hawkeye_reborn | 04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc

Analysis

max time kernel
149s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
27-05-2022 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe
Size

817KB
MD5

8d914bfb5f45b53628eb5e6956a696d2
SHA1

fb8e636a77c99f508f9193027bc5da24e712dabc
SHA256

04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc
SHA512

0c5e86dc0b39bd57566ee12c85ac7fb0418f5cc2fa1bcf5e39ee23f73368c76111c8688dd312cf16ab35d75ada5c21afee8b1874777a7b04e986f487de182db3

Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger Payload 9 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral1/memory/1692-80-0x0000000000400000-0x000000000053C000-memory.dmp	m00nd3v_logger
behavioral1/memory/1692-81-0x000000000048B1CE-mapping.dmp	m00nd3v_logger
behavioral1/memory/1692-84-0x0000000000400000-0x000000000053C000-memory.dmp	m00nd3v_logger
behavioral1/memory/1692-85-0x0000000000400000-0x000000000053C000-memory.dmp	m00nd3v_logger
behavioral1/memory/1692-86-0x0000000000402000-0x000000000048B200-memory.dmp	m00nd3v_logger
behavioral1/memory/1692-87-0x0000000000400000-0x000000000053C000-memory.dmp	m00nd3v_logger
behavioral1/memory/1692-88-0x0000000000400000-0x000000000053C000-memory.dmp	m00nd3v_logger
behavioral1/memory/1692-89-0x0000000000402000-0x000000000048B200-memory.dmp	m00nd3v_logger
behavioral1/memory/1692-96-0x0000000000400000-0x000000000053C000-memory.dmp	m00nd3v_logger

Loads dropped DLL 2 IoCs

pid	Process
1664	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe
1664	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1664 set thread context of 2032	1664	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	28
PID 2032 set thread context of 1692	2032	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
1436	taskkill.exe
1540	taskkill.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1692	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe
1692	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe
1692	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1692	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe
Token: SeDebugPrivilege	1436	taskkill.exe
Token: SeDebugPrivilege	1540	taskkill.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2032	1664	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	28
PID 1664 wrote to memory of 2032	1664	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	28
PID 1664 wrote to memory of 2032	1664	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	28
PID 1664 wrote to memory of 2032	1664	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	28
PID 1664 wrote to memory of 2032	1664	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	28
PID 1664 wrote to memory of 2032	1664	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	28
PID 1664 wrote to memory of 2032	1664	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	28
PID 1664 wrote to memory of 2032	1664	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	28
PID 1664 wrote to memory of 2032	1664	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	28
PID 1664 wrote to memory of 2032	1664	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	28
PID 2032 wrote to memory of 1692	2032	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	29
PID 2032 wrote to memory of 1692	2032	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	29
PID 2032 wrote to memory of 1692	2032	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	29
PID 2032 wrote to memory of 1692	2032	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	29
PID 2032 wrote to memory of 1692	2032	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	29
PID 2032 wrote to memory of 1692	2032	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	29
PID 2032 wrote to memory of 1692	2032	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	29
PID 2032 wrote to memory of 1692	2032	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	29
PID 2032 wrote to memory of 1692	2032	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	29
PID 2032 wrote to memory of 1692	2032	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	29
PID 2032 wrote to memory of 1692	2032	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	29
PID 1692 wrote to memory of 852	1692	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	30
PID 1692 wrote to memory of 852	1692	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	30
PID 1692 wrote to memory of 852	1692	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	30
PID 1692 wrote to memory of 852	1692	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	30
PID 1692 wrote to memory of 1656	1692	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	32
PID 1692 wrote to memory of 1656	1692	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	32
PID 1692 wrote to memory of 1656	1692	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	32
PID 1692 wrote to memory of 1656	1692	04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe	32
PID 852 wrote to memory of 1436	852	cmd.exe	34
PID 852 wrote to memory of 1436	852	cmd.exe	34
PID 852 wrote to memory of 1436	852	cmd.exe	34
PID 852 wrote to memory of 1436	852	cmd.exe	34
PID 1656 wrote to memory of 1540	1656	cmd.exe	35
PID 1656 wrote to memory of 1540	1656	cmd.exe	35
PID 1656 wrote to memory of 1540	1656	cmd.exe	35
PID 1656 wrote to memory of 1540	1656	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe
"C:\Users\Admin\AppData\Local\Temp\04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe
  "C:\Users\Admin\AppData\Local\Temp\04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Users\Admin\AppData\Local\Temp\04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe
    "C:\Users\Admin\AppData\Local\Temp\04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C TASKKILL /F /IM wscript.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:852
    - - C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /F /IM wscript.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C TASKKILL /F /IM cmd.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1656
    - - C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /F /IM cmd.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\bodements.dll

Filesize
84KB

MD5
a2f3f40061f165f5054336a90c78526f

SHA1
5a51d2e8cf374d90b615f026dc2ac9767558006c

SHA256
ce2b3ebba5b77665aeaf271b0c59c1a0cec1472585377cd5c74511dbedd76606

SHA512
f4304a99c9aa130225bb20ad3eb90f11ff790f022a2c8fbf80984b621d8752e7d4e59e27ae1c3cca9e4bfbd5137f084e26258ab948c6e066757ad5af3aa97093

Download Submit
\Users\Admin\AppData\Local\Temp\nsd64EC.tmp\System.dll

Filesize
11KB

MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
memory/1664-54-0x00000000754A1000-0x00000000754A3000-memory.dmp

Filesize
8KB

Download
memory/1664-57-0x0000000000480000-0x0000000000495000-memory.dmp

Filesize
84KB

Download
memory/1692-94-0x0000000072250000-0x0000000072E2E000-memory.dmp

Filesize
11.9MB

Download
memory/1692-87-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1692-103-0x0000000073DA0000-0x000000007453C000-memory.dmp

Filesize
7.6MB

Download
memory/1692-102-0x0000000072FC0000-0x0000000073AB8000-memory.dmp

Filesize
11.0MB

Download
memory/1692-70-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1692-72-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1692-74-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1692-76-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1692-77-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1692-78-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1692-80-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1692-84-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1692-85-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1692-86-0x0000000000402000-0x000000000048B200-memory.dmp

Filesize
548KB

Download
memory/1692-101-0x00000000746C0000-0x0000000074C6B000-memory.dmp

Filesize
5.7MB

Download
memory/1692-88-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1692-89-0x0000000000402000-0x000000000048B200-memory.dmp

Filesize
548KB

Download
memory/1692-90-0x00000000746C0000-0x0000000074C6B000-memory.dmp

Filesize
5.7MB

Download
memory/1692-91-0x0000000072FC0000-0x0000000073AB8000-memory.dmp

Filesize
11.0MB

Download
memory/1692-92-0x0000000073DA0000-0x000000007453C000-memory.dmp

Filesize
7.6MB

Download
memory/1692-93-0x0000000072E30000-0x0000000072FB8000-memory.dmp

Filesize
1.5MB

Download
memory/1692-96-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1692-95-0x00000000720B0000-0x000000007224B000-memory.dmp

Filesize
1.6MB

Download
memory/2032-64-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2032-62-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2032-61-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2032-59-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2032-58-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2032-69-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2032-66-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download