hawkeye_reborn | 3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de

General

Target

3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe
Size

692KB
MD5

0d975d18b48be7a18ac10f29a57cede7
SHA1

8c7106805127f6d7135dd5f80975578a82f46d55
SHA256

3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de
SHA512

485554946de310bac6a8c02d1e17eca404217048b9a11d6c34097e9e929d926c125ca2b1f9102ddd774a45fa284ed00978ea8b223152247f43626c8c6ddcbbc0

Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger Payload 7 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

Processes:

resource	yara_rule
behavioral1/memory/900-58-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/900-59-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/900-60-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/900-61-0x000000000048B1CE-mapping.dmp	m00nd3v_logger
behavioral1/memory/900-63-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/900-66-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1644-69-0x0000000074A70000-0x000000007501B000-memory.dmp	m00nd3v_logger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 bot.whatismyipaddress.com

flow	ioc
3	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe

description	pid	process	target process
PID 1644 set thread context of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	regasm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe

description pid process

Token: SeDebugPrivilege 1644 3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe

description	pid	process
Token: SeDebugPrivilege	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe

description	pid	process	target process
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	regasm.exe
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	regasm.exe
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	regasm.exe
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	regasm.exe
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	regasm.exe
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	regasm.exe
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	regasm.exe
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	regasm.exe
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	regasm.exe
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	regasm.exe
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	regasm.exe
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	regasm.exe

C:\Users\Admin\AppData\Local\Temp\3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe
"C:\Users\Admin\AppData\Local\Temp\3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe
"C:\Users\Admin\AppData\Local\Temp\3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe"
2⤵
PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-61-0x000000000048B1CE-mapping.dmp

Download
memory/900-70-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/900-56-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/900-58-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/900-59-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/900-60-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/900-55-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/900-63-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/900-68-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/900-66-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/900-71-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/1644-54-0x0000000076781000-0x0000000076783000-memory.dmp

Filesize
8KB

Download
memory/1644-69-0x0000000074A70000-0x000000007501B000-memory.dmp

Filesize
5.7MB

Download
memory/1644-65-0x0000000074A70000-0x000000007501B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads