Analysis
-
max time kernel
168s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-06-2022 20:14
General
-
Target
1eb603543508b94ba5fb2850c69ddc3334dbf4608a42be8f37ee1bad5ff5a99b.exe
-
Size
681KB
-
MD5
c7209681512b57a936c231434cc169d7
-
SHA1
41d22efdbdc278ee8b3240afe9598eb4500c600c
-
SHA256
1eb603543508b94ba5fb2850c69ddc3334dbf4608a42be8f37ee1bad5ff5a99b
-
SHA512
daabc59bd349268a131452363a4ac41ad459a616f0e03475a5e57e2eb3577029a757d6f87422b4b6ba45df6630f88b944b3999f66f3fe68614f78c0114b854e7
Malware Config
Extracted
hawkeye_reborn
9.0.1.6
Protocol: smtp- Host:
mail.oppobihar.in - Port:
587 - Username:
whbr.svc@oppobihar.in - Password:
oppo@12345
ba1e53be-21d5-4b75-92f5-e24f34036bcb
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:oppo@12345 _EmailPort:587 _EmailSSL:false _EmailServer:mail.oppobihar.in _EmailUsername:whbr.svc@oppobihar.in _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:ba1e53be-21d5-4b75-92f5-e24f34036bcb _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
M00nD3v Logger Payload 1 IoCs
Detects M00nD3v Logger payload in memory.
-
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
-
Nirsoft 7 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Uses the VBS compiler for execution 1 TTPs
-
Windows security modification 2 TTPs 2 IoCs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1eb603543508b94ba5fb2850c69ddc3334dbf4608a42be8f37ee1bad5ff5a99b.exe"C:\Users\Admin\AppData\Local\Temp\1eb603543508b94ba5fb2850c69ddc3334dbf4608a42be8f37ee1bad5ff5a99b.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Windows security modification
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hyrokACytX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCE5C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1eb603543508b94ba5fb2850c69ddc3334dbf4608a42be8f37ee1bad5ff5a99b.exe"C:\Users\Admin\AppData\Local\Temp\1eb603543508b94ba5fb2850c69ddc3334dbf4608a42be8f37ee1bad5ff5a99b.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp1A59.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp36CB.tmp"3⤵
- Accesses Microsoft Outlook accounts
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\1eb603543508b94ba5fb2850c69ddc3334dbf4608a42be8f37ee1bad5ff5a99b.exe.logFilesize
411B
MD5b5766774c3ec5c3c2bd98da37069b64a
SHA1230ab2667e627ef2252bdd19a2eb39fc86aa521c
SHA256e81508d529d4607729ea190c95e5bf809bad250638ed22fa58c307de7c8d0161
SHA51223038bdddc0db8830608e5c440e825e675338c30d79833c5173499bee105bd8d92896a397cd138359485228b98369d122a19e4e24b1cec13ad1679a609a47d23
-
C:\Users\Admin\AppData\Local\Temp\tmp1A59.tmpFilesize
4KB
MD5a44410c464bc23ac615f732de976447c
SHA1e13bb8bfa077dd78dda795b3c21750f217ba4d36
SHA256a1a6fab77bd9c6713b610b41cb025ba806b8fd64fb80b862e1c44ab2277545a6
SHA51215e8af0f65161d9ffe068f10083bb2aebfa9be89a36ca6816853f05b58dd05ea46c5abd2f306a354b6ce9eeab20f26a900c6cf3233553bacf168dcbefb79e31a
-
C:\Users\Admin\AppData\Local\Temp\tmpCE5C.tmpFilesize
1KB
MD5d0183382896a104f69fc319a91282a75
SHA112aa6d1b754c74d960c3c6969858f874e483d53e
SHA256ab89ce3c47043a42877708b35c9372fe1f3b4e81270f6ca128d6feaa25859b0b
SHA512d9ccb799b5ee280ec1d69c5c063705aa1368f0a9c5f27ec33c659a67c0d18d61ba1f0ffb29cfd6909e45c3471d8c4883d23b43e0b540792c3b2bd84e526a6983
-
memory/384-130-0x00000000752F0000-0x00000000758A1000-memory.dmpFilesize
5.7MB
-
memory/384-131-0x00000000752F0000-0x00000000758A1000-memory.dmpFilesize
5.7MB
-
memory/384-154-0x00000000752F0000-0x00000000758A1000-memory.dmpFilesize
5.7MB
-
memory/3860-161-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/3860-158-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/3860-157-0x0000000000000000-mapping.dmp
-
memory/3860-160-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/3860-162-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/4528-149-0x0000000000000000-mapping.dmp
-
memory/4572-156-0x00000000752F0000-0x00000000758A1000-memory.dmpFilesize
5.7MB
-
memory/4572-155-0x00000000752F0000-0x00000000758A1000-memory.dmpFilesize
5.7MB
-
memory/4572-151-0x0000000000000000-mapping.dmp
-
memory/4572-152-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/4776-140-0x000000006F360000-0x000000006F3AC000-memory.dmpFilesize
304KB
-
memory/4776-137-0x0000000005D60000-0x0000000005DC6000-memory.dmpFilesize
408KB
-
memory/4776-148-0x00000000079B0000-0x00000000079B8000-memory.dmpFilesize
32KB
-
memory/4776-146-0x00000000078C0000-0x00000000078CE000-memory.dmpFilesize
56KB
-
memory/4776-145-0x0000000007910000-0x00000000079A6000-memory.dmpFilesize
600KB
-
memory/4776-144-0x0000000007700000-0x000000000770A000-memory.dmpFilesize
40KB
-
memory/4776-143-0x0000000007690000-0x00000000076AA000-memory.dmpFilesize
104KB
-
memory/4776-142-0x0000000007CF0000-0x000000000836A000-memory.dmpFilesize
6.5MB
-
memory/4776-139-0x0000000007580000-0x00000000075B2000-memory.dmpFilesize
200KB
-
memory/4776-141-0x0000000006920000-0x000000000693E000-memory.dmpFilesize
120KB
-
memory/4776-138-0x0000000006380000-0x000000000639E000-memory.dmpFilesize
120KB
-
memory/4776-147-0x00000000079D0000-0x00000000079EA000-memory.dmpFilesize
104KB
-
memory/4776-136-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/4776-135-0x00000000054D0000-0x00000000054F2000-memory.dmpFilesize
136KB
-
memory/4776-134-0x0000000005620000-0x0000000005C48000-memory.dmpFilesize
6.2MB
-
memory/4776-133-0x0000000002A50000-0x0000000002A86000-memory.dmpFilesize
216KB
-
memory/4776-132-0x0000000000000000-mapping.dmp
-
memory/5068-164-0x0000000000000000-mapping.dmp
-
memory/5068-165-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/5068-167-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/5068-168-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB