Analysis
- max time kernel
116s - max time network
117s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:04
General
- Target new order.exe
- Size 652KB
- Sample201109-db1fy8ygee
- SHA256 73878e34b785ba5dd951e4af104d6f68416b07f487584a1963c5b63913615eb3
Malware Config
Extracted
-
hawkeye_reborn
-
10.1.2.2
-
Protocol
smtp
-
Host
bernini.hosting-mexico.net
-
Port
26
-
Username
-
Password
cs50@pass1
-
c3146bd4-fb85-4a81-9b90-72b32426f59a
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:cs50@pass1 _EmailPort:26 _EmailSSL:true _EmailServer:bernini.hosting-mexico.net _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:c3146bd4-fb85-4a81-9b90-72b32426f59a _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:false _Version:10.1.2.2 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - RebornX, Version=10.1.2.2, Culture=neutral, PublicKeyToken=null
Signatures
- CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
- HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
- M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
- M00nD3v Logger Payload 2 IoCs
Detects M00nD3v Logger payload in memory.
- rezer0 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\new order.exe"C:\Users\Admin\AppData\Local\Temp\new order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RaxvLIufoL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6A87.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\new order.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4248-18-0x0000000009C30000-0x0000000009C31000-memory.dmp
memory/4248-16-0x0000000002E30000-0x0000000002E31000-memory.dmp
memory/4248-13-0x00000000732D0000-0x00000000739BE000-memory.dmp
memory/4248-11-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4760-4-0x0000000005420000-0x0000000005421000-memory.dmp
memory/4760-8-0x0000000008D00000-0x0000000008D91000-memory.dmp
memory/4760-7-0x0000000008A00000-0x0000000008A02000-memory.dmp
memory/4760-6-0x0000000008A60000-0x0000000008A61000-memory.dmp
memory/4760-5-0x0000000005100000-0x0000000005101000-memory.dmp
memory/4760-0-0x00000000732D0000-0x00000000739BE000-memory.dmp
memory/4760-3-0x0000000005820000-0x0000000005821000-memory.dmp
memory/4760-1-0x00000000007A0000-0x00000000007A1000-memory.dmp