hawkeye_reborn | 27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea

General

Target

27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe
Size

692KB
MD5

8922b3f2e4a32ac5bac9ce82a39ca9f1
SHA1

ed710f648f23eb0035a71a3a3f56223db995a55b
SHA256

27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea
SHA512

0c19eb89c0d07b59d7d0073ed5d12c25f92174b02f78dd8446fa1bbee88ad73e99825412e09d8a1f561f3bf8fac08a88cbc3e5eba5ae65b7b9a3bfcdf7e72ba8

Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger Payload 1 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

Processes:

resource	yara_rule
behavioral2/memory/2968-132-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 bot.whatismyipaddress.com

flow	ioc
5	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe

description	pid	process	target process
PID 3112 set thread context of 2968	3112	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	regasm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe

description pid process

Token: SeDebugPrivilege 3112 27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe

description	pid	process
Token: SeDebugPrivilege	3112	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe

description	pid	process	target process
PID 3112 wrote to memory of 2968	3112	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	regasm.exe
PID 3112 wrote to memory of 2968	3112	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	regasm.exe
PID 3112 wrote to memory of 2968	3112	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	regasm.exe
PID 3112 wrote to memory of 2968	3112	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	regasm.exe
PID 3112 wrote to memory of 2968	3112	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	regasm.exe
PID 3112 wrote to memory of 2968	3112	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	regasm.exe
PID 3112 wrote to memory of 2968	3112	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	regasm.exe
PID 3112 wrote to memory of 2968	3112	27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe	regasm.exe

C:\Users\Admin\AppData\Local\Temp\27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe
"C:\Users\Admin\AppData\Local\Temp\27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3112

C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe
"C:\Users\Admin\AppData\Local\Temp\27f4f7e99c303dc6b1bbc880b82f5142bce457df4c2ddced01f06b67e4ce3dea.exe"
2⤵
PID:2968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2968-131-0x0000000000000000-mapping.dmp

Download
memory/2968-132-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2968-134-0x0000000074D50000-0x0000000075301000-memory.dmp

Filesize
5.7MB

Download
memory/2968-135-0x0000000074D50000-0x0000000075301000-memory.dmp

Filesize
5.7MB

Download
memory/2968-136-0x0000000074D50000-0x0000000075301000-memory.dmp

Filesize
5.7MB

Download
memory/3112-130-0x0000000074D50000-0x0000000075301000-memory.dmp

Filesize
5.7MB

Download
memory/3112-133-0x0000000074D50000-0x0000000075301000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads