Analysis
-
max time kernel
18s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 19:50
Static task
static1
Behavioral task
behavioral1
Sample
ZWW7W8kgYJXXKvy.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
ZWW7W8kgYJXXKvy.exe
Resource
win10v20201028
General
-
Target
ZWW7W8kgYJXXKvy.exe
-
Size
675KB
-
MD5
4137666f6fa8f8808fdc9cecc70b579d
-
SHA1
1c0c7105841a54e2dc2ed061584c485f64f1d871
-
SHA256
d3ab37684a8e03ae11189f172203d088e599045c3d0af5ebc4f6aef315cb45fd
-
SHA512
869c2570a2286074d28b53814724f4fc89305023687d581a031bee6a5f18b3183aa228d70ff353d7ba114f1cd2cbe97c1f413a2f3092944ef0ed58fb91727904
Malware Config
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
cjmyguy@yandex.com - Password:
@@Io419090@@
Extracted
hawkeye_reborn
10.1.2.2
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
cjmyguy@yandex.com - Password:
@@Io419090@@
1d23a5c9-2af1-40d7-b0b2-0b06b74ad1ec
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:@@Io419090@@ _EmailPort:587 _EmailSSL:true _EmailServer:smtp.yandex.com _EmailUsername:cjmyguy@yandex.com _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:1d23a5c9-2af1-40d7-b0b2-0b06b74ad1ec _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.1.2.2 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - RebornX, Version=10.1.2.2, Culture=neutral, PublicKeyToken=null
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
M00nD3v Logger Payload 2 IoCs
Detects M00nD3v Logger payload in memory.
Processes:
resource yara_rule behavioral2/memory/2092-2-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger behavioral2/memory/2092-3-0x000000000048A1DE-mapping.dmp m00nd3v_logger -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 bot.whatismyipaddress.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ZWW7W8kgYJXXKvy.exedescription pid process target process PID 4700 set thread context of 2092 4700 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ZWW7W8kgYJXXKvy.exepid process 2092 ZWW7W8kgYJXXKvy.exe 2092 ZWW7W8kgYJXXKvy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ZWW7W8kgYJXXKvy.exedescription pid process Token: SeDebugPrivilege 2092 ZWW7W8kgYJXXKvy.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ZWW7W8kgYJXXKvy.exepid process 2092 ZWW7W8kgYJXXKvy.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
ZWW7W8kgYJXXKvy.exedescription pid process target process PID 4700 wrote to memory of 3648 4700 ZWW7W8kgYJXXKvy.exe schtasks.exe PID 4700 wrote to memory of 3648 4700 ZWW7W8kgYJXXKvy.exe schtasks.exe PID 4700 wrote to memory of 3648 4700 ZWW7W8kgYJXXKvy.exe schtasks.exe PID 4700 wrote to memory of 2092 4700 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe PID 4700 wrote to memory of 2092 4700 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe PID 4700 wrote to memory of 2092 4700 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe PID 4700 wrote to memory of 2092 4700 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe PID 4700 wrote to memory of 2092 4700 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe PID 4700 wrote to memory of 2092 4700 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe PID 4700 wrote to memory of 2092 4700 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe PID 4700 wrote to memory of 2092 4700 ZWW7W8kgYJXXKvy.exe ZWW7W8kgYJXXKvy.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZWW7W8kgYJXXKvy.exe"C:\Users\Admin\AppData\Local\Temp\ZWW7W8kgYJXXKvy.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kRgqqg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4B28.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ZWW7W8kgYJXXKvy.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\ZWW7W8kgYJXXKvy.exe.logMD5
ef140ef600b2463c9e7dbf064a104046
SHA1c08fd1853877be95575ea2e860dd8cafef31f54c
SHA256ad8ae97fdeb174b20f02c7ddf9466981856d77d51133599b5954f48f78a1b616
SHA512bf16df0994080bdc832cb39a312e0095de57608256fcf0d04d589e0bdf3283f918fb0d6ec86ea28a4b1af6db12813c52a724028f02330ebc3a9d32a4fcda706c
-
C:\Users\Admin\AppData\Local\Temp\tmp4B28.tmpMD5
61deb82e8b40cf9147413ddf36c8793b
SHA1494f3ab6bbafbfd5049e0bdf426a9be17c35deaa
SHA25680b2ce20a86b3d0e5f61f1d845331219fa42ef91f4561dd964c6fb822f825866
SHA51296a489454bdceebde09b1953be07c8e3e4440f377de10023d646c34259e0c4d83ce7d64c9a910bd1f511f3f7a0e76cbdc03cf304d5b2e04992c958e2dcc9938a
-
memory/2092-2-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/2092-3-0x000000000048A1DE-mapping.dmp
-
memory/3648-0-0x0000000000000000-mapping.dmp