General
-
Target
6d1d95ed0d6911495c2c91b757fec55f04544ab2ef8baa261be2821231b3aaba
-
Size
3.9MB
-
Sample
220604-vcchmsbgfm
-
MD5
c0fda04886ee7618b7e694c43975ef3d
-
SHA1
62d2276ed3e79835111e7fb5a455da6ec7fdbdb8
-
SHA256
6d1d95ed0d6911495c2c91b757fec55f04544ab2ef8baa261be2821231b3aaba
-
SHA512
492875d54185f3f24a5d34eb6d9a08bac3c6c82fdc07b19df4f238ee6141eb9f6ed87ccee2cd4aecd0de12377bac244ea59e68340d2058cda6cd3251b8d71a94
Static task
static1
Behavioral task
behavioral1
Sample
6d1d95ed0d6911495c2c91b757fec55f04544ab2ef8baa261be2821231b3aaba.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
6d1d95ed0d6911495c2c91b757fec55f04544ab2ef8baa261be2821231b3aaba.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
hawkeye_reborn
- fields
- name
Targets
-
-
Target
6d1d95ed0d6911495c2c91b757fec55f04544ab2ef8baa261be2821231b3aaba
-
Size
3.9MB
-
MD5
c0fda04886ee7618b7e694c43975ef3d
-
SHA1
62d2276ed3e79835111e7fb5a455da6ec7fdbdb8
-
SHA256
6d1d95ed0d6911495c2c91b757fec55f04544ab2ef8baa261be2821231b3aaba
-
SHA512
492875d54185f3f24a5d34eb6d9a08bac3c6c82fdc07b19df4f238ee6141eb9f6ed87ccee2cd4aecd0de12377bac244ea59e68340d2058cda6cd3251b8d71a94
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-