Overview

overview

10

Static

static

T.HALK BAN...df.exe

windows7_x64

10

T.HALK BAN...df.exe

windows10-2004_x64

4

Analysis

  • max time kernel
    84s
  • max time network
    26s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    05-02-2022 13:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    T.HALK BANKASI A.S. 03.12.2020 - 04.06.2020 Hesap Ekstresi.pdf.exe

  • Size

    811KB

  • MD5

    826de0fd25130a7c0a79cb47d1cd10d1

  • SHA1

    1d6cd2a23a0f9d17bf7481bd8380fa500deff528

  • SHA256

    75bdc371b036b0305280360996f8b060f89b1aa6e840f0fd96afd2bfba151104

  • SHA512

    1aff7e3b627b0dc60ae9b917347c06f0d2cf23f5f79a6a816e296ac85d10ed15e47b8ee874d5a0b9a7d3ee9e3b159b5b22c169fae382651fb7a8deacf6605dae

Score
10/10
hawkeye_rebornm00nd3v_loggerkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.1.0.0

Credentials

  • Protocol:     smtp
  • Host:
    mail.3enaluminyum.com.tr
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    3En13579?
Mutex

ed15539e-ec4f-4f66-b9c5-28b585b59447

Attributes
  • fields

    map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:3En13579? _EmailPort:587 _EmailSSL:true _EmailServer:mail.3enaluminyum.com.tr _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:ed15539e-ec4f-4f66-b9c5-28b585b59447 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.1.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]

  • name

    HawkEye Keylogger - RebornX, Version=10.1.0.0, Culture=neutral, PublicKeyToken=null

Signatures

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn
  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger
  • M00nD3v Logger Payload 3 IoCs

    Detects M00nD3v Logger payload in memory.

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\T.HALK BANKASI A.S. 03.12.2020 - 04.06.2020 Hesap Ekstresi.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\T.HALK BANKASI A.S. 03.12.2020 - 04.06.2020 Hesap Ekstresi.pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Users\Admin\AppData\Local\Temp\T.HALK BANKASI A.S. 03.12.2020 - 04.06.2020 Hesap Ekstresi.pdf.exe
      "{path}"
      2⤵
        PID:1612
      • C:\Users\Admin\AppData\Local\Temp\T.HALK BANKASI A.S. 03.12.2020 - 04.06.2020 Hesap Ekstresi.pdf.exe
        "{path}"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1540
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp35A.tmp"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1072

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp35A.tmp
      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

      Download Submit

    • memory/1072-64-0x0000000000400000-0x0000000000477000-memory.dmp

      Filesize

      476KB

      Download

    • memory/1072-71-0x0000000000400000-0x0000000000477000-memory.dmp

      Filesize

      476KB

      Download

    • memory/1072-69-0x0000000000400000-0x0000000000477000-memory.dmp

      Filesize

      476KB

      Download

    • memory/1072-68-0x0000000000400000-0x0000000000477000-memory.dmp

      Filesize

      476KB

      Download

    • memory/1072-67-0x0000000000400000-0x0000000000477000-memory.dmp

      Filesize

      476KB

      Download

    • memory/1072-65-0x0000000000400000-0x0000000000477000-memory.dmp

      Filesize

      476KB

      Download

    • memory/1072-66-0x0000000000400000-0x0000000000477000-memory.dmp

      Filesize

      476KB

      Download

    • memory/1540-57-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB

      Download

    • memory/1540-60-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB

      Download

    • memory/1540-63-0x0000000002180000-0x0000000002181000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1540-59-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB

      Download

    • memory/1540-58-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB

      Download

    • memory/1540-56-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB

      Download

    • memory/1540-75-0x0000000002181000-0x0000000002182000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2024-61-0x00000000006C1000-0x00000000006C2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2024-54-0x0000000076071000-0x0000000076073000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2024-55-0x00000000006C0000-0x00000000006C1000-memory.dmp

      Filesize

      4KB

      Download