hawkeye_reborn | 8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94

General

Target

8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe
Size

773KB
MD5

0e569851a5caffd0924437714db46abe
SHA1

32fe45fbef9753d08978ad11a0001b29f032ba34
SHA256

8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94
SHA512

0229b9515e0bd71d7c4b2e5bc6a30dba5b69ba761bf20a1c4a32d112d563e758284b74ff067e0815dd8207dadd40d60292ad0d7998aa501017944949e32ae7a0

Score

10^/10

hawkeye_reborn m00nd3v_logger agilenet keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.zoho.com
Port:
587
Username:
zhuresult2018@zoho.com
Password:
OGOM12345

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger Payload 2 IoCs

Detects M00nD3v Logger payload in memory.

Processes:

resource	yara_rule
behavioral2/memory/2092-137-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral2/memory/2092-138-0x000000000048B1CE-mapping.dmp	m00nd3v_logger

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/2092-143-0x0000000007740000-0x00000000077B2000-memory.dmp	MailPassView
behavioral2/memory/4028-152-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4028-153-0x000000000041211A-mapping.dmp	MailPassView
behavioral2/memory/4028-154-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/2092-143-0x0000000007740000-0x00000000077B2000-memory.dmp	WebBrowserPassView
behavioral2/memory/4032-148-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/4032-149-0x000000000044472E-mapping.dmp	WebBrowserPassView
behavioral2/memory/4032-150-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2092-143-0x0000000007740000-0x00000000077B2000-memory.dmp	Nirsoft
behavioral2/memory/4032-148-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/4032-149-0x000000000044472E-mapping.dmp	Nirsoft
behavioral2/memory/4032-150-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/4028-152-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4028-153-0x000000000041211A-mapping.dmp	Nirsoft
behavioral2/memory/4028-154-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Executes dropped EXE 2 IoCs

Processes:

start.exestart.exe

pid process

3764 start.exe
2092 start.exe

pid	process
3764	start.exe
2092	start.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/3340-120-0x0000000005610000-0x000000000563A000-memory.dmp	agile_net

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

start.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Local\\start.exe -boot"	start.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

start.exestart.exe

description	pid	process	target process
PID 3764 set thread context of 2092	3764	start.exe	start.exe
PID 2092 set thread context of 4032	2092	start.exe	vbc.exe
PID 2092 set thread context of 4028	2092	start.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exestart.exevbc.exestart.exe

pid	process
3340	8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe
3764	start.exe
4032	vbc.exe
4032	vbc.exe
4032	vbc.exe
4032	vbc.exe
4032	vbc.exe
4032	vbc.exe
4032	vbc.exe
4032	vbc.exe
4032	vbc.exe
4032	vbc.exe
4032	vbc.exe
4032	vbc.exe
2092	start.exe
2092	start.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exestart.exestart.exe

description	pid	process
Token: SeDebugPrivilege	3340	8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe
Token: SeDebugPrivilege	3764	start.exe
Token: SeDebugPrivilege	2092	start.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

start.exe

pid process

2092 start.exe

pid	process
2092	start.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exeexplorer.exestart.exestart.exe

description	pid	process	target process
PID 3340 wrote to memory of 1908	3340	8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe	cmd.exe
PID 3340 wrote to memory of 1908	3340	8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe	cmd.exe
PID 3340 wrote to memory of 1908	3340	8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe	cmd.exe
PID 3340 wrote to memory of 2216	3340	8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe	explorer.exe
PID 3340 wrote to memory of 2216	3340	8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe	explorer.exe
PID 3340 wrote to memory of 2216	3340	8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe	explorer.exe
PID 3496 wrote to memory of 3764	3496	explorer.exe	start.exe
PID 3496 wrote to memory of 3764	3496	explorer.exe	start.exe
PID 3496 wrote to memory of 3764	3496	explorer.exe	start.exe
PID 3764 wrote to memory of 2092	3764	start.exe	start.exe
PID 3764 wrote to memory of 2092	3764	start.exe	start.exe
PID 3764 wrote to memory of 2092	3764	start.exe	start.exe
PID 3764 wrote to memory of 2092	3764	start.exe	start.exe
PID 3764 wrote to memory of 2092	3764	start.exe	start.exe
PID 3764 wrote to memory of 2092	3764	start.exe	start.exe
PID 3764 wrote to memory of 2092	3764	start.exe	start.exe
PID 3764 wrote to memory of 2092	3764	start.exe	start.exe
PID 2092 wrote to memory of 4032	2092	start.exe	vbc.exe
PID 2092 wrote to memory of 4032	2092	start.exe	vbc.exe
PID 2092 wrote to memory of 4032	2092	start.exe	vbc.exe
PID 2092 wrote to memory of 4032	2092	start.exe	vbc.exe
PID 2092 wrote to memory of 4032	2092	start.exe	vbc.exe
PID 2092 wrote to memory of 4032	2092	start.exe	vbc.exe
PID 2092 wrote to memory of 4032	2092	start.exe	vbc.exe
PID 2092 wrote to memory of 4032	2092	start.exe	vbc.exe
PID 2092 wrote to memory of 4032	2092	start.exe	vbc.exe
PID 2092 wrote to memory of 4028	2092	start.exe	vbc.exe
PID 2092 wrote to memory of 4028	2092	start.exe	vbc.exe
PID 2092 wrote to memory of 4028	2092	start.exe	vbc.exe
PID 2092 wrote to memory of 4028	2092	start.exe	vbc.exe
PID 2092 wrote to memory of 4028	2092	start.exe	vbc.exe
PID 2092 wrote to memory of 4028	2092	start.exe	vbc.exe
PID 2092 wrote to memory of 4028	2092	start.exe	vbc.exe
PID 2092 wrote to memory of 4028	2092	start.exe	vbc.exe
PID 2092 wrote to memory of 4028	2092	start.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe
"C:\Users\Admin\AppData\Local\Temp\8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe" "C:\Users\Admin\AppData\Local\start.exe"
2⤵
PID:1908

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Local\start.exe"
2⤵
PID:2216

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3496

C:\Users\Admin\AppData\Local\start.exe
"C:\Users\Admin\AppData\Local\start.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3764

C:\Users\Admin\AppData\Local\start.exe
"C:\Users\Admin\AppData\Local\start.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpF62D.tmp"
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4032

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp34D.tmp"
4⤵
PID:4028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\start.exe.log
MD5
a12c47683d03ed3323264b06840fea15

SHA1
5dc1d35c839bdd64d084a83ca422ebf2038a1f94

SHA256
e70034847f32a07907bf1dc9575f1d38ba028191170a653fcb7a171703f674cc

SHA512
e695bceaf8f2242530ca7db10e377211b52d9378d40ff7e9c88fef491e5793f9122404a1e6f3151179fd5500ab1a094cfa372e03bce417614fe1948b67541778

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF62D.tmp
MD5
c28d71a45b903e0c62f4a9a0a221cdd3

SHA1
f8235ed8002871df3d3af8a61e087efb87e2fc5e

SHA256
b7e7bd57d82a2d90e2c8e87435e93826a4093ac00a0215ec9e92e48c427e7089

SHA512
a187d8c8405ef017f819f39a8807105b78a33192b7b99d0366e7bacc07e49a3651491541dd123bbe1800dfc42d8c175340cb037a3bb9f916470891f9f966af7e

Download Submit
C:\Users\Admin\AppData\Local\start.exe
MD5
0e569851a5caffd0924437714db46abe

SHA1
32fe45fbef9753d08978ad11a0001b29f032ba34

SHA256
8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94

SHA512
0229b9515e0bd71d7c4b2e5bc6a30dba5b69ba761bf20a1c4a32d112d563e758284b74ff067e0815dd8207dadd40d60292ad0d7998aa501017944949e32ae7a0

Download Submit
C:\Users\Admin\AppData\Local\start.exe
MD5
0e569851a5caffd0924437714db46abe

SHA1
32fe45fbef9753d08978ad11a0001b29f032ba34

SHA256
8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94

SHA512
0229b9515e0bd71d7c4b2e5bc6a30dba5b69ba761bf20a1c4a32d112d563e758284b74ff067e0815dd8207dadd40d60292ad0d7998aa501017944949e32ae7a0

Download Submit
C:\Users\Admin\AppData\Local\start.exe
MD5
0e569851a5caffd0924437714db46abe

SHA1
32fe45fbef9753d08978ad11a0001b29f032ba34

SHA256
8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94

SHA512
0229b9515e0bd71d7c4b2e5bc6a30dba5b69ba761bf20a1c4a32d112d563e758284b74ff067e0815dd8207dadd40d60292ad0d7998aa501017944949e32ae7a0

Download Submit
memory/1908-123-0x0000000000000000-mapping.dmp

Download
memory/2092-137-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2092-138-0x000000000048B1CE-mapping.dmp

Download
memory/2092-146-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/2092-143-0x0000000007740000-0x00000000077B2000-memory.dmp

Filesize
456KB

Download
memory/2092-156-0x0000000005E30000-0x0000000005E31000-memory.dmp

Filesize
4KB

Download
memory/2092-147-0x0000000005430000-0x0000000005431000-memory.dmp

Filesize
4KB

Download
memory/2216-124-0x0000000000000000-mapping.dmp

Download
memory/3340-122-0x0000000005650000-0x0000000005651000-memory.dmp

Filesize
4KB

Download
memory/3340-117-0x00000000079E0000-0x0000000007AD2000-memory.dmp

Filesize
968KB

Download
memory/3340-115-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/3340-119-0x0000000007B80000-0x0000000007B81000-memory.dmp

Filesize
4KB

Download
memory/3340-120-0x0000000005610000-0x000000000563A000-memory.dmp

Filesize
168KB

Download
memory/3340-118-0x0000000007FE0000-0x0000000007FE1000-memory.dmp

Filesize
4KB

Download
memory/3340-121-0x0000000005640000-0x0000000005641000-memory.dmp

Filesize
4KB

Download
memory/3764-135-0x0000000005770000-0x0000000005771000-memory.dmp

Filesize
4KB

Download
memory/3764-136-0x000000000C490000-0x000000000C491000-memory.dmp

Filesize
4KB

Download
memory/3764-126-0x0000000000000000-mapping.dmp

Download
memory/4028-152-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4028-153-0x000000000041211A-mapping.dmp

Download
memory/4028-154-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4032-148-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4032-149-0x000000000044472E-mapping.dmp

Download
memory/4032-150-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads