hawkeye_reborn | 5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7

General

Target

5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7.exe
Size

1.2MB
MD5

5b4b715c551523a3acb4d7a5fae1ee51
SHA1

38fa7c681eb3a1c054afa9d403e0d14dfadad5fd
SHA256

5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7
SHA512

d28dd6bf68261ae1b331be0c62c422ae7a487036c48b3879aa213e063606bb6294dc4a89cb3ec2adf3737d7821b8aa996df63672785c3b77fb02d841aee3a286

Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 4 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

Processes:

resource	yara_rule
behavioral1/memory/844-67-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/844-71-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/844-68-0x000000000048B1CE-mapping.dmp	m00nd3v_logger
behavioral1/memory/844-73-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/844-74-0x0000000004B50000-0x0000000004BC6000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 6 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/844-74-0x0000000004B50000-0x0000000004BC6000-memory.dmp	WebBrowserPassView
behavioral1/memory/1200-85-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1200-86-0x000000000044472E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1200-89-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1200-90-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1200-91-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/844-74-0x0000000004B50000-0x0000000004BC6000-memory.dmp	Nirsoft
behavioral1/memory/1200-85-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1200-86-0x000000000044472E-mapping.dmp	Nirsoft
behavioral1/memory/1200-89-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1200-90-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1200-91-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft

Executes dropped EXE 2 IoCs

Processes:

Adobe_ReaderX.exeAdobe_ReaderX.exe

pid process

1336 Adobe_ReaderX.exe
844 Adobe_ReaderX.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
1336	Adobe_ReaderX.exe
844	Adobe_ReaderX.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Adobe_ReaderX.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe_ReaderX = "C:\\Users\\Admin\\AppData\\Local\\Adobe_ReaderX.exe -boot"	Adobe_ReaderX.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Adobe_ReaderX.exeAdobe_ReaderX.exe

description	pid	process	target process
PID 1336 set thread context of 844	1336	Adobe_ReaderX.exe	Adobe_ReaderX.exe
PID 844 set thread context of 1200	844	Adobe_ReaderX.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

vbc.exe

pid process

1200 vbc.exe
1200 vbc.exe
1200 vbc.exe
1200 vbc.exe
1200 vbc.exe

pid	process
1200	vbc.exe
1200	vbc.exe
1200	vbc.exe
1200	vbc.exe
1200	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7.exeAdobe_ReaderX.exe

description	pid	process
Token: SeDebugPrivilege	1656	5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7.exe
Token: SeDebugPrivilege	1336	Adobe_ReaderX.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7.exeexplorer.exeAdobe_ReaderX.exeAdobe_ReaderX.exe

description	pid	process	target process
PID 1656 wrote to memory of 1316	1656	5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7.exe	cmd.exe
PID 1656 wrote to memory of 1316	1656	5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7.exe	cmd.exe
PID 1656 wrote to memory of 1316	1656	5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7.exe	cmd.exe
PID 1656 wrote to memory of 1316	1656	5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7.exe	cmd.exe
PID 1656 wrote to memory of 1268	1656	5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7.exe	explorer.exe
PID 1656 wrote to memory of 1268	1656	5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7.exe	explorer.exe
PID 1656 wrote to memory of 1268	1656	5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7.exe	explorer.exe
PID 1656 wrote to memory of 1268	1656	5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7.exe	explorer.exe
PID 928 wrote to memory of 1336	928	explorer.exe	Adobe_ReaderX.exe
PID 928 wrote to memory of 1336	928	explorer.exe	Adobe_ReaderX.exe
PID 928 wrote to memory of 1336	928	explorer.exe	Adobe_ReaderX.exe
PID 928 wrote to memory of 1336	928	explorer.exe	Adobe_ReaderX.exe
PID 1336 wrote to memory of 844	1336	Adobe_ReaderX.exe	Adobe_ReaderX.exe
PID 1336 wrote to memory of 844	1336	Adobe_ReaderX.exe	Adobe_ReaderX.exe
PID 1336 wrote to memory of 844	1336	Adobe_ReaderX.exe	Adobe_ReaderX.exe
PID 1336 wrote to memory of 844	1336	Adobe_ReaderX.exe	Adobe_ReaderX.exe
PID 1336 wrote to memory of 844	1336	Adobe_ReaderX.exe	Adobe_ReaderX.exe
PID 1336 wrote to memory of 844	1336	Adobe_ReaderX.exe	Adobe_ReaderX.exe
PID 1336 wrote to memory of 844	1336	Adobe_ReaderX.exe	Adobe_ReaderX.exe
PID 1336 wrote to memory of 844	1336	Adobe_ReaderX.exe	Adobe_ReaderX.exe
PID 1336 wrote to memory of 844	1336	Adobe_ReaderX.exe	Adobe_ReaderX.exe
PID 844 wrote to memory of 1200	844	Adobe_ReaderX.exe	vbc.exe
PID 844 wrote to memory of 1200	844	Adobe_ReaderX.exe	vbc.exe
PID 844 wrote to memory of 1200	844	Adobe_ReaderX.exe	vbc.exe
PID 844 wrote to memory of 1200	844	Adobe_ReaderX.exe	vbc.exe
PID 844 wrote to memory of 1200	844	Adobe_ReaderX.exe	vbc.exe
PID 844 wrote to memory of 1200	844	Adobe_ReaderX.exe	vbc.exe
PID 844 wrote to memory of 1200	844	Adobe_ReaderX.exe	vbc.exe
PID 844 wrote to memory of 1200	844	Adobe_ReaderX.exe	vbc.exe
PID 844 wrote to memory of 1200	844	Adobe_ReaderX.exe	vbc.exe
PID 844 wrote to memory of 1200	844	Adobe_ReaderX.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7.exe
"C:\Users\Admin\AppData\Local\Temp\5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7.exe" "C:\Users\Admin\AppData\Local\Adobe_ReaderX.exe"
2⤵
PID:1316

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Local\Adobe_ReaderX.exe"
2⤵
PID:1268

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:928

C:\Users\Admin\AppData\Local\Adobe_ReaderX.exe
"C:\Users\Admin\AppData\Local\Adobe_ReaderX.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1336

C:\Users\Admin\AppData\Local\Adobe_ReaderX.exe
"C:\Users\Admin\AppData\Local\Adobe_ReaderX.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp2E33.tmp"
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1200

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Adobe_ReaderX.exe
Filesize
1.2MB

MD5
5b4b715c551523a3acb4d7a5fae1ee51

SHA1
38fa7c681eb3a1c054afa9d403e0d14dfadad5fd

SHA256
5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7

SHA512
d28dd6bf68261ae1b331be0c62c422ae7a487036c48b3879aa213e063606bb6294dc4a89cb3ec2adf3737d7821b8aa996df63672785c3b77fb02d841aee3a286

Download Submit
C:\Users\Admin\AppData\Local\Adobe_ReaderX.exe
Filesize
1.2MB

MD5
5b4b715c551523a3acb4d7a5fae1ee51

SHA1
38fa7c681eb3a1c054afa9d403e0d14dfadad5fd

SHA256
5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7

SHA512
d28dd6bf68261ae1b331be0c62c422ae7a487036c48b3879aa213e063606bb6294dc4a89cb3ec2adf3737d7821b8aa996df63672785c3b77fb02d841aee3a286

Download Submit
C:\Users\Admin\AppData\Local\Adobe_ReaderX.exe
Filesize
1.2MB

MD5
5b4b715c551523a3acb4d7a5fae1ee51

SHA1
38fa7c681eb3a1c054afa9d403e0d14dfadad5fd

SHA256
5a856d743bad4ceb35ef2aa7fa4239098f35c001a4d10b05b0bdd604fa49f3e7

SHA512
d28dd6bf68261ae1b331be0c62c422ae7a487036c48b3879aa213e063606bb6294dc4a89cb3ec2adf3737d7821b8aa996df63672785c3b77fb02d841aee3a286

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2E33.tmp
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/844-68-0x000000000048B1CE-mapping.dmp

Download
memory/844-67-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/844-74-0x0000000004B50000-0x0000000004BC6000-memory.dmp

Filesize
472KB

Download
memory/844-73-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/844-71-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/928-61-0x000007FEFB751000-0x000007FEFB753000-memory.dmp

Filesize
8KB

Download
memory/1200-81-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1200-86-0x000000000044472E-mapping.dmp

Download
memory/1200-91-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1200-90-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1200-89-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1200-85-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1200-83-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1200-76-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1200-77-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1200-79-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1268-60-0x000000006F7D1000-0x000000006F7D3000-memory.dmp

Filesize
8KB

Download
memory/1268-58-0x0000000000000000-mapping.dmp

Download
memory/1316-57-0x0000000000000000-mapping.dmp

Download
memory/1336-63-0x0000000000000000-mapping.dmp

Download
memory/1336-65-0x00000000013D0000-0x000000000150C000-memory.dmp

Filesize
1.2MB

Download
memory/1656-54-0x00000000009B0000-0x0000000000AEC000-memory.dmp

Filesize
1.2MB

Download
memory/1656-56-0x0000000000590000-0x00000000005B0000-memory.dmp

Filesize
128KB

Download
memory/1656-55-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads