hawkeye_reborn | 18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c

Analysis

max time kernel
151s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
08/06/2022, 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe
Size

780KB
MD5

019a382b39aab63505bc3a03b46a91c3
SHA1

589989f06ac303cc88d1dc3f5478976894aa7ed3
SHA256

18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c
SHA512

b529266464fdfe08525ceaea14717be400f8ad070e95ca6abe59bdcedac090dbb945174310a7c7416c4ddc9a45dac5c82415eef65eee12eb9711c4f85854ad4a

Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger Payload 5 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral1/memory/1672-69-0x000000000048B1CE-mapping.dmp	m00nd3v_logger
behavioral1/memory/1672-71-0x0000000000080000-0x0000000000110000-memory.dmp	m00nd3v_logger
behavioral1/memory/1672-72-0x0000000000080000-0x0000000000110000-memory.dmp	m00nd3v_logger
behavioral1/memory/1672-76-0x0000000000080000-0x0000000000110000-memory.dmp	m00nd3v_logger
behavioral1/memory/1672-79-0x0000000000080000-0x0000000000110000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1672-80-0x0000000000580000-0x00000000005F6000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 6 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/1672-80-0x0000000000580000-0x00000000005F6000-memory.dmp	WebBrowserPassView
behavioral1/memory/1192-91-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1192-92-0x000000000044472E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1192-95-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1192-96-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1192-97-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

resource	yara_rule
behavioral1/memory/1672-80-0x0000000000580000-0x00000000005F6000-memory.dmp	Nirsoft
behavioral1/memory/1192-91-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1192-92-0x000000000044472E-mapping.dmp	Nirsoft
behavioral1/memory/1192-95-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1192-96-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1192-97-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft

Executes dropped EXE 2 IoCs

pid	Process
1800	AdobeAcrobat18.exe
1672	AdobeAcrobat18.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Acrobat 18 = "C:\\Users\\Admin\\AppData\\Local\\AdobeAcrobat18.exe -boot"	AdobeAcrobat18.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1800 set thread context of 1672	1800	AdobeAcrobat18.exe	32
PID 1672 set thread context of 1192	1672	AdobeAcrobat18.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1192	vbc.exe
1192	vbc.exe
1192	vbc.exe
1192	vbc.exe
1192	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1352	18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe
Token: SeDebugPrivilege	1800	AdobeAcrobat18.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1092	1352	18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe	27
PID 1352 wrote to memory of 1092	1352	18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe	27
PID 1352 wrote to memory of 1092	1352	18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe	27
PID 1352 wrote to memory of 1092	1352	18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe	27
PID 1352 wrote to memory of 1836	1352	18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe	29
PID 1352 wrote to memory of 1836	1352	18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe	29
PID 1352 wrote to memory of 1836	1352	18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe	29
PID 1352 wrote to memory of 1836	1352	18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe	29
PID 668 wrote to memory of 1800	668	explorer.exe	31
PID 668 wrote to memory of 1800	668	explorer.exe	31
PID 668 wrote to memory of 1800	668	explorer.exe	31
PID 668 wrote to memory of 1800	668	explorer.exe	31
PID 1800 wrote to memory of 1672	1800	AdobeAcrobat18.exe	32
PID 1800 wrote to memory of 1672	1800	AdobeAcrobat18.exe	32
PID 1800 wrote to memory of 1672	1800	AdobeAcrobat18.exe	32
PID 1800 wrote to memory of 1672	1800	AdobeAcrobat18.exe	32
PID 1800 wrote to memory of 1672	1800	AdobeAcrobat18.exe	32
PID 1800 wrote to memory of 1672	1800	AdobeAcrobat18.exe	32
PID 1800 wrote to memory of 1672	1800	AdobeAcrobat18.exe	32
PID 1800 wrote to memory of 1672	1800	AdobeAcrobat18.exe	32
PID 1800 wrote to memory of 1672	1800	AdobeAcrobat18.exe	32
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	34
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	34
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	34
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	34
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	34
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	34
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	34
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	34
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	34
PID 1672 wrote to memory of 1192	1672	AdobeAcrobat18.exe	34

C:\Users\Admin\AppData\Local\Temp\18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe
"C:\Users\Admin\AppData\Local\Temp\18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c.exe" "C:\Users\Admin\AppData\Local\AdobeAcrobat18.exe"
  2⤵
  PID:1092
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Local\AdobeAcrobat18.exe"
  2⤵
  PID:1836

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:668
- C:\Users\Admin\AppData\Local\AdobeAcrobat18.exe
  "C:\Users\Admin\AppData\Local\AdobeAcrobat18.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Users\Admin\AppData\Local\AdobeAcrobat18.exe
    "C:\Users\Admin\AppData\Local\AdobeAcrobat18.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp7D8A.tmp"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\AdobeAcrobat18.exe

Filesize
780KB

MD5
019a382b39aab63505bc3a03b46a91c3

SHA1
589989f06ac303cc88d1dc3f5478976894aa7ed3

SHA256
18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c

SHA512
b529266464fdfe08525ceaea14717be400f8ad070e95ca6abe59bdcedac090dbb945174310a7c7416c4ddc9a45dac5c82415eef65eee12eb9711c4f85854ad4a

Download Submit
C:\Users\Admin\AppData\Local\AdobeAcrobat18.exe

Filesize
780KB

MD5
019a382b39aab63505bc3a03b46a91c3

SHA1
589989f06ac303cc88d1dc3f5478976894aa7ed3

SHA256
18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c

SHA512
b529266464fdfe08525ceaea14717be400f8ad070e95ca6abe59bdcedac090dbb945174310a7c7416c4ddc9a45dac5c82415eef65eee12eb9711c4f85854ad4a

Download Submit
C:\Users\Admin\AppData\Local\AdobeAcrobat18.exe

Filesize
780KB

MD5
019a382b39aab63505bc3a03b46a91c3

SHA1
589989f06ac303cc88d1dc3f5478976894aa7ed3

SHA256
18c9c79af4ab40c95b609b7d2bdb5fbba7f18ca875941ccce16e71e99cf7604c

SHA512
b529266464fdfe08525ceaea14717be400f8ad070e95ca6abe59bdcedac090dbb945174310a7c7416c4ddc9a45dac5c82415eef65eee12eb9711c4f85854ad4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7D8A.tmp

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/668-62-0x000007FEFBCF1000-0x000007FEFBCF3000-memory.dmp

Filesize
8KB

Download
memory/1192-85-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1192-91-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1192-87-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1192-83-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1192-97-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1192-96-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1192-95-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1192-89-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1192-82-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1352-56-0x0000000000670000-0x0000000000692000-memory.dmp

Filesize
136KB

Download
memory/1352-57-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/1352-54-0x0000000001360000-0x000000000142C000-memory.dmp

Filesize
816KB

Download
memory/1352-55-0x0000000006E10000-0x0000000006F40000-memory.dmp

Filesize
1.2MB

Download
memory/1672-80-0x0000000000580000-0x00000000005F6000-memory.dmp

Filesize
472KB

Download
memory/1672-79-0x0000000000080000-0x0000000000110000-memory.dmp

Filesize
576KB

Download
memory/1672-76-0x0000000000080000-0x0000000000110000-memory.dmp

Filesize
576KB

Download
memory/1672-72-0x0000000000080000-0x0000000000110000-memory.dmp

Filesize
576KB

Download
memory/1672-71-0x0000000000080000-0x0000000000110000-memory.dmp

Filesize
576KB

Download
memory/1800-66-0x00000000001B0000-0x000000000027C000-memory.dmp

Filesize
816KB

Download
memory/1836-61-0x000000006FDC1000-0x000000006FDC3000-memory.dmp

Filesize
8KB

Download