Overview

overview

10

Static

static

27862b8ecd...5e.exe

windows7_x64

10

27862b8ecd...5e.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    16-06-2022 04:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    27862b8ecde1957a2c8ea09aa012f67e866f6bf8034ba91579c4112fdf8db15e.exe

  • Size

    2.1MB

  • MD5

    574da65930bab974b3f2526cd10cb94c

  • SHA1

    a20106e24d1da07171f92fbceb0ffd1d20667b88

  • SHA256

    27862b8ecde1957a2c8ea09aa012f67e866f6bf8034ba91579c4112fdf8db15e

  • SHA512

    0abe3cc8774121c63abcc2b11becbe56211f30534720ed0a55b0666fc622e269bcb209238ae5cffc14aec0a7ffc4e32058a8e6ec6ddf182d362f753350529a57

Score
10/10
hawkeye_rebornm00nd3v_loggercollectioninfostealerkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes
  • fields

  • name

Signatures

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn
  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger
  • M00nD3v Logger Payload 1 IoCs

    Detects M00nD3v Logger payload in memory.

    infostealer
  • NirSoft MailPassView 5 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 5 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 9 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27862b8ecde1957a2c8ea09aa012f67e866f6bf8034ba91579c4112fdf8db15e.exe
    "C:\Users\Admin\AppData\Local\Temp\27862b8ecde1957a2c8ea09aa012f67e866f6bf8034ba91579c4112fdf8db15e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:844
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpD0C2.tmp"
        3⤵
          PID:2356
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpD4DA.tmp"
          3⤵
          • Accesses Microsoft Outlook accounts
          PID:2892

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scripting

    1
    T1064

    Persistence

    Privilege Escalation

    Defense Evasion

    Scripting

    1
    T1064

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Email Collection

    1
    T1114

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpD0C2.tmp
      Filesize

      4KB

      MD5

      92b3d04dbcf7aa8eabb0096c55624068

      SHA1

      04a3b14a8f16bdd8a67f1b5d6be8c3db79c766c7

      SHA256

      84e388e2bbff6a229d99df8d7e0558e46e793106c2f3bb290c6acc06fe31fe9c

      SHA512

      fbd6a298b66e2117f68028cdf9fa1b3e441f87fa8a052ce1be628ae65116d5b2953cdc8117dce57e86475a75412b1a85f431eb0da6dd788ec5312d34ff71f9d1

      Download Submit
    • memory/844-131-0x0000000005350000-0x00000000053EC000-memory.dmp
      Filesize

      624KB

      Download
    • memory/844-130-0x00000000001D0000-0x00000000003E4000-memory.dmp
      Filesize

      2.1MB

      Download
    • memory/2356-139-0x0000000000400000-0x000000000045B000-memory.dmp
      Filesize

      364KB

      Download
    • memory/2356-141-0x0000000000400000-0x000000000045B000-memory.dmp
      Filesize

      364KB

      Download
    • memory/2356-140-0x0000000000400000-0x000000000045B000-memory.dmp
      Filesize

      364KB

      Download
    • memory/2356-136-0x0000000000000000-mapping.dmp
      Download
    • memory/2356-137-0x0000000000400000-0x000000000045B000-memory.dmp
      Filesize

      364KB

      Download
    • memory/2892-143-0x0000000000000000-mapping.dmp
      Download
    • memory/2892-144-0x0000000000400000-0x000000000041C000-memory.dmp
      Filesize

      112KB

      Download
    • memory/2892-146-0x0000000000400000-0x000000000041C000-memory.dmp
      Filesize

      112KB

      Download
    • memory/2892-147-0x0000000000400000-0x000000000041C000-memory.dmp
      Filesize

      112KB

      Download
    • memory/2892-148-0x0000000000400000-0x000000000041C000-memory.dmp
      Filesize

      112KB

      Download
    • memory/2928-135-0x0000000071B50000-0x0000000072101000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/2928-134-0x0000000071B50000-0x0000000072101000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/2928-133-0x0000000000400000-0x00000000004A4000-memory.dmp
      Filesize

      656KB

      Download
    • memory/2928-132-0x0000000000000000-mapping.dmp
      Download