Analysis
-
max time kernel
56s -
max time network
102s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:13
General
-
Target
DOC131020-13102020161809.pdf.exe
-
Size
816KB
-
MD5
71edcf18af1984f6164e817f01901be8
-
SHA1
92433522129ad461a913a9b93375b77ec0cfbe1b
-
SHA256
15c7c3a3e619c5db49470198804b7a3a6cf925daceeea180fd0b9cc91bb2e4d1
-
SHA512
bc6068001ee3529a3b764e5919f0d73b5cdff49931d5c4c6faf9950df36c061ec449f730830937f859bc15ac89c2fa994eee8de1fe9abb55aee14f461c266d3b
Malware Config
Extracted
hawkeye_reborn
10.1.2.7
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
melfordee@yandex.com - Password:
hhxfdjsihnlsxrzf
b229d537-6551-4a40-9bd3-ad959ca672e3
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:hhxfdjsihnlsxrzf _EmailPort:587 _EmailSSL:true _EmailServer:smtp.yandex.com _EmailUsername:melfordee@yandex.com _EmptyClipboard:true _EmptyKeyStroke:true _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:5 _LoopPasswordStealer:true _MeltFile:false _Mutex:b229d537-6551-4a40-9bd3-ad959ca672e3 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:false _Version:10.1.2.7 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - RebornX, Version=10.1.2.7, Culture=neutral, PublicKeyToken=null
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
M00nD3v Logger Payload 2 IoCs
Detects M00nD3v Logger payload in memory.
-
Suspicious use of SetThreadContext 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DOC131020-13102020161809.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DOC131020-13102020161809.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XHBTWTBD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDCC.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\DOC131020-13102020161809.pdf.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DOC131020-13102020161809.pdf.exe.logMD5
3fed8d1dd11972a6e2603bb2d73a3ee5
SHA17ecb7f64ade7b91c5815da647e84167c3d95afb4
SHA256eecf6c0575dc995a485d46a5daaa66f58229e552f16782d873834d218ab17551
SHA512ca6059eb67f800cc666d5146d24070abf5ee08209f8f9d1668a0ca2201eb3f6fa013c2d807b09925e12b82c37686980fcc26a6a5e4a5ba129c4b2a585961d3bb
-
C:\Users\Admin\AppData\Local\Temp\tmpDCC.tmpMD5
2011d7973d2f00ceb26e0ba1a9fd8f11
SHA143f49a6c9f7f7f332daf9fc9ffaac581c562102d
SHA256cd5d17f6fb7b5760d426e737859de22580140aaa87d0bd54aaa55d637de27fdb
SHA512e45e63830958d69b8d1fbb43c0f83e32760a90524036d0701b0c5f95f9969936345c38eb5b0bb26d9fbd4fdd54b4764c30291569d42196b68d30b34551703131
-
memory/676-20-0x0000000009A90000-0x0000000009A91000-memory.dmpFilesize
4KB
-
memory/676-18-0x0000000001450000-0x000000000146A000-memory.dmpFilesize
104KB
-
memory/676-15-0x0000000073940000-0x000000007402E000-memory.dmpFilesize
6.9MB
-
memory/676-13-0x0000000000497C3E-mapping.dmp
-
memory/676-12-0x0000000000400000-0x000000000049C000-memory.dmpFilesize
624KB
-
memory/1020-5-0x0000000004980000-0x0000000004981000-memory.dmpFilesize
4KB
-
memory/1020-9-0x00000000077B0000-0x00000000077B1000-memory.dmpFilesize
4KB
-
memory/1020-8-0x00000000070B0000-0x0000000007172000-memory.dmpFilesize
776KB
-
memory/1020-7-0x0000000004DB0000-0x0000000004DC4000-memory.dmpFilesize
80KB
-
memory/1020-6-0x0000000007280000-0x0000000007281000-memory.dmpFilesize
4KB
-
memory/1020-0-0x0000000073940000-0x000000007402E000-memory.dmpFilesize
6.9MB
-
memory/1020-4-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/1020-3-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB
-
memory/1020-1-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2532-10-0x0000000000000000-mapping.dmp