hawkeye_reborn | 18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c

General

Target

18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe
Size

780KB
MD5

019a382b39aab63505bc3a03b46a91c3
SHA1

589989f06ac303cc88d1dc3f5478976894aa7ed3
SHA256

18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c
SHA512

b529266464fdfe08525ceaea14717be400f8ad070e95ca6abe59bdcedac090dbb945174310a7c7416c4ddc9a45dac5c82415eef65eee12eb9711c4f85854ad4a

Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger Payload 5 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

Processes:

resource	yara_rule
behavioral1/memory/1672-69-0x000000000048B1CE-mapping.dmp	m00nd3v_logger
behavioral1/memory/1672-71-0x0000000000080000-0x0000000000110000-memory.dmp	m00nd3v_logger
behavioral1/memory/1672-72-0x0000000000080000-0x0000000000110000-memory.dmp	m00nd3v_logger
behavioral1/memory/1672-76-0x0000000000080000-0x0000000000110000-memory.dmp	m00nd3v_logger
behavioral1/memory/1672-79-0x0000000000080000-0x0000000000110000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/1672-80-0x0000000000580000-0x00000000005F6000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 6 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/1672-80-0x0000000000580000-0x00000000005F6000-memory.dmp	WebBrowserPassView
behavioral1/memory/1192-91-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1192-92-0x000000000044472E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1192-95-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1192-96-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1192-97-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1672-80-0x0000000000580000-0x00000000005F6000-memory.dmp	Nirsoft
behavioral1/memory/1192-91-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1192-92-0x000000000044472E-mapping.dmp	Nirsoft
behavioral1/memory/1192-95-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1192-96-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1192-97-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft

Executes dropped EXE 2 IoCs

Processes:

AdobeAcrobat18.exeAdobeAcrobat18.exe

pid process

1800 AdobeAcrobat18.exe
1672 AdobeAcrobat18.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
1800	AdobeAcrobat18.exe
1672	AdobeAcrobat18.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

AdobeAcrobat18.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Acrobat 18 = "C:\\Users\\Admin\\AppData\\Local\\AdobeAcrobat18.exe -boot"	AdobeAcrobat18.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

AdobeAcrobat18.exeAdobeAcrobat18.exe

description	pid	process	target process
PID 1800 set thread context of 1672	1800	AdobeAcrobat18.exe	AdobeAcrobat18.exe
PID 1672 set thread context of 1192	1672	AdobeAcrobat18.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

vbc.exe

pid process

1192 vbc.exe
1192 vbc.exe
1192 vbc.exe
1192 vbc.exe
1192 vbc.exe

pid	process
1192	vbc.exe
1192	vbc.exe
1192	vbc.exe
1192	vbc.exe
1192	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exeAdobeAcrobat18.exe

description	pid	process
Token: SeDebugPrivilege	1352	18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe
Token: SeDebugPrivilege	1800	AdobeAcrobat18.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exeexplorer.exeAdobeAcrobat18.exeAdobeAcrobat18.exe

description	pid	process	target process
PID 1352 wrote to memory of 1092	1352	18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe	cmd.exe
PID 1352 wrote to memory of 1092	1352	18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe	cmd.exe
PID 1352 wrote to memory of 1092	1352	18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe	cmd.exe
PID 1352 wrote to memory of 1092	1352	18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe	cmd.exe
PID 1352 wrote to memory of 1836	1352	18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe	explorer.exe
PID 1352 wrote to memory of 1836	1352	18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe	explorer.exe
PID 1352 wrote to memory of 1836	1352	18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe	explorer.exe
PID 1352 wrote to memory of 1836	1352	18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe	explorer.exe
PID 668 wrote to memory of 1800	668	explorer.exe	AdobeAcrobat18.exe
PID 668 wrote to memory of 1800	668	explorer.exe	AdobeAcrobat18.exe
PID 668 wrote to memory of 1800	668	explorer.exe	AdobeAcrobat18.exe
PID 668 wrote to memory of 1800	668	explorer.exe	AdobeAcrobat18.exe
PID 1800 wrote to memory of 1672	1800	AdobeAcrobat18.exe	AdobeAcrobat18.exe
PID 1800 wrote to memory of 1672	1800	AdobeAcrobat18.exe	AdobeAcrobat18.exe
PID 1800 wrote to memory of 1672	1800	AdobeAcrobat18.exe	AdobeAcrobat18.exe
PID 1800 wrote to memory of 1672	1800	AdobeAcrobat18.exe	AdobeAcrobat18.exe
PID 1800 wrote to memory of 1672	1800	AdobeAcrobat18.exe	AdobeAcrobat18.exe
PID 1800 wrote to memory of 1672	1800	AdobeAcrobat18.exe	AdobeAcrobat18.exe
PID 1800 wrote to memory of 1672	1800	AdobeAcrobat18.exe	AdobeAcrobat18.exe
PID 1800 wrote to memory of 1672	1800	AdobeAcrobat18.exe	AdobeAcrobat18.exe
PID 1800 wrote to memory of 1672	1800	AdobeAcrobat18.exe	AdobeAcrobat18.exe
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	vbc.exe
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	vbc.exe
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	vbc.exe
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	vbc.exe
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	vbc.exe
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	vbc.exe
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	vbc.exe
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	vbc.exe
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	vbc.exe
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe
"C:\Users\Admin\AppData\Local\Temp\18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe" "C:\Users\Admin\AppData\Local\AdobeAcrobat18.exe"
2⤵
PID:1092

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Local\AdobeAcrobat18.exe"
2⤵
PID:1836

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:668

C:\Users\Admin\AppData\Local\AdobeAcrobat18.exe
"C:\Users\Admin\AppData\Local\AdobeAcrobat18.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800

C:\Users\Admin\AppData\Local\AdobeAcrobat18.exe
"C:\Users\Admin\AppData\Local\AdobeAcrobat18.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp7D8A.tmp"
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1192

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\AdobeAcrobat18.exe
Filesize
780KB

MD5
019a382b39aab63505bc3a03b46a91c3

SHA1
589989f06ac303cc88d1dc3f5478976894aa7ed3

SHA256
18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c

SHA512
b529266464fdfe08525ceaea14717be400f8ad070e95ca6abe59bdcedac090dbb945174310a7c7416c4ddc9a45dac5c82415eef65eee12eb9711c4f85854ad4a

Download Submit
C:\Users\Admin\AppData\Local\AdobeAcrobat18.exe
Filesize
780KB

MD5
019a382b39aab63505bc3a03b46a91c3

SHA1
589989f06ac303cc88d1dc3f5478976894aa7ed3

SHA256
18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c

SHA512
b529266464fdfe08525ceaea14717be400f8ad070e95ca6abe59bdcedac090dbb945174310a7c7416c4ddc9a45dac5c82415eef65eee12eb9711c4f85854ad4a

Download Submit
C:\Users\Admin\AppData\Local\AdobeAcrobat18.exe
Filesize
780KB

MD5
019a382b39aab63505bc3a03b46a91c3

SHA1
589989f06ac303cc88d1dc3f5478976894aa7ed3

SHA256
18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c

SHA512
b529266464fdfe08525ceaea14717be400f8ad070e95ca6abe59bdcedac090dbb945174310a7c7416c4ddc9a45dac5c82415eef65eee12eb9711c4f85854ad4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7D8A.tmp
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/668-62-0x000007FEFBCF1000-0x000007FEFBCF3000-memory.dmp

Filesize
8KB

Download
memory/1092-58-0x0000000000000000-mapping.dmp

Download
memory/1192-85-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1192-91-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1192-87-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1192-83-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1192-97-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1192-96-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1192-95-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1192-89-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1192-92-0x000000000044472E-mapping.dmp

Download
memory/1192-82-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1352-56-0x0000000000670000-0x0000000000692000-memory.dmp

Filesize
136KB

Download
memory/1352-57-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/1352-54-0x0000000001360000-0x000000000142C000-memory.dmp

Filesize
816KB

Download
memory/1352-55-0x0000000006E10000-0x0000000006F40000-memory.dmp

Filesize
1.2MB

Download
memory/1672-69-0x000000000048B1CE-mapping.dmp

Download
memory/1672-80-0x0000000000580000-0x00000000005F6000-memory.dmp

Filesize
472KB

Download
memory/1672-79-0x0000000000080000-0x0000000000110000-memory.dmp

Filesize
576KB

Download
memory/1672-76-0x0000000000080000-0x0000000000110000-memory.dmp

Filesize
576KB

Download
memory/1672-72-0x0000000000080000-0x0000000000110000-memory.dmp

Filesize
576KB

Download
memory/1672-71-0x0000000000080000-0x0000000000110000-memory.dmp

Filesize
576KB

Download
memory/1800-66-0x00000000001B0000-0x000000000027C000-memory.dmp

Filesize
816KB

Download
memory/1800-64-0x0000000000000000-mapping.dmp

Download
memory/1836-61-0x000000006FDC1000-0x000000006FDC3000-memory.dmp

Filesize
8KB

Download
memory/1836-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads