Analysis
- max time kernel
161s - max time network
168s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
16/05/2022, 12:58
General
- Target 49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe
- Size 1.0MB
- Sample220516-p7ptkacde7
- SHA256 49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d
Malware Config
Extracted
-
hawkeye_reborn
- fields
- name
Signatures
- HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
- M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
- M00nD3v Logger Payload 1 IoCs
Detects M00nD3v Logger payload in memory.
- NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
- Nirsoft 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe"C:\Users\Admin\AppData\Local\Temp\49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe"C:\Users\Admin\AppData\Local\Temp\49d828447e0e7fc82bc34b2ebc6c6189b218620ea1dd04050a38f7e23048f30d.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp8875.tmp"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/380-139-0x0000000000400000-0x000000000045B000-memory.dmp
memory/2024-136-0x0000000000400000-0x0000000000490000-memory.dmp
memory/2024-137-0x0000000005890000-0x00000000058F6000-memory.dmp
memory/3368-130-0x0000000000AF0000-0x0000000000BFE000-memory.dmp
memory/3368-131-0x0000000005B50000-0x00000000060F4000-memory.dmp
memory/3368-132-0x00000000055A0000-0x0000000005632000-memory.dmp
memory/3368-133-0x00000000057E0000-0x00000000057EA000-memory.dmp
memory/3368-134-0x0000000001250000-0x00000000012EC000-memory.dmp