@ _EmailPort:587 _EmailSSL:true _EmailServer:smtp.yandex.com _EmailUsername:cjmyguy@yandex.com _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:1d23a5c9-2af1-40d7-b0b2-0b06b74ad1ec _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.1.2.2 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - RebornX, Version=10.1.2.2, Culture=neutral, PublicKeyToken=null
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
M00nD3v Logger Payload 4 IoCs
Detects M00nD3v Logger payload in memory.
Processes:
resource yara_rule behavioral1/memory/1344-2-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger behavioral1/memory/1344-3-0x000000000048A1DE-mapping.dmp m00nd3v_logger behavioral1/memory/1344-4-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger behavioral1/memory/1344-5-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 bot.whatismyipaddress.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ZWW7W8kgYJXXKvy.exedescription pid process target process PID 288 set thread context of 1344 288 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ZWW7W8kgYJXXKvy.exepid process 1344 ZWW7W8kgYJXXKvy.exe 1344 ZWW7W8kgYJXXKvy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ZWW7W8kgYJXXKvy.exedescription pid process Token: SeDebugPrivilege 1344 ZWW7W8kgYJXXKvy.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ZWW7W8kgYJXXKvy.exepid process 1344 ZWW7W8kgYJXXKvy.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
ZWW7W8kgYJXXKvy.exedescription pid process target process PID 288 wrote to memory of 1076 288 ZWW7W8kgYJXXKvy.exe schtasks.exe PID 288 wrote to memory of 1076 288 ZWW7W8kgYJXXKvy.exe schtasks.exe PID 288 wrote to memory of 1076 288 ZWW7W8kgYJXXKvy.exe schtasks.exe PID 288 wrote to memory of 1076 288 ZWW7W8kgYJXXKvy.exe schtasks.exe PID 288 wrote to memory of 1344 288 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe PID 288 wrote to memory of 1344 288 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe PID 288 wrote to memory of 1344 288 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe PID 288 wrote to memory of 1344 288 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe PID 288 wrote to memory of 1344 288 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe PID 288 wrote to memory of 1344 288 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe PID 288 wrote to memory of 1344 288 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe PID 288 wrote to memory of 1344 288 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe PID 288 wrote to memory of 1344 288 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZWW7W8kgYJXXKvy.exe"C:\Users\Admin\AppData\Local\Temp\ZWW7W8kgYJXXKvy.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kRgqqg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp30D0.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ZWW7W8kgYJXXKvy.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp30D0.tmpMD5
b17600f80598983fc11195f743454d21
SHA1467498356386799248c27a66f36a0c649b67f96a
SHA256958c422028d3b9ed2a8298d863ac34f89463ca949c42a087e4a66deb822fff52
SHA512349d6af7a32ada64830ee3374c1d62e2d66e385c7c20c46bc3beb4c5915794e3e2c92d02e641aafdb76a53744674bf767da3bc0a1e1dc7cb1bb6d3836f85baba
-
memory/1076-0-0x0000000000000000-mapping.dmp
-
memory/1344-2-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/1344-3-0x000000000048A1DE-mapping.dmp
-
memory/1344-4-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/1344-5-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/1368-6-0x000007FEF7510000-0x000007FEF778A000-memory.dmpFilesize
2.5MB