hawkeye_reborn | 27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
16-06-2022 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe
Size

692KB
MD5

8922b3f2e4a32ac5bac9ce82a39ca9f1
SHA1

ed710f648f23eb0035a71a3a3f56223db995a55b
SHA256

27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea
SHA512

0c19eb89c0d07b59d7d0073ed5d12c25f92174b02f78dd8446fa1bbee88ad73e99825412e09d8a1f561f3bf8fac08a88cbc3e5eba5ae65b7b9a3bfcdf7e72ba8

Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger Payload 7 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral1/memory/940-58-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/940-59-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/940-60-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/940-61-0x000000000048B1CE-mapping.dmp	m00nd3v_logger
behavioral1/memory/940-63-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/940-65-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1488-69-0x0000000074500000-0x0000000074AAB000-memory.dmp	m00nd3v_logger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 940	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	30

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2008	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	27
PID 1488 wrote to memory of 2008	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	27
PID 1488 wrote to memory of 2008	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	27
PID 1488 wrote to memory of 2008	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	27
PID 1488 wrote to memory of 2008	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	27
PID 1488 wrote to memory of 2008	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	27
PID 1488 wrote to memory of 2008	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	27
PID 1488 wrote to memory of 2024	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	28
PID 1488 wrote to memory of 2024	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	28
PID 1488 wrote to memory of 2024	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	28
PID 1488 wrote to memory of 2024	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	28
PID 1488 wrote to memory of 2024	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	28
PID 1488 wrote to memory of 2024	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	28
PID 1488 wrote to memory of 2024	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	28
PID 1488 wrote to memory of 980	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	29
PID 1488 wrote to memory of 980	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	29
PID 1488 wrote to memory of 980	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	29
PID 1488 wrote to memory of 980	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	29
PID 1488 wrote to memory of 980	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	29
PID 1488 wrote to memory of 980	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	29
PID 1488 wrote to memory of 980	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	29
PID 1488 wrote to memory of 940	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	30
PID 1488 wrote to memory of 940	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	30
PID 1488 wrote to memory of 940	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	30
PID 1488 wrote to memory of 940	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	30
PID 1488 wrote to memory of 940	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	30
PID 1488 wrote to memory of 940	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	30
PID 1488 wrote to memory of 940	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	30
PID 1488 wrote to memory of 940	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	30
PID 1488 wrote to memory of 940	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	30
PID 1488 wrote to memory of 940	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	30
PID 1488 wrote to memory of 940	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	30
PID 1488 wrote to memory of 940	1488	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	30

C:\Users\Admin\AppData\Local\Temp\27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe
"C:\Users\Admin\AppData\Local\Temp\27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe
  "C:\Users\Admin\AppData\Local\Temp\27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe"
  2⤵
  PID:2008
- C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe
  "C:\Users\Admin\AppData\Local\Temp\27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe"
  2⤵
  PID:2024
- C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe
  "C:\Users\Admin\AppData\Local\Temp\27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe"
  2⤵
  PID:980
- C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe
  "C:\Users\Admin\AppData\Local\Temp\27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe"
  2⤵
  PID:940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-55-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/940-56-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/940-58-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/940-59-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/940-60-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/940-63-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/940-65-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/940-68-0x0000000074390000-0x000000007493B000-memory.dmp

Filesize
5.7MB

Download
memory/940-70-0x0000000074390000-0x000000007493B000-memory.dmp

Filesize
5.7MB

Download
memory/1488-54-0x0000000075271000-0x0000000075273000-memory.dmp

Filesize
8KB

Download
memory/1488-66-0x0000000074500000-0x0000000074AAB000-memory.dmp

Filesize
5.7MB

Download
memory/1488-69-0x0000000074500000-0x0000000074AAB000-memory.dmp

Filesize
5.7MB

Download