Analysis
-
max time kernel
138s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en -
submitted
07-09-2021 06:09
Static task
static1
Behavioral task
behavioral1
Sample
8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe
Resource
win7-en
Behavioral task
behavioral2
Sample
8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe
Resource
win10-en
General
-
Target
8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe
-
Size
773KB
-
MD5
0e569851a5caffd0924437714db46abe
-
SHA1
32fe45fbef9753d08978ad11a0001b29f032ba34
-
SHA256
8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94
-
SHA512
0229b9515e0bd71d7c4b2e5bc6a30dba5b69ba761bf20a1c4a32d112d563e758284b74ff067e0815dd8207dadd40d60292ad0d7998aa501017944949e32ae7a0
Malware Config
Extracted
Protocol: smtp- Host:
smtp.zoho.com - Port:
587 - Username:
[email protected] - Password:
OGOM12345
Extracted
hawkeye_reborn
- fields
- name
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
M00nD3v Logger Payload 2 IoCs
Detects M00nD3v Logger payload in memory.
resource yara_rule behavioral2/memory/2092-137-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger behavioral2/memory/2092-138-0x000000000048B1CE-mapping.dmp m00nd3v_logger -
NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/2092-143-0x0000000007740000-0x00000000077B2000-memory.dmp MailPassView behavioral2/memory/4028-152-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/4028-153-0x000000000041211A-mapping.dmp MailPassView behavioral2/memory/4028-154-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/2092-143-0x0000000007740000-0x00000000077B2000-memory.dmp WebBrowserPassView behavioral2/memory/4032-148-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/4032-149-0x000000000044472E-mapping.dmp WebBrowserPassView behavioral2/memory/4032-150-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
resource yara_rule behavioral2/memory/2092-143-0x0000000007740000-0x00000000077B2000-memory.dmp Nirsoft behavioral2/memory/4032-148-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/4032-149-0x000000000044472E-mapping.dmp Nirsoft behavioral2/memory/4032-150-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/4028-152-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/4028-153-0x000000000041211A-mapping.dmp Nirsoft behavioral2/memory/4028-154-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft -
Executes dropped EXE 2 IoCs
pid Process 3764 start.exe 2092 start.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral2/memory/3340-120-0x0000000005610000-0x000000000563A000-memory.dmp agile_net -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Local\\start.exe -boot" start.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3764 set thread context of 2092 3764 start.exe 85 PID 2092 set thread context of 4032 2092 start.exe 87 PID 2092 set thread context of 4028 2092 start.exe 88 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3340 8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe 3764 start.exe 4032 vbc.exe 4032 vbc.exe 4032 vbc.exe 4032 vbc.exe 4032 vbc.exe 4032 vbc.exe 4032 vbc.exe 4032 vbc.exe 4032 vbc.exe 4032 vbc.exe 4032 vbc.exe 4032 vbc.exe 2092 start.exe 2092 start.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3340 8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe Token: SeDebugPrivilege 3764 start.exe Token: SeDebugPrivilege 2092 start.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2092 start.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 3340 wrote to memory of 1908 3340 8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe 78 PID 3340 wrote to memory of 1908 3340 8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe 78 PID 3340 wrote to memory of 1908 3340 8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe 78 PID 3340 wrote to memory of 2216 3340 8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe 81 PID 3340 wrote to memory of 2216 3340 8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe 81 PID 3340 wrote to memory of 2216 3340 8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe 81 PID 3496 wrote to memory of 3764 3496 explorer.exe 83 PID 3496 wrote to memory of 3764 3496 explorer.exe 83 PID 3496 wrote to memory of 3764 3496 explorer.exe 83 PID 3764 wrote to memory of 2092 3764 start.exe 85 PID 3764 wrote to memory of 2092 3764 start.exe 85 PID 3764 wrote to memory of 2092 3764 start.exe 85 PID 3764 wrote to memory of 2092 3764 start.exe 85 PID 3764 wrote to memory of 2092 3764 start.exe 85 PID 3764 wrote to memory of 2092 3764 start.exe 85 PID 3764 wrote to memory of 2092 3764 start.exe 85 PID 3764 wrote to memory of 2092 3764 start.exe 85 PID 2092 wrote to memory of 4032 2092 start.exe 87 PID 2092 wrote to memory of 4032 2092 start.exe 87 PID 2092 wrote to memory of 4032 2092 start.exe 87 PID 2092 wrote to memory of 4032 2092 start.exe 87 PID 2092 wrote to memory of 4032 2092 start.exe 87 PID 2092 wrote to memory of 4032 2092 start.exe 87 PID 2092 wrote to memory of 4032 2092 start.exe 87 PID 2092 wrote to memory of 4032 2092 start.exe 87 PID 2092 wrote to memory of 4032 2092 start.exe 87 PID 2092 wrote to memory of 4028 2092 start.exe 88 PID 2092 wrote to memory of 4028 2092 start.exe 88 PID 2092 wrote to memory of 4028 2092 start.exe 88 PID 2092 wrote to memory of 4028 2092 start.exe 88 PID 2092 wrote to memory of 4028 2092 start.exe 88 PID 2092 wrote to memory of 4028 2092 start.exe 88 PID 2092 wrote to memory of 4028 2092 start.exe 88 PID 2092 wrote to memory of 4028 2092 start.exe 88 PID 2092 wrote to memory of 4028 2092 start.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe"C:\Users\Admin\AppData\Local\Temp\8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe" "C:\Users\Admin\AppData\Local\start.exe"2⤵PID:1908
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Local\start.exe"2⤵PID:2216
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\start.exe"C:\Users\Admin\AppData\Local\start.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\start.exe"C:\Users\Admin\AppData\Local\start.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpF62D.tmp"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4032
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp34D.tmp"4⤵PID:4028
-
-
-