Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 19:53
Static task
static1
Behavioral task
behavioral1
Sample
667bd85d957124ab909987434bad3a62.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
667bd85d957124ab909987434bad3a62.exe
Resource
win10v20201028
General
-
Target
667bd85d957124ab909987434bad3a62.exe
-
Size
814KB
-
MD5
667bd85d957124ab909987434bad3a62
-
SHA1
48f5ff1c43ab6ed28f59dcf9b10d4515922201f2
-
SHA256
7559061a4b412f6249a6dd96889eecac890e2f7a3d1a2ea9bcf611feb26bf7d2
-
SHA512
4ce39e69483fbad186313ab5bd26cc15a068ce8c1785e78a995ba92299c5b191cfde53dc55e1de50318f91fb74a2b800970d5292c249f738531b60a9ecdab2b2
Malware Config
Extracted
hawkeye_reborn
9.0.1.6
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
alexisborris@yandex.ru - Password:
@Veronica24#
2aaa2ba3-49c8-4136-9d23-df4acf25bce7
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:true _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:@Veronica24# _EmailPort:587 _EmailSSL:true _EmailServer:smtp.yandex.ru _EmailUsername:alexisborris@yandex.ru _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:2aaa2ba3-49c8-4136-9d23-df4acf25bce7 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null
Signatures
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
Processes:
resource yara_rule behavioral1/memory/536-320-0x0000000000420000-0x0000000000422000-memory.dmp coreentity -
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
M00nD3v Logger Payload 4 IoCs
Detects M00nD3v Logger payload in memory.
Processes:
resource yara_rule behavioral1/memory/300-325-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger behavioral1/memory/300-326-0x000000000048B2FE-mapping.dmp m00nd3v_logger behavioral1/memory/300-327-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger behavioral1/memory/300-328-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger -
Processes:
resource yara_rule behavioral1/memory/536-321-0x0000000005B80000-0x0000000005C12000-memory.dmp rezer0 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
667bd85d957124ab909987434bad3a62.exe667bd85d957124ab909987434bad3a62.exedescription pid process target process PID 536 set thread context of 300 536 667bd85d957124ab909987434bad3a62.exe 667bd85d957124ab909987434bad3a62.exe PID 300 set thread context of 1320 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 set thread context of 1916 300 667bd85d957124ab909987434bad3a62.exe vbc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 1196 taskkill.exe 652 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
667bd85d957124ab909987434bad3a62.exevbc.exepid process 300 667bd85d957124ab909987434bad3a62.exe 300 667bd85d957124ab909987434bad3a62.exe 300 667bd85d957124ab909987434bad3a62.exe 300 667bd85d957124ab909987434bad3a62.exe 300 667bd85d957124ab909987434bad3a62.exe 300 667bd85d957124ab909987434bad3a62.exe 300 667bd85d957124ab909987434bad3a62.exe 300 667bd85d957124ab909987434bad3a62.exe 300 667bd85d957124ab909987434bad3a62.exe 1320 vbc.exe 1320 vbc.exe 1320 vbc.exe 1320 vbc.exe 1320 vbc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
667bd85d957124ab909987434bad3a62.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 300 667bd85d957124ab909987434bad3a62.exe Token: SeDebugPrivilege 652 taskkill.exe Token: SeDebugPrivilege 1196 taskkill.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
667bd85d957124ab909987434bad3a62.exe667bd85d957124ab909987434bad3a62.execmd.execmd.exedescription pid process target process PID 536 wrote to memory of 1636 536 667bd85d957124ab909987434bad3a62.exe schtasks.exe PID 536 wrote to memory of 1636 536 667bd85d957124ab909987434bad3a62.exe schtasks.exe PID 536 wrote to memory of 1636 536 667bd85d957124ab909987434bad3a62.exe schtasks.exe PID 536 wrote to memory of 1636 536 667bd85d957124ab909987434bad3a62.exe schtasks.exe PID 536 wrote to memory of 300 536 667bd85d957124ab909987434bad3a62.exe 667bd85d957124ab909987434bad3a62.exe PID 536 wrote to memory of 300 536 667bd85d957124ab909987434bad3a62.exe 667bd85d957124ab909987434bad3a62.exe PID 536 wrote to memory of 300 536 667bd85d957124ab909987434bad3a62.exe 667bd85d957124ab909987434bad3a62.exe PID 536 wrote to memory of 300 536 667bd85d957124ab909987434bad3a62.exe 667bd85d957124ab909987434bad3a62.exe PID 536 wrote to memory of 300 536 667bd85d957124ab909987434bad3a62.exe 667bd85d957124ab909987434bad3a62.exe PID 536 wrote to memory of 300 536 667bd85d957124ab909987434bad3a62.exe 667bd85d957124ab909987434bad3a62.exe PID 536 wrote to memory of 300 536 667bd85d957124ab909987434bad3a62.exe 667bd85d957124ab909987434bad3a62.exe PID 536 wrote to memory of 300 536 667bd85d957124ab909987434bad3a62.exe 667bd85d957124ab909987434bad3a62.exe PID 536 wrote to memory of 300 536 667bd85d957124ab909987434bad3a62.exe 667bd85d957124ab909987434bad3a62.exe PID 300 wrote to memory of 1172 300 667bd85d957124ab909987434bad3a62.exe cmd.exe PID 300 wrote to memory of 1172 300 667bd85d957124ab909987434bad3a62.exe cmd.exe PID 300 wrote to memory of 1172 300 667bd85d957124ab909987434bad3a62.exe cmd.exe PID 300 wrote to memory of 1172 300 667bd85d957124ab909987434bad3a62.exe cmd.exe PID 300 wrote to memory of 1460 300 667bd85d957124ab909987434bad3a62.exe cmd.exe PID 300 wrote to memory of 1460 300 667bd85d957124ab909987434bad3a62.exe cmd.exe PID 300 wrote to memory of 1460 300 667bd85d957124ab909987434bad3a62.exe cmd.exe PID 300 wrote to memory of 1460 300 667bd85d957124ab909987434bad3a62.exe cmd.exe PID 1172 wrote to memory of 1196 1172 cmd.exe taskkill.exe PID 1172 wrote to memory of 1196 1172 cmd.exe taskkill.exe PID 1172 wrote to memory of 1196 1172 cmd.exe taskkill.exe PID 1172 wrote to memory of 1196 1172 cmd.exe taskkill.exe PID 1460 wrote to memory of 652 1460 cmd.exe taskkill.exe PID 1460 wrote to memory of 652 1460 cmd.exe taskkill.exe PID 1460 wrote to memory of 652 1460 cmd.exe taskkill.exe PID 1460 wrote to memory of 652 1460 cmd.exe taskkill.exe PID 300 wrote to memory of 1320 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1320 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1320 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1320 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1320 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1320 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1320 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1320 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1320 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1320 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1916 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1916 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1916 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1916 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1916 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1916 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1916 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1916 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1916 300 667bd85d957124ab909987434bad3a62.exe vbc.exe PID 300 wrote to memory of 1916 300 667bd85d957124ab909987434bad3a62.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\667bd85d957124ab909987434bad3a62.exe"C:\Users\Admin\AppData\Local\Temp\667bd85d957124ab909987434bad3a62.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FeJAOhVJyQNy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3025.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\667bd85d957124ab909987434bad3a62.exe"{path}"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C TASKKILL /F /IM wscript.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exeTASKKILL /F /IM wscript.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C TASKKILL /F /IM cmd.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exeTASKKILL /F /IM cmd.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp6133.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp65A7.tmp"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3025.tmpMD5
c9e08d269d48f8883f1bbde1e3858f37
SHA11a00237acf9c6b17540c837e6dbfe528f1f455d9
SHA2566c994e4355578617a1b527b16d1941ef970211dd5b4e877fd829f236c266ef49
SHA5128b9409b2f1a71eee72114e1ea41347177ca568b6fdaafd21b61c1a284bca042597a444712ebab65d7e12d635eda071f89d9ecc0209971ccf2b24c152d3fa5b2d
-
C:\Users\Admin\AppData\Local\Temp\tmp6133.tmpMD5
f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
memory/300-329-0x0000000074360000-0x0000000074A4E000-memory.dmpFilesize
6.9MB
-
memory/300-325-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/300-332-0x0000000000DA0000-0x0000000000E12000-memory.dmpFilesize
456KB
-
memory/300-328-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/300-327-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/300-326-0x000000000048B2FE-mapping.dmp
-
memory/536-3-0x0000000000720000-0x00000000007B6000-memory.dmpFilesize
600KB
-
memory/536-1-0x00000000010D0000-0x00000000010D1000-memory.dmpFilesize
4KB
-
memory/536-4-0x0000000000530000-0x0000000000541000-memory.dmpFilesize
68KB
-
memory/536-321-0x0000000005B80000-0x0000000005C12000-memory.dmpFilesize
584KB
-
memory/536-320-0x0000000000420000-0x0000000000422000-memory.dmpFilesize
8KB
-
memory/536-0-0x0000000074360000-0x0000000074A4E000-memory.dmpFilesize
6.9MB
-
memory/652-343-0x0000000000000000-mapping.dmp
-
memory/1172-339-0x0000000000000000-mapping.dmp
-
memory/1196-342-0x0000000000000000-mapping.dmp
-
memory/1320-346-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/1320-347-0x000000000044472E-mapping.dmp
-
memory/1320-348-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/1460-341-0x0000000000000000-mapping.dmp
-
memory/1636-322-0x0000000000000000-mapping.dmp
-
memory/1916-352-0x000000000041211A-mapping.dmp
-
memory/1916-351-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1916-353-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2044-349-0x000007FEF72E0000-0x000007FEF755A000-memory.dmpFilesize
2.5MB