Analysis
-
max time kernel
122s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 14:45
Static task
static1
Behavioral task
behavioral1
Sample
DHL_SHIP.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DHL_SHIP.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
RECEIPT_.exe
Resource
win7-20220414-en
General
-
Target
DHL_SHIP.exe
-
Size
663KB
-
MD5
2e36f6782801ac6be4b0fae3bc66d3eb
-
SHA1
faae086629f2895097732d54353d708f14ca302c
-
SHA256
3ba1dc2aac23384e6a3b3bc09debde9a2029864c7fd14f12d06ff06efcd9e977
-
SHA512
4cf83a5fce2d41485dc54f4198a3d068be7a35499a06798c120341c61e5ed1b26e685e6b97085585cbfa4214d7559d87c6cf59cbdcc8304fea88145e28457f87
Malware Config
Extracted
hawkeye_reborn
10.0.0.0
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
alan.poh@khengkenq.com - Password:
ajonwa
99962c92-eee7-4494-95c3-cd8974204d95
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:false _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:ajonwa _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:alan.poh@khengkenq.com _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:1 _MeltFile:false _Mutex:99962c92-eee7-4494-95c3-cd8974204d95 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/3656-146-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/3656-148-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/3656-149-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/3816-139-0x0000000000400000-0x000000000045C000-memory.dmp WebBrowserPassView behavioral2/memory/3816-141-0x0000000000400000-0x000000000045C000-memory.dmp WebBrowserPassView behavioral2/memory/3816-142-0x0000000000400000-0x000000000045C000-memory.dmp WebBrowserPassView behavioral2/memory/3816-143-0x0000000000400000-0x000000000045C000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
Processes:
resource yara_rule behavioral2/memory/3816-139-0x0000000000400000-0x000000000045C000-memory.dmp Nirsoft behavioral2/memory/3816-141-0x0000000000400000-0x000000000045C000-memory.dmp Nirsoft behavioral2/memory/3816-142-0x0000000000400000-0x000000000045C000-memory.dmp Nirsoft behavioral2/memory/3816-143-0x0000000000400000-0x000000000045C000-memory.dmp Nirsoft behavioral2/memory/3656-146-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/3656-148-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/3656-149-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 34 bot.whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
DHL_SHIP.exeRegSvcs.exedescription pid process target process PID 3212 set thread context of 308 3212 DHL_SHIP.exe RegSvcs.exe PID 308 set thread context of 3816 308 RegSvcs.exe vbc.exe PID 308 set thread context of 3656 308 RegSvcs.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
vbc.exepid process 3816 vbc.exe 3816 vbc.exe 3816 vbc.exe 3816 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 308 RegSvcs.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
DHL_SHIP.exeRegSvcs.exedescription pid process target process PID 3212 wrote to memory of 308 3212 DHL_SHIP.exe RegSvcs.exe PID 3212 wrote to memory of 308 3212 DHL_SHIP.exe RegSvcs.exe PID 3212 wrote to memory of 308 3212 DHL_SHIP.exe RegSvcs.exe PID 3212 wrote to memory of 308 3212 DHL_SHIP.exe RegSvcs.exe PID 3212 wrote to memory of 308 3212 DHL_SHIP.exe RegSvcs.exe PID 3212 wrote to memory of 308 3212 DHL_SHIP.exe RegSvcs.exe PID 3212 wrote to memory of 308 3212 DHL_SHIP.exe RegSvcs.exe PID 3212 wrote to memory of 308 3212 DHL_SHIP.exe RegSvcs.exe PID 308 wrote to memory of 3816 308 RegSvcs.exe vbc.exe PID 308 wrote to memory of 3816 308 RegSvcs.exe vbc.exe PID 308 wrote to memory of 3816 308 RegSvcs.exe vbc.exe PID 308 wrote to memory of 3816 308 RegSvcs.exe vbc.exe PID 308 wrote to memory of 3816 308 RegSvcs.exe vbc.exe PID 308 wrote to memory of 3816 308 RegSvcs.exe vbc.exe PID 308 wrote to memory of 3816 308 RegSvcs.exe vbc.exe PID 308 wrote to memory of 3816 308 RegSvcs.exe vbc.exe PID 308 wrote to memory of 3816 308 RegSvcs.exe vbc.exe PID 308 wrote to memory of 3656 308 RegSvcs.exe vbc.exe PID 308 wrote to memory of 3656 308 RegSvcs.exe vbc.exe PID 308 wrote to memory of 3656 308 RegSvcs.exe vbc.exe PID 308 wrote to memory of 3656 308 RegSvcs.exe vbc.exe PID 308 wrote to memory of 3656 308 RegSvcs.exe vbc.exe PID 308 wrote to memory of 3656 308 RegSvcs.exe vbc.exe PID 308 wrote to memory of 3656 308 RegSvcs.exe vbc.exe PID 308 wrote to memory of 3656 308 RegSvcs.exe vbc.exe PID 308 wrote to memory of 3656 308 RegSvcs.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL_SHIP.exe"C:\Users\Admin\AppData\Local\Temp\DHL_SHIP.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp7E29.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp830C.tmp"3⤵
- Accesses Microsoft Outlook accounts
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7E29.tmpFilesize
4KB
MD5bdf65f70610625cc771c5cc7ce168c7d
SHA1a8829b1c071ed0521d11925a98468c12a53a03b8
SHA256b66236dd86f140ca02db0c296e45032b272de2895c4f047a562e73bc8395dba5
SHA512add2db50b0440b07ecc48a5fde7f0b72e84b76f11ea060944afa28ddd03791e6adb3bfca704254131fb3f591f484b37f7276fab96b0c4776a27cb526bcf5f3a4
-
memory/308-137-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/308-136-0x0000000000000000-mapping.dmp
-
memory/3212-133-0x00000000055C0000-0x00000000055CA000-memory.dmpFilesize
40KB
-
memory/3212-134-0x00000000062F0000-0x000000000638C000-memory.dmpFilesize
624KB
-
memory/3212-135-0x0000000006600000-0x0000000006666000-memory.dmpFilesize
408KB
-
memory/3212-132-0x0000000005640000-0x00000000056D2000-memory.dmpFilesize
584KB
-
memory/3212-131-0x0000000005B50000-0x00000000060F4000-memory.dmpFilesize
5.6MB
-
memory/3212-130-0x0000000000B60000-0x0000000000C0C000-memory.dmpFilesize
688KB
-
memory/3656-149-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3656-148-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3656-146-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3656-145-0x0000000000000000-mapping.dmp
-
memory/3816-138-0x0000000000000000-mapping.dmp
-
memory/3816-143-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/3816-142-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/3816-141-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/3816-139-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB