Analysis
- max time kernel
189s - max time network
48s - platform
windows7_x64 - resource
win7-20220414-en - submitted
19/06/2022, 19:46
General
- Target 34dd58676093cd5f4106acfd008f9c440829d79ce8f59e16c2986f2eb2b70b81.exe
- Size 774KB
- Sample220619-yhbebaaddr
- SHA256 34dd58676093cd5f4106acfd008f9c440829d79ce8f59e16c2986f2eb2b70b81
Malware Config
Extracted
-
hawkeye_reborn
- fields
- name
Signatures
- HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
- M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
- M00nD3v Logger Payload 6 IoCs
Detects M00nD3v Logger payload in memory.
- NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 6 IoCs
Password recovery tool for various web browsers
- Nirsoft 6 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\34dd58676093cd5f4106acfd008f9c440829d79ce8f59e16c2986f2eb2b70b81.exe"C:\Users\Admin\AppData\Local\Temp\34dd58676093cd5f4106acfd008f9c440829d79ce8f59e16c2986f2eb2b70b81.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp964.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmp964.tmp
memory/324-54-0x0000000000970000-0x0000000000A3A000-memory.dmp
memory/324-55-0x0000000004860000-0x0000000004916000-memory.dmp
memory/324-56-0x0000000000410000-0x000000000042C000-memory.dmp
memory/324-57-0x0000000000440000-0x000000000044C000-memory.dmp
memory/640-69-0x0000000075EF1000-0x0000000075EF3000-memory.dmp
memory/640-83-0x0000000000885000-0x0000000000896000-memory.dmp
memory/640-62-0x0000000000400000-0x0000000000490000-memory.dmp
memory/640-63-0x0000000000400000-0x0000000000490000-memory.dmp
memory/640-68-0x0000000000400000-0x0000000000490000-memory.dmp
memory/640-66-0x0000000000400000-0x0000000000490000-memory.dmp
memory/640-59-0x0000000000400000-0x0000000000490000-memory.dmp
memory/640-70-0x0000000000BE0000-0x0000000000C56000-memory.dmp
memory/640-58-0x0000000000400000-0x0000000000490000-memory.dmp
memory/640-61-0x0000000000400000-0x0000000000490000-memory.dmp
memory/1784-74-0x0000000000400000-0x000000000045B000-memory.dmp
memory/1784-76-0x0000000000400000-0x000000000045B000-memory.dmp
memory/1784-78-0x0000000000400000-0x000000000045B000-memory.dmp
memory/1784-80-0x0000000000400000-0x000000000045B000-memory.dmp
memory/1784-72-0x0000000000400000-0x000000000045B000-memory.dmp
memory/1784-85-0x0000000000400000-0x000000000045B000-memory.dmp
memory/1784-87-0x0000000000400000-0x000000000045B000-memory.dmp
memory/1784-88-0x0000000000400000-0x000000000045B000-memory.dmp
memory/1784-71-0x0000000000400000-0x000000000045B000-memory.dmp