Malware Analysis Report

2025-01-18 02:38

Sample ID 220205-mzpsgsaghj
Target b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08
SHA256 b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08
Tags
hawkeye_reborn m00nd3v_logger collection keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08

Threat Level: Known bad

The file b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08 was found to be: Known bad.

Malicious Activity Summary

hawkeye_reborn m00nd3v_logger collection keylogger spyware stealer trojan

M00nd3v_Logger

HawkEye Reborn

M00nD3v Logger Payload

Reads user/profile data of web browsers

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in Windows directory

outlook_win_path

Suspicious use of AdjustPrivilegeToken

outlook_office_path

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-05 10:54

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-05 10:54

Reported

2022-02-05 10:57

Platform

win7-en-20211208

Max time kernel

139s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe"

Signatures

HawkEye Reborn

keylogger trojan stealer spyware hawkeye_reborn

M00nd3v_Logger

stealer spyware m00nd3v_logger

M00nD3v Logger Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A bot.whatismyipaddress.com N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 848 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe
PID 848 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe
PID 848 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe
PID 848 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe
PID 848 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe
PID 848 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe
PID 848 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe
PID 848 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe
PID 848 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe

"C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe"

C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe

"{path}"

Network

Country Destination Domain Proto
US 8.8.8.8:53 bot.whatismyipaddress.com udp

Files

memory/848-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

memory/848-55-0x0000000000370000-0x0000000000371000-memory.dmp

memory/848-56-0x0000000000371000-0x0000000000372000-memory.dmp

memory/1676-57-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1676-58-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1676-59-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1676-60-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1676-61-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1676-63-0x0000000000400000-0x00000000008B0000-memory.dmp

memory/1676-64-0x0000000000400000-0x00000000008B0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-05 10:54

Reported

2022-02-05 10:57

Platform

win10v2004-en-20220113

Max time kernel

135s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe"

Signatures

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\WindowsUpdate.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log C:\Windows\system32\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe

"C:\Users\Admin\AppData\Local\Temp\b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08.exe"

C:\Windows\SysWOW64\fondue.exe

"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll

C:\Windows\system32\FonDUE.EXE

"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

Network

Country Destination Domain Proto
IE 40.126.31.137:443 tcp
US 8.8.8.8:53 settings-win.data.microsoft.com udp
US 52.167.17.97:443 settings-win.data.microsoft.com tcp
US 52.167.17.97:443 settings-win.data.microsoft.com tcp
NL 104.110.191.140:80 tcp
NL 104.110.191.140:80 tcp
US 52.167.17.97:443 settings-win.data.microsoft.com tcp
US 52.167.17.97:443 settings-win.data.microsoft.com tcp
US 52.167.17.97:443 settings-win.data.microsoft.com tcp

Files

memory/2908-145-0x000002AF77FC0000-0x000002AF77FC4000-memory.dmp