Analysis
- max time kernel
147s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
16/06/2022, 02:45
General
- Target 27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe
- Size 692KB
- Sample220616-c84ynabdc5
- SHA256 27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea
Score
10/10
Malware Config
Extracted
Family
-
hawkeye_reborn
Attributes
- fields
- name
Signatures
- HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
- M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
- M00nD3v Logger Payload 1 IoCs
Detects M00nD3v Logger payload in memory.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe"C:\Users\Admin\AppData\Local\Temp\27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe"C:\Users\Admin\AppData\Local\Temp\27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2968-132-0x0000000000400000-0x0000000000490000-memory.dmp
memory/2968-134-0x0000000074D50000-0x0000000075301000-memory.dmp
memory/2968-135-0x0000000074D50000-0x0000000075301000-memory.dmp
memory/2968-136-0x0000000074D50000-0x0000000075301000-memory.dmp
memory/3112-130-0x0000000074D50000-0x0000000075301000-memory.dmp
memory/3112-133-0x0000000074D50000-0x0000000075301000-memory.dmp