Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 16:28
Static task
static1
Behavioral task
behavioral1
Sample
1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25.exe
Resource
win10v2004-20220812-en
General
-
Target
1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25.exe
-
Size
2.4MB
-
MD5
ec95f296d9751f88130c0250b06a3a2d
-
SHA1
7969844cb2c4cfe26c2fa1787af596a69ea6fe6b
-
SHA256
1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25
-
SHA512
f4d2854300bb4fb16679a58b75332bf1b9965e250aa73da14ddb8724502dea5efe09374d19960661dc7c68d1976bdb9255e17597fbd6807333f1d8b324726f19
-
SSDEEP
24576:Xu6J33O0c+JY5UZ+XC0kGso6Fa8g0PJS77cpKfOkI5rmvAxtSE2SZ9AuNalU+Y/D:xu0c++OCvkGs9Fa8oE2SZ5OY/eADIY
Malware Config
Extracted
hawkeye_reborn
9.0.1.6
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
sale@sheibnigroup.com - Password:
!ymi9!v5%rE[c
fdb3fc3f-6168-4562-8bb3-bcdf02593bc4
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:!ymi9!v5%rE[c _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:sale@sheibnigroup.com _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:fdb3fc3f-6168-4562-8bb3-bcdf02593bc4 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
Processes:
resource yara_rule behavioral2/memory/4404-133-0x0000000000500000-0x0000000000590000-memory.dmp m00nd3v_logger -
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/1820-149-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/1820-151-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/1820-152-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/4928-142-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/4928-144-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/4928-145-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/4928-146-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
Processes:
resource yara_rule behavioral2/memory/4928-142-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/4928-144-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/4928-145-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/4928-146-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/1820-149-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/1820-151-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/1820-152-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 37 bot.whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25.exeRegAsm.exedescription pid process target process PID 2228 set thread context of 4404 2228 1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25.exe RegAsm.exe PID 4404 set thread context of 4928 4404 RegAsm.exe vbc.exe PID 4404 set thread context of 1820 4404 RegAsm.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
vbc.exeRegAsm.exepid process 4928 vbc.exe 4928 vbc.exe 4928 vbc.exe 4928 vbc.exe 4928 vbc.exe 4928 vbc.exe 4928 vbc.exe 4928 vbc.exe 4928 vbc.exe 4928 vbc.exe 4928 vbc.exe 4928 vbc.exe 4404 RegAsm.exe 4404 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 4404 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 4404 RegAsm.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25.exeRegAsm.exedescription pid process target process PID 2228 wrote to memory of 4404 2228 1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25.exe RegAsm.exe PID 2228 wrote to memory of 4404 2228 1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25.exe RegAsm.exe PID 2228 wrote to memory of 4404 2228 1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25.exe RegAsm.exe PID 2228 wrote to memory of 4404 2228 1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25.exe RegAsm.exe PID 2228 wrote to memory of 4404 2228 1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25.exe RegAsm.exe PID 2228 wrote to memory of 1112 2228 1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25.exe schtasks.exe PID 2228 wrote to memory of 1112 2228 1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25.exe schtasks.exe PID 2228 wrote to memory of 1112 2228 1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25.exe schtasks.exe PID 4404 wrote to memory of 4928 4404 RegAsm.exe vbc.exe PID 4404 wrote to memory of 4928 4404 RegAsm.exe vbc.exe PID 4404 wrote to memory of 4928 4404 RegAsm.exe vbc.exe PID 4404 wrote to memory of 4928 4404 RegAsm.exe vbc.exe PID 4404 wrote to memory of 4928 4404 RegAsm.exe vbc.exe PID 4404 wrote to memory of 4928 4404 RegAsm.exe vbc.exe PID 4404 wrote to memory of 4928 4404 RegAsm.exe vbc.exe PID 4404 wrote to memory of 4928 4404 RegAsm.exe vbc.exe PID 4404 wrote to memory of 4928 4404 RegAsm.exe vbc.exe PID 4404 wrote to memory of 1820 4404 RegAsm.exe vbc.exe PID 4404 wrote to memory of 1820 4404 RegAsm.exe vbc.exe PID 4404 wrote to memory of 1820 4404 RegAsm.exe vbc.exe PID 4404 wrote to memory of 1820 4404 RegAsm.exe vbc.exe PID 4404 wrote to memory of 1820 4404 RegAsm.exe vbc.exe PID 4404 wrote to memory of 1820 4404 RegAsm.exe vbc.exe PID 4404 wrote to memory of 1820 4404 RegAsm.exe vbc.exe PID 4404 wrote to memory of 1820 4404 RegAsm.exe vbc.exe PID 4404 wrote to memory of 1820 4404 RegAsm.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25.exe"C:\Users\Admin\AppData\Local\Temp\1bf5c3c7195489b2563cd26fc2cc672788bda18d5c612005161027f4b9652c25.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpBD98.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpC29A.tmp"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn /tr "C:\Users\Admin\RegAsm\RegAsm.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpBD98.tmpFilesize
4KB
MD530177e1276595fd69ea96b692f49d776
SHA175769c29031ca1ad8e175dd700c74b5e35c5b0c7
SHA25676d4066990e2ee2776f733a25ce23e9af545fd6f1a3b5760d603bdc05d9402d5
SHA512ccdf20174d299de8ec21445faaf4ebe95c04bd7634c9fe138ba54262b754620c2dfd53a5c94b7d53518181d2eab7b5c97d7933d3a66d05220b06aee120893d4b
-
memory/1112-138-0x0000000000000000-mapping.dmp
-
memory/1820-152-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1820-151-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1820-149-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1820-148-0x0000000000000000-mapping.dmp
-
memory/4404-133-0x0000000000500000-0x0000000000590000-memory.dmpFilesize
576KB
-
memory/4404-139-0x0000000074420000-0x00000000749D1000-memory.dmpFilesize
5.7MB
-
memory/4404-140-0x0000000074420000-0x00000000749D1000-memory.dmpFilesize
5.7MB
-
memory/4404-132-0x0000000000000000-mapping.dmp
-
memory/4928-142-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/4928-146-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/4928-145-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/4928-144-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/4928-141-0x0000000000000000-mapping.dmp