hawkeye_reborn | 3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de

General

Target

3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe
Size

692KB
MD5

0d975d18b48be7a18ac10f29a57cede7
SHA1

8c7106805127f6d7135dd5f80975578a82f46d55
SHA256

3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de
SHA512

485554946de310bac6a8c02d1e17eca404217048b9a11d6c34097e9e929d926c125ca2b1f9102ddd774a45fa284ed00978ea8b223152247f43626c8c6ddcbbc0

Score

10^/10

Family

hawkeye_reborn

Attributes

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger Payload 7 IoCs

Detects M00nD3v Logger payload in memory.

resource	yara_rule
behavioral1/memory/900-58-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/900-59-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/900-60-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/900-61-0x000000000048B1CE-mapping.dmp	m00nd3v_logger
behavioral1/memory/900-63-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/900-66-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1644-69-0x0000000074A70000-0x000000007501B000-memory.dmp	m00nd3v_logger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1644 set thread context of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	27
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	27
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	27
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	27
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	27
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	27
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	27
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	27
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	27
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	27
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	27
PID 1644 wrote to memory of 900	1644	3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe	27

C:\Users\Admin\AppData\Local\Temp\3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe
"C:\Users\Admin\AppData\Local\Temp\3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe
  "C:\Users\Admin\AppData\Local\Temp\3b5f733e9294d06f99fa7bd3992ca3662a174f78b476b8469443b1962cc1f1de.exe"
  2⤵
  PID:900

memory/900-70-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/900-56-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/900-58-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/900-59-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/900-60-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/900-55-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/900-63-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/900-68-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/900-66-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/900-71-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/1644-54-0x0000000076781000-0x0000000076783000-memory.dmp

Filesize
8KB

Download
memory/1644-69-0x0000000074A70000-0x000000007501B000-memory.dmp

Filesize
5.7MB

Download
memory/1644-65-0x0000000074A70000-0x000000007501B000-memory.dmp

Filesize
5.7MB

Download