Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system - submitted
25/07/2022, 03:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe
Resource
win7-20220715-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe
- Size 1.6MB
- Sample220725-dhb1macbdr
- SHA256 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691
- MD5 59da4ef4c430c92392b3ce58c17fe5c1
- SHA1 5be78c303656c271c7c5bd9ea5762588f8dec50c
- SHA512 4c6b8a293c9b16c6afad98a13fd09e521891bef947ef4519e9849e62161718024bedab3bc3cc0ac047d4b141748fde9c25774127dbe5efe551e7f34e974905b9
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
hawkeye_reborn
Version
-
9.0.1.6
Credentials
-
Protocol
smtp
-
Host
mail.hakamfood.com
-
Port
587
-
Username
-
Password
h#zgztA3q
Mutex
-
fe44ffbb-6066-4b55-8164-e37a90c5e1a4
Attributes
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:h#zgztA3q _EmailPort:587 _EmailSSL:true _EmailServer:mail.hakamfood.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:30 _MeltFile:false _Mutex:fe44ffbb-6066-4b55-8164-e37a90c5e1a4 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null
Signatures
- HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
- M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
resource yara_rule behavioral2/memory/4060-131-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger - NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/5056-146-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/5056-148-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/5056-149-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView - NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/3584-139-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/3584-141-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/3584-142-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/3584-143-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView - Nirsoft 7 IoCs
resource yara_rule behavioral2/memory/3584-139-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3584-141-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3584-142-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3584-143-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/5056-146-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/5056-148-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/5056-149-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft - Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\imjpuexc.url c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe - Uses the VBS compiler for execution 1 TTPs
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 31 bot.whatismyipaddress.com - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4032 set thread context of 4060 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 83 PID 4060 set thread context of 3584 4060 RegAsm.exe 84 PID 4060 set thread context of 5056 4060 RegAsm.exe 85 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4060 RegAsm.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4060 RegAsm.exe - Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 4032 wrote to memory of 4060 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 83 PID 4032 wrote to memory of 4060 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 83 PID 4032 wrote to memory of 4060 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 83 PID 4032 wrote to memory of 4060 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 83 PID 4032 wrote to memory of 4060 4032 c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe 83 PID 4060 wrote to memory of 3584 4060 RegAsm.exe 84 PID 4060 wrote to memory of 3584 4060 RegAsm.exe 84 PID 4060 wrote to memory of 3584 4060 RegAsm.exe 84 PID 4060 wrote to memory of 3584 4060 RegAsm.exe 84 PID 4060 wrote to memory of 3584 4060 RegAsm.exe 84 PID 4060 wrote to memory of 3584 4060 RegAsm.exe 84 PID 4060 wrote to memory of 3584 4060 RegAsm.exe 84 PID 4060 wrote to memory of 3584 4060 RegAsm.exe 84 PID 4060 wrote to memory of 3584 4060 RegAsm.exe 84 PID 4060 wrote to memory of 5056 4060 RegAsm.exe 85 PID 4060 wrote to memory of 5056 4060 RegAsm.exe 85 PID 4060 wrote to memory of 5056 4060 RegAsm.exe 85 PID 4060 wrote to memory of 5056 4060 RegAsm.exe 85 PID 4060 wrote to memory of 5056 4060 RegAsm.exe 85 PID 4060 wrote to memory of 5056 4060 RegAsm.exe 85 PID 4060 wrote to memory of 5056 4060 RegAsm.exe 85 PID 4060 wrote to memory of 5056 4060 RegAsm.exe 85 PID 4060 wrote to memory of 5056 4060 RegAsm.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe"C:\Users\Admin\AppData\Local\Temp\c260859caa48c47ffbfac609cbf0d15f240dd244aacf8ec4ade0cb146904c691.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp9D6D.tmp"3⤵PID:3584
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpA185.tmp"3⤵
- Accesses Microsoft Outlook accounts
PID:5056
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\tmp9D6D.tmp
- Size 4KB
- SHA256 c02f630d99769ab6a71fec1ee712a8c6a97742e5469b4e4157d5ca716e09e62c
- MD5 8376e754a86cd9a9461b4a4ae2486b11
- SHA1 d0e566622882fde386f482f1dcee15b2c7fa5d3a
- SHA512 a1caf85a93499f37d7451bf9b3ef01cbf833e9371585257c009a5de183d072d46a0b8124a8816e0bd94025a5129ad6fb15738f12a865485a3aff07343a14ec6a
- SSDEEP 48:wvvv0wZxfvvcwZxfdvv0wZxBvv0wZxakvv0wZ7:mvtxvVp1vtPvtbvt7
- MD5 SHA1 SHA512 SSDEEP