Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    01/08/2022, 23:52 UTC

General

  • Target

    5b6c76e47de00034b5a7ce230bdd6c4866c76469b0b6f472002b2fd6b72aac44.exe

  • Size

    1.3MB

  • MD5

    955e83cbcf2b5b8cf0629f49fad441ba

  • SHA1

    02c77af40341daf8a8ca2071b2393e661197b9a7

  • SHA256

    5b6c76e47de00034b5a7ce230bdd6c4866c76469b0b6f472002b2fd6b72aac44

  • SHA512

    91282e07dfcd82193d649a5dd6df049af49e1af92b84d4f9932d510e9d1eb779cbed66f0575434ab7cd92970f4f168d90d652fb9613451b23a7ce94919c19609

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    purchase@arabm.us
  • Password:
    success21
Mutex

549ad1f6-42d4-4cda-a6b2-ebde0ffab020

Attributes
  • fields

    map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:false _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:success21 _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:purchase@arabm.us _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:10 _MeltFile:false _Mutex:549ad1f6-42d4-4cda-a6b2-ebde0ffab020 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]

  • name

    HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Signatures

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

  • M00nD3v Logger payload 4 IoCs

    Detects M00nD3v Logger payload in memory.

  • NirSoft MailPassView 4 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 5 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 9 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b6c76e47de00034b5a7ce230bdd6c4866c76469b0b6f472002b2fd6b72aac44.exe
    "C:\Users\Admin\AppData\Local\Temp\5b6c76e47de00034b5a7ce230bdd6c4866c76469b0b6f472002b2fd6b72aac44.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1088
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp37B4.tmp"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1972
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpDCAB.tmp"
        3⤵
        • Accesses Microsoft Outlook accounts
        PID:1316

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp37B4.tmp

    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

  • memory/1088-55-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

  • memory/1088-57-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

  • memory/1088-63-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

  • memory/1088-64-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

  • memory/1088-66-0x00000000749F0000-0x0000000074F9B000-memory.dmp

    Filesize

    5.7MB

  • memory/1088-82-0x00000000749F0000-0x0000000074F9B000-memory.dmp

    Filesize

    5.7MB

  • memory/1316-98-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1316-97-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1316-93-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1316-90-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1316-91-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1316-88-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1316-86-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1316-85-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1348-54-0x00000000766A1000-0x00000000766A3000-memory.dmp

    Filesize

    8KB

  • memory/1972-67-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/1972-83-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/1972-81-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/1972-80-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/1972-76-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/1972-72-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/1972-74-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/1972-70-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/1972-68-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.