Analysis
-
max time kernel
151s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
-
submitted
25-07-2022 03:53
General
-
Target
b88b5cc0836571fd67144bb824d9c085f9339baadb7df27c07e17de2142a85b2.exe
-
Size
1.9MB
-
MD5
c2a6692a2bfca323ceca92dcce28da9e
-
SHA1
0bd41cdf86ab77ad73b54889417e2872be88a0bd
-
SHA256
b88b5cc0836571fd67144bb824d9c085f9339baadb7df27c07e17de2142a85b2
-
SHA512
db8498f65a986f1d35232837671647b15916624eb0f8a07de11483f260a7b9f0e16087fa09436cb22facefd9a2f76d1f8e36a350ba04c0107269c172cf968059
Malware Config
Extracted
hawkeye_reborn
9.0.1.6
Protocol: smtp- Host:
mail.gattibufood.com - Port:
587 - Username:
info@gattibufood.com - Password:
Mandy@12345678
3be5e6d8-7909-406b-814d-29663cae33b7
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:false _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:Mandy@12345678 _EmailPort:587 _EmailSSL:true _EmailServer:mail.gattibufood.com _EmailUsername:info@gattibufood.com _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:587 _MeltFile:false _Mutex:3be5e6d8-7909-406b-814d-29663cae33b7 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
M00nD3v Logger payload 1 IoCs
Detects M00nD3v Logger payload in memory.
-
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
-
Nirsoft 7 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b88b5cc0836571fd67144bb824d9c085f9339baadb7df27c07e17de2142a85b2.exe"C:\Users\Admin\AppData\Local\Temp\b88b5cc0836571fd67144bb824d9c085f9339baadb7df27c07e17de2142a85b2.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpB338.tmp"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpB74F.tmp"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\b88b5cc0836571fd67144bb824d9c085f9339baadb7df27c07e17de2142a85b2.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 33⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB338.tmpFilesize
4KB
MD5ae71d1489c720c09cdc02b218976fd51
SHA11cc6d077c844719c4312b3406886672b83733321
SHA256ef9b00f510578bf81d7e764f3fbf5185c75cb5b4faa8e2d0348679110b6bc854
SHA512fb9676057ae018a95ec744af57ea4dc8f3e4a689328418751cf74509022e05aec5130f4328a7cfbbaa8dd3230e1aa8cc73cb82b1ae1245a26d32d1906290ab45
-
memory/260-146-0x0000000000000000-mapping.dmp
-
memory/260-147-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/260-150-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/260-149-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1228-136-0x0000000000000000-mapping.dmp
-
memory/3080-135-0x0000000000000000-mapping.dmp
-
memory/4476-130-0x0000000000320000-0x0000000000518000-memory.dmpFilesize
2.0MB
-
memory/4476-132-0x00000000051C0000-0x000000000525C000-memory.dmpFilesize
624KB
-
memory/4476-131-0x0000000005340000-0x000000000586C000-memory.dmpFilesize
5.2MB
-
memory/4528-138-0x0000000000000000-mapping.dmp
-
memory/4528-139-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/4528-141-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/4528-143-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/4528-144-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/5044-134-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/5044-142-0x0000000070B80000-0x0000000071131000-memory.dmpFilesize
5.7MB
-
memory/5044-137-0x0000000070B80000-0x0000000071131000-memory.dmpFilesize
5.7MB
-
memory/5044-133-0x0000000000000000-mapping.dmp