Malware Analysis Report

2025-01-18 02:37

Sample ID 220205-rjhfpacba7
Target 765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28
SHA256 765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28
Tags
hawkeye_reborn m00nd3v_logger keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28

Threat Level: Known bad

The file 765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28 was found to be: Known bad.

Malicious Activity Summary

hawkeye_reborn m00nd3v_logger keylogger spyware stealer trojan

HawkEye Reborn

M00nd3v_Logger

NirSoft WebBrowserPassView

Nirsoft

M00nD3v Logger Payload

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-05 14:13

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-05 14:13

Reported

2022-02-05 14:15

Platform

win7-en-20211208

Max time kernel

151s

Max time network

21s

Command Line

"C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe"

Signatures

HawkEye Reborn

keylogger trojan stealer spyware hawkeye_reborn

M00nd3v_Logger

stealer spyware m00nd3v_logger

M00nD3v Logger Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1364 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Windows\SysWOW64\schtasks.exe
PID 1364 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Windows\SysWOW64\schtasks.exe
PID 1364 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Windows\SysWOW64\schtasks.exe
PID 1364 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Windows\SysWOW64\schtasks.exe
PID 1364 wrote to memory of 360 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe
PID 1364 wrote to memory of 360 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe
PID 1364 wrote to memory of 360 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe
PID 1364 wrote to memory of 360 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe
PID 1364 wrote to memory of 360 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe
PID 1364 wrote to memory of 360 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe
PID 1364 wrote to memory of 360 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe
PID 1364 wrote to memory of 360 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe
PID 1364 wrote to memory of 360 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe
PID 360 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 360 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 360 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 360 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 360 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 360 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 360 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 360 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 360 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 360 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe

"C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TVjqoIDJDbw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFD13.tmp"

C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe

"C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp2F49.tmp"

Network

N/A

Files

memory/1364-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

memory/1364-55-0x0000000000C60000-0x0000000000C61000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpFD13.tmp

MD5 3476c9bd8a576a0d1210c4167f9e49c5
SHA1 3c23eea054ffb5498bf138d79a4e345710b90441
SHA256 5172c529a0ec264426550a3a3199921e7189c2c06d1804bd91052732ee9dbd3c
SHA512 fa44625a0d2053f73b316e86a9efc2cb64ced4c512c908f35b4ae3f114b5da987328096e7f29b3f05776f77bf96c82bc3d2f09d51e7953ee67520bda535a5852

memory/360-58-0x0000000000080000-0x0000000000110000-memory.dmp

memory/360-59-0x0000000000080000-0x0000000000110000-memory.dmp

memory/360-60-0x0000000000080000-0x0000000000110000-memory.dmp

memory/360-61-0x0000000000080000-0x0000000000110000-memory.dmp

memory/360-64-0x0000000000080000-0x0000000000110000-memory.dmp

memory/360-67-0x0000000000080000-0x0000000000110000-memory.dmp

memory/360-70-0x0000000000080000-0x0000000000110000-memory.dmp

memory/360-72-0x00000000001A0000-0x00000000001A1000-memory.dmp

memory/1220-73-0x0000000000400000-0x000000000045B000-memory.dmp

memory/1220-74-0x0000000000400000-0x000000000045B000-memory.dmp

memory/1220-75-0x0000000000400000-0x000000000045B000-memory.dmp

memory/1220-76-0x0000000000400000-0x000000000045B000-memory.dmp

memory/1220-77-0x0000000000400000-0x000000000045B000-memory.dmp

memory/1220-78-0x0000000000400000-0x000000000045B000-memory.dmp

memory/1220-80-0x0000000000400000-0x000000000045B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp2F49.tmp

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-05 14:13

Reported

2022-02-05 14:15

Platform

win10v2004-en-20220113

Max time kernel

142s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe"

Signatures

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\WindowsUpdate.log C:\Windows\system32\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe

"C:\Users\Admin\AppData\Local\Temp\765fffe2f974776a9a92361d7ba6cb0cc206777c96b8090cedf7db22cdf0ac28.exe"

C:\Windows\SysWOW64\fondue.exe

"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll

C:\Windows\system32\FonDUE.EXE

"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

Network

Country Destination Domain Proto
US 8.8.8.8:53 settings-win.data.microsoft.com udp
US 52.167.17.97:443 settings-win.data.microsoft.com tcp
US 52.167.17.97:443 settings-win.data.microsoft.com tcp
US 8.8.8.8:53 settings-win.data.microsoft.com udp
US 52.167.249.196:443 settings-win.data.microsoft.com tcp
US 52.167.249.196:443 settings-win.data.microsoft.com tcp
US 52.167.249.196:443 settings-win.data.microsoft.com tcp
NL 178.79.208.1:80 tcp
NL 178.79.208.1:80 tcp

Files

memory/744-143-0x0000017B3B740000-0x0000017B3B744000-memory.dmp