hawkeye_reborn | 49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d

General

Target

49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe
Size

1.0MB
MD5

a8ce97b006581f5df23ab2b23c2d0d18
SHA1

8f5b076487470b2ae6f8d51243315a14ded7da58
SHA256

49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d
SHA512

cd6f1c402a0ad2dd7688ed97fe67ba1374044eba85f4446f061db5a03bda5a7f597b3e73364bcc2cfe5c4affe6514cc6c5e49d14bcaba7597ba71beac44f7671

Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger Payload 4 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral1/memory/1180-57-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1180-58-0x000000000048B1CE-mapping.dmp	m00nd3v_logger
behavioral1/memory/1180-60-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1180-62-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1180-63-0x00000000008B0000-0x0000000000926000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 5 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/1180-63-0x00000000008B0000-0x0000000000926000-memory.dmp	WebBrowserPassView
behavioral1/memory/1128-74-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1128-75-0x000000000044472E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1128-78-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1128-79-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Nirsoft 5 IoCs

resource	yara_rule
behavioral1/memory/1180-63-0x00000000008B0000-0x0000000000926000-memory.dmp	Nirsoft
behavioral1/memory/1128-74-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1128-75-0x000000000044472E-mapping.dmp	Nirsoft
behavioral1/memory/1128-78-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1128-79-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1540 set thread context of 1180	1540	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	27
PID 1180 set thread context of 1128	1180	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	29

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1128	vbc.exe
1128	vbc.exe
1128	vbc.exe
1128	vbc.exe
1128	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1180	1540	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	27
PID 1540 wrote to memory of 1180	1540	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	27
PID 1540 wrote to memory of 1180	1540	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	27
PID 1540 wrote to memory of 1180	1540	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	27
PID 1540 wrote to memory of 1180	1540	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	27
PID 1540 wrote to memory of 1180	1540	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	27
PID 1540 wrote to memory of 1180	1540	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	27
PID 1540 wrote to memory of 1180	1540	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	27
PID 1540 wrote to memory of 1180	1540	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	27
PID 1180 wrote to memory of 1128	1180	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	29
PID 1180 wrote to memory of 1128	1180	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	29
PID 1180 wrote to memory of 1128	1180	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	29
PID 1180 wrote to memory of 1128	1180	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	29
PID 1180 wrote to memory of 1128	1180	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	29
PID 1180 wrote to memory of 1128	1180	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	29
PID 1180 wrote to memory of 1128	1180	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	29
PID 1180 wrote to memory of 1128	1180	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	29
PID 1180 wrote to memory of 1128	1180	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	29
PID 1180 wrote to memory of 1128	1180	49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe	29

C:\Users\Admin\AppData\Local\Temp\49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe
"C:\Users\Admin\AppData\Local\Temp\49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Users\Admin\AppData\Local\Temp\49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe
  "C:\Users\Admin\AppData\Local\Temp\49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp18CF.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp18CF.tmp

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/1128-66-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1128-65-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1128-68-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1128-79-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1128-70-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1128-78-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1128-72-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1128-74-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1180-62-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1180-60-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1180-57-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1180-63-0x00000000008B0000-0x0000000000926000-memory.dmp

Filesize
472KB

Download
memory/1540-54-0x0000000000940000-0x0000000000A4E000-memory.dmp

Filesize
1.1MB

Download
memory/1540-56-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/1540-55-0x0000000000490000-0x00000000004AE000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing