Analysis
-
max time kernel
150s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 14:45
Static task
static1
Behavioral task
behavioral1
Sample
DHL_SHIP.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DHL_SHIP.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
RECEIPT_.exe
Resource
win7-20220414-en
General
-
Target
DHL_SHIP.exe
-
Size
663KB
-
MD5
2e36f6782801ac6be4b0fae3bc66d3eb
-
SHA1
faae086629f2895097732d54353d708f14ca302c
-
SHA256
3ba1dc2aac23384e6a3b3bc09debde9a2029864c7fd14f12d06ff06efcd9e977
-
SHA512
4cf83a5fce2d41485dc54f4198a3d068be7a35499a06798c120341c61e5ed1b26e685e6b97085585cbfa4214d7559d87c6cf59cbdcc8304fea88145e28457f87
Malware Config
Extracted
hawkeye_reborn
10.0.0.0
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
alan.poh@khengkenq.com - Password:
ajonwa
99962c92-eee7-4494-95c3-cd8974204d95
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:false _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:ajonwa _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:alan.poh@khengkenq.com _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:1 _MeltFile:false _Mutex:99962c92-eee7-4494-95c3-cd8974204d95 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral1/memory/1100-57-0x0000000005070000-0x000000000510A000-memory.dmp disable_win_def -
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1968-70-0x00000000007E0000-0x0000000000856000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 6 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1968-70-0x00000000007E0000-0x0000000000856000-memory.dmp WebBrowserPassView behavioral1/memory/2012-81-0x0000000000400000-0x000000000045C000-memory.dmp WebBrowserPassView behavioral1/memory/2012-82-0x0000000000444D30-mapping.dmp WebBrowserPassView behavioral1/memory/2012-86-0x0000000000400000-0x000000000045C000-memory.dmp WebBrowserPassView behavioral1/memory/2012-87-0x0000000000400000-0x000000000045C000-memory.dmp WebBrowserPassView behavioral1/memory/2012-88-0x0000000000400000-0x000000000045C000-memory.dmp WebBrowserPassView -
Nirsoft 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1968-70-0x00000000007E0000-0x0000000000856000-memory.dmp Nirsoft behavioral1/memory/2012-81-0x0000000000400000-0x000000000045C000-memory.dmp Nirsoft behavioral1/memory/2012-82-0x0000000000444D30-mapping.dmp Nirsoft behavioral1/memory/2012-86-0x0000000000400000-0x000000000045C000-memory.dmp Nirsoft behavioral1/memory/2012-87-0x0000000000400000-0x000000000045C000-memory.dmp Nirsoft behavioral1/memory/2012-88-0x0000000000400000-0x000000000045C000-memory.dmp Nirsoft -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
DHL_SHIP.exeRegSvcs.exedescription pid process target process PID 1100 set thread context of 1968 1100 DHL_SHIP.exe RegSvcs.exe PID 1968 set thread context of 2012 1968 RegSvcs.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
vbc.exepid process 2012 vbc.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
DHL_SHIP.exeRegSvcs.exedescription pid process target process PID 1100 wrote to memory of 1968 1100 DHL_SHIP.exe RegSvcs.exe PID 1100 wrote to memory of 1968 1100 DHL_SHIP.exe RegSvcs.exe PID 1100 wrote to memory of 1968 1100 DHL_SHIP.exe RegSvcs.exe PID 1100 wrote to memory of 1968 1100 DHL_SHIP.exe RegSvcs.exe PID 1100 wrote to memory of 1968 1100 DHL_SHIP.exe RegSvcs.exe PID 1100 wrote to memory of 1968 1100 DHL_SHIP.exe RegSvcs.exe PID 1100 wrote to memory of 1968 1100 DHL_SHIP.exe RegSvcs.exe PID 1100 wrote to memory of 1968 1100 DHL_SHIP.exe RegSvcs.exe PID 1100 wrote to memory of 1968 1100 DHL_SHIP.exe RegSvcs.exe PID 1100 wrote to memory of 1968 1100 DHL_SHIP.exe RegSvcs.exe PID 1100 wrote to memory of 1968 1100 DHL_SHIP.exe RegSvcs.exe PID 1100 wrote to memory of 1968 1100 DHL_SHIP.exe RegSvcs.exe PID 1968 wrote to memory of 2012 1968 RegSvcs.exe vbc.exe PID 1968 wrote to memory of 2012 1968 RegSvcs.exe vbc.exe PID 1968 wrote to memory of 2012 1968 RegSvcs.exe vbc.exe PID 1968 wrote to memory of 2012 1968 RegSvcs.exe vbc.exe PID 1968 wrote to memory of 2012 1968 RegSvcs.exe vbc.exe PID 1968 wrote to memory of 2012 1968 RegSvcs.exe vbc.exe PID 1968 wrote to memory of 2012 1968 RegSvcs.exe vbc.exe PID 1968 wrote to memory of 2012 1968 RegSvcs.exe vbc.exe PID 1968 wrote to memory of 2012 1968 RegSvcs.exe vbc.exe PID 1968 wrote to memory of 2012 1968 RegSvcs.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL_SHIP.exe"C:\Users\Admin\AppData\Local\Temp\DHL_SHIP.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp1A07.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1A07.tmpFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
memory/1100-54-0x00000000008B0000-0x000000000095C000-memory.dmpFilesize
688KB
-
memory/1100-55-0x0000000074B51000-0x0000000074B53000-memory.dmpFilesize
8KB
-
memory/1100-56-0x0000000000360000-0x0000000000368000-memory.dmpFilesize
32KB
-
memory/1100-57-0x0000000005070000-0x000000000510A000-memory.dmpFilesize
616KB
-
memory/1100-58-0x00000000003F0000-0x00000000003FA000-memory.dmpFilesize
40KB
-
memory/1968-69-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/1968-84-0x0000000004AB5000-0x0000000004AC6000-memory.dmpFilesize
68KB
-
memory/1968-63-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/1968-64-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/1968-65-0x000000000048B2BE-mapping.dmp
-
memory/1968-67-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/1968-60-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/1968-70-0x00000000007E0000-0x0000000000856000-memory.dmpFilesize
472KB
-
memory/1968-59-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/1968-62-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/2012-73-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2012-77-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2012-79-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2012-81-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2012-82-0x0000000000444D30-mapping.dmp
-
memory/2012-75-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2012-86-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2012-87-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2012-88-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2012-72-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB