Analysis
- max time kernel
153s - max time network
153s - platform
windows7_x64 - resource
win7v20210410 - submitted
14/08/2021, 08:47
Static task
static1
Behavioral task
behavioral1
Sample
E-Remittance Form_z.TXT.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
E-Remittance Form_z.TXT.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target E-Remittance Form_z.TXT.exe
- Size 1.4MB
- Sample210814-sr9bd6bjbx
- SHA256 bdade907a458b6c9d2e87af5667c3b8a16aa7804535634ed662b0e07c34f64b1
- MD5 0c3bdc11fd6454bb67da849864170b44
- SHA1 1c925518e075761758a47f677016c95f5e80c92c
- SHA512 b75c5e2967976c5df69b7ad438b9dc26b68accd1fe707575f396b3926e16c99dbf7fd4f30815430e5160461793de9f7897bc2660307f94aa8795a01220b7ad9b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
hawkeye_reborn
Version
-
9.0.1.6
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
PLAYBOY@123
Mutex
-
0afb590f-6441-4e30-9017-486274a19cc9
Attributes
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:PLAYBOY@123 _EmailPort:587 _EmailSSL:true _EmailServer:smtp.yandex.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:2880 _MeltFile:false _Mutex:0afb590f-6441-4e30-9017-486274a19cc9 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null
Signatures
- HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
- M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
- M00nD3v Logger Payload 3 IoCs
Detects M00nD3v Logger payload in memory.
resource yara_rule behavioral1/memory/1720-70-0x00000000001D0000-0x0000000000732000-memory.dmp m00nd3v_logger behavioral1/memory/1720-71-0x000000000025B2FE-mapping.dmp m00nd3v_logger behavioral1/memory/1720-72-0x00000000001D0000-0x0000000000732000-memory.dmp m00nd3v_logger - NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/1720-74-0x0000000002640000-0x00000000026B2000-memory.dmp MailPassView behavioral1/memory/1572-83-0x000000000041211A-mapping.dmp MailPassView behavioral1/memory/1572-82-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral1/memory/1572-85-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView - NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/memory/1720-74-0x0000000002640000-0x00000000026B2000-memory.dmp WebBrowserPassView behavioral1/memory/524-77-0x000000000044472E-mapping.dmp WebBrowserPassView behavioral1/memory/524-76-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral1/memory/524-80-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView - Nirsoft 7 IoCs
resource yara_rule behavioral1/memory/1720-74-0x0000000002640000-0x00000000026B2000-memory.dmp Nirsoft behavioral1/memory/524-77-0x000000000044472E-mapping.dmp Nirsoft behavioral1/memory/524-76-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral1/memory/524-80-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral1/memory/1572-83-0x000000000041211A-mapping.dmp Nirsoft behavioral1/memory/1572-82-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral1/memory/1572-85-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft - Executes dropped EXE 1 IoCs
pid Process 1064 urdavsa.pif - Loads dropped DLL 4 IoCs
pid Process 1268 E-Remittance Form_z.TXT.exe 1268 E-Remittance Form_z.TXT.exe 1268 E-Remittance Form_z.TXT.exe 1268 E-Remittance Form_z.TXT.exe - Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1064 set thread context of 1720 1064 urdavsa.pif 30 PID 1720 set thread context of 524 1720 RegSvcs.exe 32 PID 1720 set thread context of 1572 1720 RegSvcs.exe 34 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1064 urdavsa.pif 1720 RegSvcs.exe 1720 RegSvcs.exe 1720 RegSvcs.exe 1720 RegSvcs.exe 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 524 vbc.exe 524 vbc.exe 524 vbc.exe 524 vbc.exe 524 vbc.exe 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif 1064 urdavsa.pif - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1268 wrote to memory of 1064 1268 E-Remittance Form_z.TXT.exe 26 PID 1268 wrote to memory of 1064 1268 E-Remittance Form_z.TXT.exe 26 PID 1268 wrote to memory of 1064 1268 E-Remittance Form_z.TXT.exe 26 PID 1268 wrote to memory of 1064 1268 E-Remittance Form_z.TXT.exe 26 PID 1064 wrote to memory of 1720 1064 urdavsa.pif 30 PID 1064 wrote to memory of 1720 1064 urdavsa.pif 30 PID 1064 wrote to memory of 1720 1064 urdavsa.pif 30 PID 1064 wrote to memory of 1720 1064 urdavsa.pif 30 PID 1064 wrote to memory of 1720 1064 urdavsa.pif 30 PID 1064 wrote to memory of 1720 1064 urdavsa.pif 30 PID 1064 wrote to memory of 1720 1064 urdavsa.pif 30 PID 1064 wrote to memory of 1720 1064 urdavsa.pif 30 PID 1064 wrote to memory of 1720 1064 urdavsa.pif 30 PID 1720 wrote to memory of 524 1720 RegSvcs.exe 32 PID 1720 wrote to memory of 524 1720 RegSvcs.exe 32 PID 1720 wrote to memory of 524 1720 RegSvcs.exe 32 PID 1720 wrote to memory of 524 1720 RegSvcs.exe 32 PID 1720 wrote to memory of 524 1720 RegSvcs.exe 32 PID 1720 wrote to memory of 524 1720 RegSvcs.exe 32 PID 1720 wrote to memory of 524 1720 RegSvcs.exe 32 PID 1720 wrote to memory of 524 1720 RegSvcs.exe 32 PID 1720 wrote to memory of 524 1720 RegSvcs.exe 32 PID 1720 wrote to memory of 524 1720 RegSvcs.exe 32 PID 1720 wrote to memory of 1572 1720 RegSvcs.exe 34 PID 1720 wrote to memory of 1572 1720 RegSvcs.exe 34 PID 1720 wrote to memory of 1572 1720 RegSvcs.exe 34 PID 1720 wrote to memory of 1572 1720 RegSvcs.exe 34 PID 1720 wrote to memory of 1572 1720 RegSvcs.exe 34 PID 1720 wrote to memory of 1572 1720 RegSvcs.exe 34 PID 1720 wrote to memory of 1572 1720 RegSvcs.exe 34 PID 1720 wrote to memory of 1572 1720 RegSvcs.exe 34 PID 1720 wrote to memory of 1572 1720 RegSvcs.exe 34 PID 1720 wrote to memory of 1572 1720 RegSvcs.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\E-Remittance Form_z.TXT.exe"C:\Users\Admin\AppData\Local\Temp\E-Remittance Form_z.TXT.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\82139548\urdavsa.pif"C:\Users\Admin\AppData\Local\Temp\82139548\urdavsa.pif" rpgc.htg2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp94C1.tmp"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:524
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp9915.tmp"4⤵PID:1572
-
-
-