Analysis
-
max time kernel
173s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 17:09
Static task
static1
Behavioral task
behavioral1
Sample
5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe
Resource
win10v2004-20221111-en
General
-
Target
5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe
-
Size
2.1MB
-
MD5
f7835d63004df191a84914a8bbf7caaa
-
SHA1
68eb4d98ac8b80ffae1874ebc72b2315f172b6e9
-
SHA256
5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f
-
SHA512
abe31479e2d64faa0f328a11abdd388f0172e0e2b22eae6e74f15f90332c7ac4ca19012330d301fa8bf6f7cc6ee554d6a7026ffcc2c591129ef93c47d3187f84
-
SSDEEP
24576:/AHnh+eWsN3skA4RV1Hom2KXMmHa3O+KHeAsUPVjvJ3ad6P9uQETtB7DX0iK5:ih+ZkldoPK8Ya3NZtY
Malware Config
Extracted
hawkeye_reborn
9.0.1.6
Protocol: smtp- Host:
mail.coniketransport.com - Port:
26 - Username:
de@coniketransport.com - Password:
goodyear@2019
90882945-8989-48e8-bd21-21066212c105
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:goodyear@2019 _EmailPort:26 _EmailSSL:false _EmailServer:mail.coniketransport.com _EmailUsername:de@coniketransport.com _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:280 _MeltFile:false _Mutex:90882945-8989-48e8-bd21-21066212c105 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
Processes:
resource yara_rule behavioral2/memory/2100-134-0x0000000000800000-0x0000000000890000-memory.dmp m00nd3v_logger -
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/2420-151-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/2420-153-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/2420-154-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/400-144-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/400-146-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/400-147-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/400-148-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
Processes:
resource yara_rule behavioral2/memory/400-144-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/400-146-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/400-147-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/400-148-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/2420-151-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/2420-153-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/2420-154-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe -
Drops startup file 1 IoCs
Processes:
5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEChooser.url 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exeRegAsm.exedescription pid process target process PID 3712 set thread context of 2100 3712 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe RegAsm.exe PID 2100 set thread context of 400 2100 RegAsm.exe vbc.exe PID 2100 set thread context of 2420 2100 RegAsm.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
vbc.exepid process 400 vbc.exe 400 vbc.exe 400 vbc.exe 400 vbc.exe 400 vbc.exe 400 vbc.exe 400 vbc.exe 400 vbc.exe 400 vbc.exe 400 vbc.exe 400 vbc.exe 400 vbc.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exepid process 3712 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe 3712 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe 3712 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe 3712 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exepid process 3712 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe 3712 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe 3712 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe 3712 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.execmd.exeRegAsm.exedescription pid process target process PID 3712 wrote to memory of 2100 3712 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe RegAsm.exe PID 3712 wrote to memory of 2100 3712 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe RegAsm.exe PID 3712 wrote to memory of 2100 3712 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe RegAsm.exe PID 3712 wrote to memory of 2100 3712 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe RegAsm.exe PID 3712 wrote to memory of 2100 3712 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe RegAsm.exe PID 3712 wrote to memory of 2908 3712 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe cmd.exe PID 3712 wrote to memory of 2908 3712 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe cmd.exe PID 3712 wrote to memory of 2908 3712 5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe cmd.exe PID 2908 wrote to memory of 3756 2908 cmd.exe PING.EXE PID 2908 wrote to memory of 3756 2908 cmd.exe PING.EXE PID 2908 wrote to memory of 3756 2908 cmd.exe PING.EXE PID 2100 wrote to memory of 400 2100 RegAsm.exe vbc.exe PID 2100 wrote to memory of 400 2100 RegAsm.exe vbc.exe PID 2100 wrote to memory of 400 2100 RegAsm.exe vbc.exe PID 2100 wrote to memory of 400 2100 RegAsm.exe vbc.exe PID 2100 wrote to memory of 400 2100 RegAsm.exe vbc.exe PID 2100 wrote to memory of 400 2100 RegAsm.exe vbc.exe PID 2100 wrote to memory of 400 2100 RegAsm.exe vbc.exe PID 2100 wrote to memory of 400 2100 RegAsm.exe vbc.exe PID 2100 wrote to memory of 400 2100 RegAsm.exe vbc.exe PID 2100 wrote to memory of 2420 2100 RegAsm.exe vbc.exe PID 2100 wrote to memory of 2420 2100 RegAsm.exe vbc.exe PID 2100 wrote to memory of 2420 2100 RegAsm.exe vbc.exe PID 2100 wrote to memory of 2420 2100 RegAsm.exe vbc.exe PID 2100 wrote to memory of 2420 2100 RegAsm.exe vbc.exe PID 2100 wrote to memory of 2420 2100 RegAsm.exe vbc.exe PID 2100 wrote to memory of 2420 2100 RegAsm.exe vbc.exe PID 2100 wrote to memory of 2420 2100 RegAsm.exe vbc.exe PID 2100 wrote to memory of 2420 2100 RegAsm.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe"C:\Users\Admin\AppData\Local\Temp\5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp3AB2.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp49B7.tmp"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\5e1c47b5cc6816b687126c26231578083c1b3ee2541836b58bb01452592adb5f.exe & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -t 03⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3AB2.tmpFilesize
4KB
MD59945b47a62f116c5707cfe39eba4e3a3
SHA13a891690b33791216df5ca70ff15c288b8ec3223
SHA256bec9bca76621ea0f0db461945ca513d00aba466d4cf882a437a8de82075784f1
SHA5127c0ba560d4332ca00c6b2e3e938c50e7006b0775ba2eec3ff287adf656de508795be097a6a12d9f3cb9a43ac63c0f52f2574ad1cdebe868fd4ac02e683687e48
-
memory/400-148-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/400-143-0x0000000000000000-mapping.dmp
-
memory/400-144-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/400-146-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/400-147-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2100-134-0x0000000000800000-0x0000000000890000-memory.dmpFilesize
576KB
-
memory/2100-139-0x0000000073710000-0x0000000073CC1000-memory.dmpFilesize
5.7MB
-
memory/2100-133-0x0000000000000000-mapping.dmp
-
memory/2100-142-0x0000000073710000-0x0000000073CC1000-memory.dmpFilesize
5.7MB
-
memory/2420-150-0x0000000000000000-mapping.dmp
-
memory/2420-151-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2420-153-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2420-154-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2908-140-0x0000000000000000-mapping.dmp
-
memory/3756-141-0x0000000000000000-mapping.dmp