Malware Analysis Report

2025-01-18 02:38

Sample ID 220205-nys9ysbac2
Target a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e
SHA256 a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e
Tags
evasion trojan hawkeye_reborn keylogger rezer0 spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e

Threat Level: Known bad

The file a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e was found to be: Known bad.

Malicious Activity Summary

evasion trojan hawkeye_reborn keylogger rezer0 spyware stealer

Modifies Windows Defender Real-time Protection settings

HawkEye Reborn

Looks for VirtualBox Guest Additions in registry

ReZer0 packer

NirSoft MailPassView

Nirsoft

NirSoft WebBrowserPassView

Looks for VMWare Tools registry key

Windows security modification

Checks BIOS information in registry

Maps connected drives based on registry

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-05 11:48

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-05 11:48

Reported

2022-02-05 11:51

Platform

win10v2004-en-20220113

Max time kernel

18s

Max time network

68s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe

"C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell" Get-MpPreference -verbose

Network

Country Destination Domain Proto
US 8.8.8.8:53 settings-win.data.microsoft.com udp
NL 51.124.78.146:443 settings-win.data.microsoft.com tcp

Files

memory/4892-130-0x0000000000ED0000-0x0000000000F86000-memory.dmp

memory/4892-131-0x0000000005EC0000-0x0000000006464000-memory.dmp

memory/4892-132-0x00000000059B0000-0x0000000005A42000-memory.dmp

memory/4892-133-0x0000000005940000-0x000000000594A000-memory.dmp

memory/4892-134-0x0000000005910000-0x0000000005EB4000-memory.dmp

memory/4892-135-0x00000000091E0000-0x000000000927C000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-05 11:48

Reported

2022-02-05 11:51

Platform

win7-en-20211208

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe"

Signatures

HawkEye Reborn

keylogger trojan stealer spyware hawkeye_reborn

Modifies Windows Defender Real-time Protection settings

evasion trojan

Looks for VirtualBox Guest Additions in registry

evasion

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A

ReZer0 packer

rezer0
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VMWare Tools registry key

evasion

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A bot.whatismyipaddress.com N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1196 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1196 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1196 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1196 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1196 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Windows\SysWOW64\schtasks.exe
PID 1196 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Windows\SysWOW64\schtasks.exe
PID 1196 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Windows\SysWOW64\schtasks.exe
PID 1196 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Windows\SysWOW64\schtasks.exe
PID 1196 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe
PID 1196 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe
PID 1196 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe
PID 1196 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe
PID 1196 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe
PID 1196 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe
PID 1196 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe
PID 1196 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe
PID 1196 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe
PID 1196 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe
PID 1196 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe
PID 1196 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe
PID 1196 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe
PID 1196 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe
PID 1196 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe
PID 1196 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe
PID 1196 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe

"C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell" Get-MpPreference -verbose

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sTpIzWFY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3E18.tmp"

C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe

"{path}"

C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe

"{path}"

C:\Users\Admin\AppData\Local\Temp\a6cc097da2bee5d66e38a786047089065ad694607297795f7088847cdcb1643e.exe

"{path}"

Network

Country Destination Domain Proto
US 8.8.8.8:53 bot.whatismyipaddress.com udp

Files

memory/1196-54-0x0000000000CB0000-0x0000000000D66000-memory.dmp

memory/1196-55-0x0000000074B21000-0x0000000074B23000-memory.dmp

memory/1196-56-0x0000000004D50000-0x0000000004D51000-memory.dmp

memory/1196-57-0x0000000000360000-0x000000000036A000-memory.dmp

memory/1196-58-0x0000000005CC0000-0x0000000005D58000-memory.dmp

memory/1204-62-0x0000000002160000-0x0000000002420000-memory.dmp

memory/1204-63-0x0000000002160000-0x0000000002420000-memory.dmp

memory/1204-64-0x0000000002160000-0x0000000002420000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp3E18.tmp

MD5 2b9478587e55cfebac889c3f7ac75d89
SHA1 a87882bb44e2de5e5a04c52c0dcfefc210fb74bb
SHA256 a4dd2c7f4748321bb8149de70049000dd235ecc1e6aaede0249df9ce073876c1
SHA512 058ad362c3c49b32c00adb1702a1ba96c384b18d6dbf433b75c9f1b86e44c67cdc047ae86d3e8ac27c08ef49c06a733edc5013139d68202f6aba26fde993f34b

memory/1376-66-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1376-67-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1376-69-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1376-68-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1376-70-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1376-71-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1376-72-0x0000000000970000-0x00000000009E6000-memory.dmp

memory/1376-73-0x0000000004B40000-0x0000000004B41000-memory.dmp