Malware Analysis Report

2025-01-18 02:43

Sample ID 210907-gwjt6sfcbl
Target 8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94
SHA256 8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94
Tags
hawkeye_reborn m00nd3v_logger agilenet keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94

Threat Level: Known bad

The file 8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94 was found to be: Known bad.

Malicious Activity Summary

hawkeye_reborn m00nd3v_logger agilenet keylogger persistence spyware stealer trojan

HawkEye Reborn

M00nd3v_Logger

M00nD3v Logger Payload

NirSoft MailPassView

NirSoft WebBrowserPassView

Nirsoft

Executes dropped EXE

Uses the VBS compiler for execution

Obfuscated with Agile.Net obfuscator

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-09-07 06:09

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-09-07 06:09

Reported

2021-09-07 06:10

Platform

win7-en

Max time network

6s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 10.0.0.1:67 udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2021-09-07 06:09

Reported

2021-09-07 06:12

Platform

win10-en

Max time kernel

138s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe"

Signatures

HawkEye Reborn

keylogger trojan stealer spyware hawkeye_reborn

M00nd3v_Logger

stealer spyware m00nd3v_logger

M00nD3v Logger Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\start.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\start.exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Local\\start.exe -boot" C:\Users\Admin\AppData\Local\start.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3764 set thread context of 2092 N/A C:\Users\Admin\AppData\Local\start.exe C:\Users\Admin\AppData\Local\start.exe
PID 2092 set thread context of 4032 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2092 set thread context of 4028 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\start.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\start.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\start.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3340 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe C:\Windows\SysWOW64\cmd.exe
PID 3340 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe C:\Windows\SysWOW64\cmd.exe
PID 3340 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe C:\Windows\SysWOW64\cmd.exe
PID 3340 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe C:\Windows\SysWOW64\explorer.exe
PID 3340 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe C:\Windows\SysWOW64\explorer.exe
PID 3340 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe C:\Windows\SysWOW64\explorer.exe
PID 3496 wrote to memory of 3764 N/A C:\Windows\explorer.exe C:\Users\Admin\AppData\Local\start.exe
PID 3496 wrote to memory of 3764 N/A C:\Windows\explorer.exe C:\Users\Admin\AppData\Local\start.exe
PID 3496 wrote to memory of 3764 N/A C:\Windows\explorer.exe C:\Users\Admin\AppData\Local\start.exe
PID 3764 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\start.exe C:\Users\Admin\AppData\Local\start.exe
PID 3764 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\start.exe C:\Users\Admin\AppData\Local\start.exe
PID 3764 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\start.exe C:\Users\Admin\AppData\Local\start.exe
PID 3764 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\start.exe C:\Users\Admin\AppData\Local\start.exe
PID 3764 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\start.exe C:\Users\Admin\AppData\Local\start.exe
PID 3764 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\start.exe C:\Users\Admin\AppData\Local\start.exe
PID 3764 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\start.exe C:\Users\Admin\AppData\Local\start.exe
PID 3764 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\start.exe C:\Users\Admin\AppData\Local\start.exe
PID 2092 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2092 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2092 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2092 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2092 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2092 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2092 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2092 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2092 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2092 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2092 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2092 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2092 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2092 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2092 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2092 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2092 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2092 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\start.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe

"C:\Users\Admin\AppData\Local\Temp\8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94.exe" "C:\Users\Admin\AppData\Local\start.exe"

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Local\start.exe"

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding

C:\Users\Admin\AppData\Local\start.exe

"C:\Users\Admin\AppData\Local\start.exe"

C:\Users\Admin\AppData\Local\start.exe

"C:\Users\Admin\AppData\Local\start.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpF62D.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp34D.tmp"

Network

Country Destination Domain Proto
US 34.117.59.81:443 tcp
US 172.67.132.120:80 tcp
US 172.67.195.219:443 tcp
US 8.8.8.8:53 smtp.zoho.com udp
US 136.143.182.56:587 smtp.zoho.com tcp

Files

memory/3340-115-0x0000000000C40000-0x0000000000C41000-memory.dmp

memory/3340-117-0x00000000079E0000-0x0000000007AD2000-memory.dmp

memory/3340-118-0x0000000007FE0000-0x0000000007FE1000-memory.dmp

memory/3340-119-0x0000000007B80000-0x0000000007B81000-memory.dmp

memory/3340-120-0x0000000005610000-0x000000000563A000-memory.dmp

memory/3340-121-0x0000000005640000-0x0000000005641000-memory.dmp

memory/3340-122-0x0000000005650000-0x0000000005651000-memory.dmp

memory/1908-123-0x0000000000000000-mapping.dmp

memory/2216-124-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\start.exe

MD5 0e569851a5caffd0924437714db46abe
SHA1 32fe45fbef9753d08978ad11a0001b29f032ba34
SHA256 8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94
SHA512 0229b9515e0bd71d7c4b2e5bc6a30dba5b69ba761bf20a1c4a32d112d563e758284b74ff067e0815dd8207dadd40d60292ad0d7998aa501017944949e32ae7a0

memory/3764-126-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\start.exe

MD5 0e569851a5caffd0924437714db46abe
SHA1 32fe45fbef9753d08978ad11a0001b29f032ba34
SHA256 8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94
SHA512 0229b9515e0bd71d7c4b2e5bc6a30dba5b69ba761bf20a1c4a32d112d563e758284b74ff067e0815dd8207dadd40d60292ad0d7998aa501017944949e32ae7a0

memory/3764-135-0x0000000005770000-0x0000000005771000-memory.dmp

memory/3764-136-0x000000000C490000-0x000000000C491000-memory.dmp

memory/2092-137-0x0000000000400000-0x0000000000490000-memory.dmp

C:\Users\Admin\AppData\Local\start.exe

MD5 0e569851a5caffd0924437714db46abe
SHA1 32fe45fbef9753d08978ad11a0001b29f032ba34
SHA256 8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94
SHA512 0229b9515e0bd71d7c4b2e5bc6a30dba5b69ba761bf20a1c4a32d112d563e758284b74ff067e0815dd8207dadd40d60292ad0d7998aa501017944949e32ae7a0

memory/2092-138-0x000000000048B1CE-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\start.exe.log

MD5 a12c47683d03ed3323264b06840fea15
SHA1 5dc1d35c839bdd64d084a83ca422ebf2038a1f94
SHA256 e70034847f32a07907bf1dc9575f1d38ba028191170a653fcb7a171703f674cc
SHA512 e695bceaf8f2242530ca7db10e377211b52d9378d40ff7e9c88fef491e5793f9122404a1e6f3151179fd5500ab1a094cfa372e03bce417614fe1948b67541778

memory/2092-143-0x0000000007740000-0x00000000077B2000-memory.dmp

memory/2092-146-0x0000000005150000-0x0000000005151000-memory.dmp

memory/2092-147-0x0000000005430000-0x0000000005431000-memory.dmp

memory/4032-148-0x0000000000400000-0x000000000045B000-memory.dmp

memory/4032-149-0x000000000044472E-mapping.dmp

memory/4032-150-0x0000000000400000-0x000000000045B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpF62D.tmp

MD5 c28d71a45b903e0c62f4a9a0a221cdd3
SHA1 f8235ed8002871df3d3af8a61e087efb87e2fc5e
SHA256 b7e7bd57d82a2d90e2c8e87435e93826a4093ac00a0215ec9e92e48c427e7089
SHA512 a187d8c8405ef017f819f39a8807105b78a33192b7b99d0366e7bacc07e49a3651491541dd123bbe1800dfc42d8c175340cb037a3bb9f916470891f9f966af7e

memory/4028-152-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4028-153-0x000000000041211A-mapping.dmp

memory/4028-154-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2092-156-0x0000000005E30000-0x0000000005E31000-memory.dmp