Analysis
-
max time kernel
152s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
30-11-2022 18:25
General
-
Target
9cd84779bad177eec59b8487a4b8d721111f9b4a7060d2e90b8f39f3a7f5e6d0.exe
-
Size
933KB
-
MD5
3bb43fd0782d5cd38ba6f3668620d66e
-
SHA1
c4235bbf67ed3b480bf9fdbeefd01d65ea1c4996
-
SHA256
9cd84779bad177eec59b8487a4b8d721111f9b4a7060d2e90b8f39f3a7f5e6d0
-
SHA512
79344aa089642690687143c338bf518e77089f0ae002ca9a4ffea645b799520ea2acd74af6d0c21f78a0c2df5f112a81d104ded62670d2212303e5d6bab007ca
-
SSDEEP
24576:frl6kD68JmlokQf2mYev5fDmWc45paT5OMhtG3:jl328U2pf2AlD95paT5thtG
Malware Config
Extracted
hawkeye_reborn
9.0.1.6
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
amirjonazamatov@yandex.ru - Password:
cynthia$12
14a72b54-8e67-4361-a777-297577014805
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:cynthia$12 _EmailPort:587 _EmailSSL:true _EmailServer:smtp.yandex.ru _EmailUsername:amirjonazamatov@yandex.ru _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:14a72b54-8e67-4361-a777-297577014805 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
M00nD3v Logger payload 1 IoCs
Detects M00nD3v Logger payload in memory.
-
NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
-
Nirsoft 8 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cd84779bad177eec59b8487a4b8d721111f9b4a7060d2e90b8f39f3a7f5e6d0.exe"C:\Users\Admin\AppData\Local\Temp\9cd84779bad177eec59b8487a4b8d721111f9b4a7060d2e90b8f39f3a7f5e6d0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpA6DF.tmp"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpAFB9.tmp"3⤵
- Accesses Microsoft Outlook accounts
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA6DF.tmpFilesize
4KB
MD5952a930b9fe70f809a67cb4e765c9448
SHA17e6c235246cc1be14d8a01ee7688a2a2471d44c9
SHA256bd8156713974af3003c418302d3647fa84f62836fe83613c05e8bc40cb06a867
SHA51210d12f2412fd2cb9ecf47cccd0261b17d9a3323957602c06795c4b2244306837d0a979ec6e552dc023ee81719ebcb9455bdb6f9d44f07788664994d1498452fb
-
memory/1400-154-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1400-153-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1400-151-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1400-149-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1400-148-0x0000000000000000-mapping.dmp
-
memory/3248-133-0x0000000000190000-0x000000000038E000-memory.dmpFilesize
2.0MB
-
memory/3248-132-0x0000000000190000-0x000000000038E000-memory.dmpFilesize
2.0MB
-
memory/3496-140-0x0000000074610000-0x0000000074BC1000-memory.dmpFilesize
5.7MB
-
memory/3496-141-0x0000000074610000-0x0000000074BC1000-memory.dmpFilesize
5.7MB
-
memory/3496-135-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/3496-134-0x0000000000000000-mapping.dmp
-
memory/3504-146-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/3504-145-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/3504-143-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/3504-142-0x0000000000000000-mapping.dmp
-
memory/3504-152-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB