Analysis
-
max time kernel
149s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
08-07-2022 07:32
Static task
static1
Behavioral task
behavioral1
Sample
a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48.exe
Resource
win10v2004-20220414-en
General
-
Target
a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48.exe
-
Size
2.3MB
-
MD5
fee7ba808b8fec3bc11c596832b1aefe
-
SHA1
29baf52ac00c39d8ab828090c96b829969a8669e
-
SHA256
a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48
-
SHA512
4445c2c1edfe435156140f8d7a151b3b78a4f221544b4aee809945a114ca28441a230a644628ad092956fb98f385a03ee4b0cc3af1a8adfb1e1cab1ee02b2f1f
Malware Config
Extracted
hawkeye_reborn
9.0.1.6
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
madhav@cncautomotivegroup.pw - Password:
!5CFew19ar[.?
b2812f3c-7b52-4c85-aab8-14b829856d53
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:!5CFew19ar[.? _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:madhav@cncautomotivegroup.pw _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:b2812f3c-7b52-4c85-aab8-14b829856d53 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
Processes:
resource yara_rule behavioral2/memory/1476-132-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger -
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/3612-148-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/3612-150-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/3612-151-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/5032-141-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/5032-143-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/5032-144-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/5032-145-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
Processes:
resource yara_rule behavioral2/memory/5032-141-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/5032-143-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/5032-144-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/5032-145-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3612-148-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/3612-150-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/3612-151-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 92 bot.whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48.exeRegAsm.exedescription pid process target process PID 3032 set thread context of 1476 3032 a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48.exe RegAsm.exe PID 1476 set thread context of 5032 1476 RegAsm.exe vbc.exe PID 1476 set thread context of 3612 1476 RegAsm.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
vbc.exeRegAsm.exepid process 5032 vbc.exe 5032 vbc.exe 5032 vbc.exe 5032 vbc.exe 5032 vbc.exe 5032 vbc.exe 5032 vbc.exe 5032 vbc.exe 5032 vbc.exe 5032 vbc.exe 5032 vbc.exe 5032 vbc.exe 1476 RegAsm.exe 1476 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 1476 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 1476 RegAsm.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48.exeRegAsm.exedescription pid process target process PID 3032 wrote to memory of 1476 3032 a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48.exe RegAsm.exe PID 3032 wrote to memory of 1476 3032 a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48.exe RegAsm.exe PID 3032 wrote to memory of 1476 3032 a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48.exe RegAsm.exe PID 3032 wrote to memory of 1476 3032 a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48.exe RegAsm.exe PID 3032 wrote to memory of 1476 3032 a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48.exe RegAsm.exe PID 3032 wrote to memory of 4056 3032 a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48.exe schtasks.exe PID 3032 wrote to memory of 4056 3032 a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48.exe schtasks.exe PID 3032 wrote to memory of 4056 3032 a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48.exe schtasks.exe PID 1476 wrote to memory of 5032 1476 RegAsm.exe vbc.exe PID 1476 wrote to memory of 5032 1476 RegAsm.exe vbc.exe PID 1476 wrote to memory of 5032 1476 RegAsm.exe vbc.exe PID 1476 wrote to memory of 5032 1476 RegAsm.exe vbc.exe PID 1476 wrote to memory of 5032 1476 RegAsm.exe vbc.exe PID 1476 wrote to memory of 5032 1476 RegAsm.exe vbc.exe PID 1476 wrote to memory of 5032 1476 RegAsm.exe vbc.exe PID 1476 wrote to memory of 5032 1476 RegAsm.exe vbc.exe PID 1476 wrote to memory of 5032 1476 RegAsm.exe vbc.exe PID 1476 wrote to memory of 3612 1476 RegAsm.exe vbc.exe PID 1476 wrote to memory of 3612 1476 RegAsm.exe vbc.exe PID 1476 wrote to memory of 3612 1476 RegAsm.exe vbc.exe PID 1476 wrote to memory of 3612 1476 RegAsm.exe vbc.exe PID 1476 wrote to memory of 3612 1476 RegAsm.exe vbc.exe PID 1476 wrote to memory of 3612 1476 RegAsm.exe vbc.exe PID 1476 wrote to memory of 3612 1476 RegAsm.exe vbc.exe PID 1476 wrote to memory of 3612 1476 RegAsm.exe vbc.exe PID 1476 wrote to memory of 3612 1476 RegAsm.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48.exe"C:\Users\Admin\AppData\Local\Temp\a025c434836e9f9f920e5e77737f855f3aad1f13b8ed892c68caa6d4e163fa48.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp246B.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp2CC9.tmp"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn /tr "C:\Users\Admin\RegAsm\RegAsm.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp246B.tmpFilesize
4KB
MD5a44410c464bc23ac615f732de976447c
SHA1e13bb8bfa077dd78dda795b3c21750f217ba4d36
SHA256a1a6fab77bd9c6713b610b41cb025ba806b8fd64fb80b862e1c44ab2277545a6
SHA51215e8af0f65161d9ffe068f10083bb2aebfa9be89a36ca6816853f05b58dd05ea46c5abd2f306a354b6ce9eeab20f26a900c6cf3233553bacf168dcbefb79e31a
-
memory/1476-132-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/1476-137-0x0000000073470000-0x0000000073A21000-memory.dmpFilesize
5.7MB
-
memory/1476-139-0x0000000073470000-0x0000000073A21000-memory.dmpFilesize
5.7MB
-
memory/1476-131-0x0000000000000000-mapping.dmp
-
memory/3612-151-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3612-150-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3612-148-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3612-147-0x0000000000000000-mapping.dmp
-
memory/4056-138-0x0000000000000000-mapping.dmp
-
memory/5032-141-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/5032-145-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/5032-144-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/5032-143-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/5032-140-0x0000000000000000-mapping.dmp