hawkeye_reborn | 1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449

General

Target

1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449.exe
Size

878KB
MD5

3e79df1bd7f679a54a47c6bca00aca9e
SHA1

289dfbff64c3912dccda857cae04f3c5c3c1d221
SHA256

1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449
SHA512

7fbfd83ba85eb5615d116d2226ae8b8691d0f8a6bcd534873f4681c8cac103e8390f9b877371001f0cb5556ae68372e7b5e40c9fb9c26a83d8cef7a9685f0007

Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger Payload 1 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral2/memory/684-134-0x0000000000400000-0x00000000004A4000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/684-134-0x0000000000400000-0x00000000004A4000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/684-134-0x0000000000400000-0x00000000004A4000-memory.dmp	WebBrowserPassView

Nirsoft 1 IoCs

resource	yara_rule
behavioral2/memory/684-134-0x0000000000400000-0x00000000004A4000-memory.dmp	Nirsoft

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2208 set thread context of 684	2208	1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449.exe	77

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449.exe
Token: SeDebugPrivilege	684	1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 684	2208	1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449.exe	77
PID 2208 wrote to memory of 684	2208	1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449.exe	77
PID 2208 wrote to memory of 684	2208	1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449.exe	77
PID 2208 wrote to memory of 684	2208	1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449.exe	77
PID 2208 wrote to memory of 684	2208	1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449.exe	77
PID 2208 wrote to memory of 684	2208	1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449.exe	77
PID 2208 wrote to memory of 684	2208	1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449.exe	77
PID 2208 wrote to memory of 684	2208	1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449.exe	77

C:\Users\Admin\AppData\Local\Temp\1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449.exe
"C:\Users\Admin\AppData\Local\Temp\1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449.exe
  "C:\Users\Admin\AppData\Local\Temp\1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1363179794d9442bd5a5d430c1d1192e22662adebee044ba1b45f2187d4de449.exe.log

Filesize
321B

MD5
baf5d1398fdb79e947b60fe51e45397f

SHA1
49e7b8389f47b93509d621b8030b75e96bb577af

SHA256
10c8c7b5fa58f8c6b69f44e92a4e2af111b59fcf4f21a07e04b19e14876ccdf8

SHA512
b2c9ef5581d5eae7c17ae260fe9f52344ed737fa851cb44d1cea58a32359d0ac5d0ca3099c970209bd30a0d4af6e504101f21b7054cf5eca91c0831cf12fb413

Download Submit
memory/684-134-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/684-136-0x0000000000B80000-0x0000000000C60000-memory.dmp

Filesize
896KB

Download
memory/684-137-0x0000000005830000-0x00000000058CC000-memory.dmp

Filesize
624KB

Download
memory/684-138-0x0000000000B80000-0x0000000000C60000-memory.dmp

Filesize
896KB

Download
memory/684-139-0x00000000057A0000-0x0000000005806000-memory.dmp

Filesize
408KB

Download
memory/684-140-0x0000000006630000-0x00000000066C2000-memory.dmp

Filesize
584KB

Download
memory/2208-130-0x00000000009E0000-0x0000000000AC0000-memory.dmp

Filesize
896KB

Download
memory/2208-131-0x00000000009E0000-0x0000000000AC0000-memory.dmp

Filesize
896KB

Download
memory/2208-132-0x0000000008100000-0x00000000086A4000-memory.dmp

Filesize
5.6MB

Download
memory/2208-135-0x00000000009E0000-0x0000000000AC0000-memory.dmp

Filesize
896KB

Download

Analysis

Sharing