hawkeye_reborn | 4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb

General

Target

4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe
Size

985KB
MD5

d6aa101b1b18175f70c4a4c314f4998b
SHA1

43c77052d7fe5e6fdc9eea2bcba82dfc852920b5
SHA256

4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb
SHA512

3483af9285410eda1a0063ea08864aedbf18fee8df542fb63efbe42d1f28b4d27f774fa89529ef1ca056180f604c690ba50ceedda392805fe58165962fd00355

Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 4 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

Processes:

resource	yara_rule
behavioral1/memory/1744-58-0x00000000000F0000-0x0000000000180000-memory.dmp	m00nd3v_logger
behavioral1/memory/1744-57-0x00000000000F0000-0x0000000000180000-memory.dmp	m00nd3v_logger
behavioral1/memory/1744-62-0x00000000000F0000-0x0000000000180000-memory.dmp	m00nd3v_logger
behavioral1/memory/1744-65-0x00000000000F0000-0x0000000000180000-memory.dmp	m00nd3v_logger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 bot.whatismyipaddress.com

flow	ioc
12	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe

description	pid	process	target process
PID 2008 set thread context of 1744	2008	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe

Drops file in Windows directory 2 IoCs

Processes:

4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe

description pid process

Token: SeDebugPrivilege 2008 4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe

description	pid	process
Token: SeDebugPrivilege	2008	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe

description	pid	process	target process
PID 2008 wrote to memory of 1744	2008	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe
PID 2008 wrote to memory of 1744	2008	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe
PID 2008 wrote to memory of 1744	2008	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe
PID 2008 wrote to memory of 1744	2008	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe
PID 2008 wrote to memory of 1744	2008	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe
PID 2008 wrote to memory of 1744	2008	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe
PID 2008 wrote to memory of 1744	2008	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe
PID 2008 wrote to memory of 1744	2008	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe
PID 2008 wrote to memory of 1744	2008	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe	4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe

C:\Users\Admin\AppData\Local\Temp\4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe
"C:\Users\Admin\AppData\Local\Temp\4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Local\Temp\4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe
"C:\Users\Admin\AppData\Local\Temp\4d9d802de273d132846db610fa7ee558e8c7af19ceb1aa84fa22789664a2f2fb.exe"
2⤵
PID:1744

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1

T1130

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-58-0x00000000000F0000-0x0000000000180000-memory.dmp

Filesize
576KB

Download
memory/1744-57-0x00000000000F0000-0x0000000000180000-memory.dmp

Filesize
576KB

Download
memory/1744-62-0x00000000000F0000-0x0000000000180000-memory.dmp

Filesize
576KB

Download
memory/1744-65-0x00000000000F0000-0x0000000000180000-memory.dmp

Filesize
576KB

Download
memory/1744-67-0x0000000074E00000-0x00000000753AB000-memory.dmp

Filesize
5.7MB

Download
memory/1744-69-0x0000000074E00000-0x00000000753AB000-memory.dmp

Filesize
5.7MB

Download
memory/2008-54-0x0000000075791000-0x0000000075793000-memory.dmp

Filesize
8KB

Download
memory/2008-55-0x0000000074E00000-0x00000000753AB000-memory.dmp

Filesize
5.7MB

Download
memory/2008-56-0x0000000074E00000-0x00000000753AB000-memory.dmp

Filesize
5.7MB

Download
memory/2008-68-0x0000000074E00000-0x00000000753AB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads