Analysis
-
max time kernel
210s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 19:18
Static task
static1
Behavioral task
behavioral1
Sample
a55c42d0a26779f590536012e11806639c58d901a3d7aab545a371b9bc84ba9e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a55c42d0a26779f590536012e11806639c58d901a3d7aab545a371b9bc84ba9e.exe
Resource
win10v2004-20221111-en
General
-
Target
a55c42d0a26779f590536012e11806639c58d901a3d7aab545a371b9bc84ba9e.exe
-
Size
2.0MB
-
MD5
f2ee37eab3cd4e3ec20f186474058808
-
SHA1
60ab1cd407174c95e5a72183a7d707b6cd6ebccf
-
SHA256
a55c42d0a26779f590536012e11806639c58d901a3d7aab545a371b9bc84ba9e
-
SHA512
f378b81dfc8a85a4c6f106a56bfe950e377d836086f8c0c2ed13db32f8c3b422da5b22ed8f7b1e1d37725ebf8e1e8f8ee1dfe16628243c274a8895e455a52d86
-
SSDEEP
24576:EAHnh+eWsN3skA4RV1Hom2KXMmHa+dp1NE0x3IE9Gs3Twbda54nDEVGaqi1L5:Th+ZkldoPK8Yacn
Malware Config
Extracted
hawkeye_reborn
9.0.1.6
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
$xP.KtUr1fc1]
ee71f51d-b2cc-4836-9d78-8192533d9d31
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:$xP.KtUr1fc1] _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:ee71f51d-b2cc-4836-9d78-8192533d9d31 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
resource yara_rule behavioral2/memory/3776-133-0x0000000000760000-0x00000000007F0000-memory.dmp m00nd3v_logger -
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/4336-149-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/4336-151-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/4336-152-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/2572-142-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/2572-144-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/2572-145-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/2572-146-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
resource yara_rule behavioral2/memory/2572-142-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/2572-144-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/2572-145-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/2572-146-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/4336-149-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/4336-151-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/4336-152-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation a55c42d0a26779f590536012e11806639c58d901a3d7aab545a371b9bc84ba9e.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2760 set thread context of 3776 2760 a55c42d0a26779f590536012e11806639c58d901a3d7aab545a371b9bc84ba9e.exe 80 PID 3776 set thread context of 2572 3776 RegAsm.exe 83 PID 3776 set thread context of 4336 3776 RegAsm.exe 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4160 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2572 vbc.exe 2572 vbc.exe 2572 vbc.exe 2572 vbc.exe 2572 vbc.exe 2572 vbc.exe 2572 vbc.exe 2572 vbc.exe 2572 vbc.exe 2572 vbc.exe 2572 vbc.exe 2572 vbc.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2760 wrote to memory of 3776 2760 a55c42d0a26779f590536012e11806639c58d901a3d7aab545a371b9bc84ba9e.exe 80 PID 2760 wrote to memory of 3776 2760 a55c42d0a26779f590536012e11806639c58d901a3d7aab545a371b9bc84ba9e.exe 80 PID 2760 wrote to memory of 3776 2760 a55c42d0a26779f590536012e11806639c58d901a3d7aab545a371b9bc84ba9e.exe 80 PID 2760 wrote to memory of 3776 2760 a55c42d0a26779f590536012e11806639c58d901a3d7aab545a371b9bc84ba9e.exe 80 PID 2760 wrote to memory of 3776 2760 a55c42d0a26779f590536012e11806639c58d901a3d7aab545a371b9bc84ba9e.exe 80 PID 2760 wrote to memory of 4160 2760 a55c42d0a26779f590536012e11806639c58d901a3d7aab545a371b9bc84ba9e.exe 81 PID 2760 wrote to memory of 4160 2760 a55c42d0a26779f590536012e11806639c58d901a3d7aab545a371b9bc84ba9e.exe 81 PID 2760 wrote to memory of 4160 2760 a55c42d0a26779f590536012e11806639c58d901a3d7aab545a371b9bc84ba9e.exe 81 PID 3776 wrote to memory of 2572 3776 RegAsm.exe 83 PID 3776 wrote to memory of 2572 3776 RegAsm.exe 83 PID 3776 wrote to memory of 2572 3776 RegAsm.exe 83 PID 3776 wrote to memory of 2572 3776 RegAsm.exe 83 PID 3776 wrote to memory of 2572 3776 RegAsm.exe 83 PID 3776 wrote to memory of 2572 3776 RegAsm.exe 83 PID 3776 wrote to memory of 2572 3776 RegAsm.exe 83 PID 3776 wrote to memory of 2572 3776 RegAsm.exe 83 PID 3776 wrote to memory of 2572 3776 RegAsm.exe 83 PID 3776 wrote to memory of 4336 3776 RegAsm.exe 86 PID 3776 wrote to memory of 4336 3776 RegAsm.exe 86 PID 3776 wrote to memory of 4336 3776 RegAsm.exe 86 PID 3776 wrote to memory of 4336 3776 RegAsm.exe 86 PID 3776 wrote to memory of 4336 3776 RegAsm.exe 86 PID 3776 wrote to memory of 4336 3776 RegAsm.exe 86 PID 3776 wrote to memory of 4336 3776 RegAsm.exe 86 PID 3776 wrote to memory of 4336 3776 RegAsm.exe 86 PID 3776 wrote to memory of 4336 3776 RegAsm.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a55c42d0a26779f590536012e11806639c58d901a3d7aab545a371b9bc84ba9e.exe"C:\Users\Admin\AppData\Local\Temp\a55c42d0a26779f590536012e11806639c58d901a3d7aab545a371b9bc84ba9e.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp77FA.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2572
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp9FD6.tmp"3⤵
- Accesses Microsoft Outlook accounts
PID:4336
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn /tr "C:\Users\Admin\RegAsm\RegAsm.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4160
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD58937ec50df53642622ba77b9b2dfe88f
SHA176e19a0efe5cf6eac0a3bbb81f4a3f12d46d095d
SHA256e35d3c41759c879026d522ee9c6d5e8afb7ec045856d456d50170306c321f363
SHA5126aedc7c3c8b5b883f0f944fc8da54d4c0ae85afc8278765c229f4efa28776cba4b37c80bfa7035f358a251c5ef816c0bde805ce70e18052ee291f5d27e07153c