Analysis
-
max time kernel
95s -
max time network
100s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-07-2022 02:30
Static task
static1
Behavioral task
behavioral1
Sample
4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exe
Resource
win10v2004-20220414-en
General
-
Target
4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exe
-
Size
817KB
-
MD5
b7b54500b995dcd5ac2e9f0b5bdd0c23
-
SHA1
011ad6cf3d6c092d7892c3742647c38e157ab475
-
SHA256
4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8
-
SHA512
85de68c3ed5e8c7e3ae4a766796296be20bdab153b4c56951af145272ff069264e99c0682042d846fbe10d31989ffcd13997dddada535e02bb66b2350c63f14c
Malware Config
Extracted
hawkeye_reborn
- fields
- name
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
Processes:
resource yara_rule behavioral1/memory/1468-69-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger behavioral1/memory/1468-70-0x000000000048B1CE-mapping.dmp m00nd3v_logger behavioral1/memory/1468-73-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger behavioral1/memory/1468-75-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1468-76-0x0000000000DC0000-0x0000000000E36000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1468-76-0x0000000000DC0000-0x0000000000E36000-memory.dmp WebBrowserPassView -
Nirsoft 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1468-76-0x0000000000DC0000-0x0000000000E36000-memory.dmp Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
stable.exestable.exepid process 268 stable.exe 1468 stable.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/960-56-0x0000000000540000-0x0000000000578000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
stable.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Local\\stable.exe -boot" stable.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 bot.whatismyipaddress.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
stable.exedescription pid process target process PID 268 set thread context of 1468 268 stable.exe stable.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exestable.exepid process 960 4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exe 268 stable.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exestable.exestable.exedescription pid process Token: SeDebugPrivilege 960 4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exe Token: SeDebugPrivilege 268 stable.exe Token: SeDebugPrivilege 1468 stable.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exeexplorer.exestable.exedescription pid process target process PID 960 wrote to memory of 1272 960 4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exe cmd.exe PID 960 wrote to memory of 1272 960 4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exe cmd.exe PID 960 wrote to memory of 1272 960 4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exe cmd.exe PID 960 wrote to memory of 1272 960 4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exe cmd.exe PID 960 wrote to memory of 1068 960 4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exe explorer.exe PID 960 wrote to memory of 1068 960 4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exe explorer.exe PID 960 wrote to memory of 1068 960 4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exe explorer.exe PID 960 wrote to memory of 1068 960 4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exe explorer.exe PID 320 wrote to memory of 268 320 explorer.exe stable.exe PID 320 wrote to memory of 268 320 explorer.exe stable.exe PID 320 wrote to memory of 268 320 explorer.exe stable.exe PID 320 wrote to memory of 268 320 explorer.exe stable.exe PID 268 wrote to memory of 1468 268 stable.exe stable.exe PID 268 wrote to memory of 1468 268 stable.exe stable.exe PID 268 wrote to memory of 1468 268 stable.exe stable.exe PID 268 wrote to memory of 1468 268 stable.exe stable.exe PID 268 wrote to memory of 1468 268 stable.exe stable.exe PID 268 wrote to memory of 1468 268 stable.exe stable.exe PID 268 wrote to memory of 1468 268 stable.exe stable.exe PID 268 wrote to memory of 1468 268 stable.exe stable.exe PID 268 wrote to memory of 1468 268 stable.exe stable.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exe"C:\Users\Admin\AppData\Local\Temp\4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\4272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8.exe" "C:\Users\Admin\AppData\Local\stable.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Local\stable.exe"2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\stable.exe"C:\Users\Admin\AppData\Local\stable.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\stable.exe"C:\Users\Admin\AppData\Local\stable.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\stable.exeFilesize
817KB
MD5b7b54500b995dcd5ac2e9f0b5bdd0c23
SHA1011ad6cf3d6c092d7892c3742647c38e157ab475
SHA2564272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8
SHA51285de68c3ed5e8c7e3ae4a766796296be20bdab153b4c56951af145272ff069264e99c0682042d846fbe10d31989ffcd13997dddada535e02bb66b2350c63f14c
-
C:\Users\Admin\AppData\Local\stable.exeFilesize
817KB
MD5b7b54500b995dcd5ac2e9f0b5bdd0c23
SHA1011ad6cf3d6c092d7892c3742647c38e157ab475
SHA2564272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8
SHA51285de68c3ed5e8c7e3ae4a766796296be20bdab153b4c56951af145272ff069264e99c0682042d846fbe10d31989ffcd13997dddada535e02bb66b2350c63f14c
-
C:\Users\Admin\AppData\Local\stable.exeFilesize
817KB
MD5b7b54500b995dcd5ac2e9f0b5bdd0c23
SHA1011ad6cf3d6c092d7892c3742647c38e157ab475
SHA2564272b1d0b38f1c3e9ef6b63582035c96bef09292be1224918cf4ea6cbfda3de8
SHA51285de68c3ed5e8c7e3ae4a766796296be20bdab153b4c56951af145272ff069264e99c0682042d846fbe10d31989ffcd13997dddada535e02bb66b2350c63f14c
-
memory/268-67-0x0000000001370000-0x0000000001446000-memory.dmpFilesize
856KB
-
memory/268-65-0x0000000000000000-mapping.dmp
-
memory/320-63-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmpFilesize
8KB
-
memory/960-55-0x0000000006EC0000-0x0000000006FE0000-memory.dmpFilesize
1.1MB
-
memory/960-54-0x0000000000D50000-0x0000000000E26000-memory.dmpFilesize
856KB
-
memory/960-58-0x0000000076571000-0x0000000076573000-memory.dmpFilesize
8KB
-
memory/960-57-0x0000000000420000-0x0000000000426000-memory.dmpFilesize
24KB
-
memory/960-56-0x0000000000540000-0x0000000000578000-memory.dmpFilesize
224KB
-
memory/1068-62-0x0000000070001000-0x0000000070003000-memory.dmpFilesize
8KB
-
memory/1068-60-0x0000000000000000-mapping.dmp
-
memory/1272-59-0x0000000000000000-mapping.dmp
-
memory/1468-69-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/1468-70-0x000000000048B1CE-mapping.dmp
-
memory/1468-73-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/1468-75-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/1468-76-0x0000000000DC0000-0x0000000000E36000-memory.dmpFilesize
472KB