Analysis
-
max time kernel
122s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
22-09-2023 03:29
Static task
static1
Behavioral task
behavioral1
Sample
e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f.exe
Resource
win10v2004-20230915-en
General
-
Target
e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f.exe
-
Size
2.1MB
-
MD5
6649115b67af4f2a5eac1af865ede43c
-
SHA1
a7baa999229d188915f25660e344a02ad0107b9e
-
SHA256
e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f
-
SHA512
c954088a9dc94bece5ff6e4fbcef4f9f38395e4a8c960177c09163af5f7ffb8c237a48378816a73b10148dcfecb94989bf721d8cc44eac072f603880c801c8ee
-
SSDEEP
24576:WCdxte/80jYLT3U1jfsWa9L+0aVsXJoWGhq5h1/qKp6hpKNEhQB:fw80cTsjkWa9ty06OrB
Malware Config
Extracted
hawkeye_reborn
9.0.1.6
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
]ismQsWAwgXsX
da3d62c1-c0fb-4948-840e-a27be0eb69ef
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:]ismQsWAwgXsX _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:da3d62c1-c0fb-4948-840e-a27be0eb69ef _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
resource yara_rule behavioral2/memory/3580-1-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger -
NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/4308-26-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/4308-28-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/4308-29-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/4308-31-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/3172-15-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/3172-17-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/3172-18-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/3172-24-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView -
Nirsoft 8 IoCs
resource yara_rule behavioral2/memory/3172-15-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3172-17-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3172-18-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3172-24-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/4308-26-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/4308-28-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/4308-29-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/4308-31-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 49 bot.whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3152 set thread context of 3580 3152 e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f.exe 87 PID 3580 set thread context of 3172 3580 RegAsm.exe 91 PID 3580 set thread context of 4308 3580 RegAsm.exe 92 -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3172 vbc.exe 3172 vbc.exe 3172 vbc.exe 3172 vbc.exe 3172 vbc.exe 3172 vbc.exe 3172 vbc.exe 3172 vbc.exe 3172 vbc.exe 3172 vbc.exe 3172 vbc.exe 3172 vbc.exe 3580 RegAsm.exe 3580 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3580 RegAsm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3152 e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f.exe 3152 e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f.exe 3152 e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3152 e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f.exe 3152 e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f.exe 3152 e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3580 RegAsm.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 3152 wrote to memory of 3580 3152 e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f.exe 87 PID 3152 wrote to memory of 3580 3152 e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f.exe 87 PID 3152 wrote to memory of 3580 3152 e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f.exe 87 PID 3152 wrote to memory of 3580 3152 e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f.exe 87 PID 3152 wrote to memory of 3580 3152 e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f.exe 87 PID 3580 wrote to memory of 3172 3580 RegAsm.exe 91 PID 3580 wrote to memory of 3172 3580 RegAsm.exe 91 PID 3580 wrote to memory of 3172 3580 RegAsm.exe 91 PID 3580 wrote to memory of 3172 3580 RegAsm.exe 91 PID 3580 wrote to memory of 3172 3580 RegAsm.exe 91 PID 3580 wrote to memory of 3172 3580 RegAsm.exe 91 PID 3580 wrote to memory of 3172 3580 RegAsm.exe 91 PID 3580 wrote to memory of 3172 3580 RegAsm.exe 91 PID 3580 wrote to memory of 3172 3580 RegAsm.exe 91 PID 3580 wrote to memory of 4308 3580 RegAsm.exe 92 PID 3580 wrote to memory of 4308 3580 RegAsm.exe 92 PID 3580 wrote to memory of 4308 3580 RegAsm.exe 92 PID 3580 wrote to memory of 4308 3580 RegAsm.exe 92 PID 3580 wrote to memory of 4308 3580 RegAsm.exe 92 PID 3580 wrote to memory of 4308 3580 RegAsm.exe 92 PID 3580 wrote to memory of 4308 3580 RegAsm.exe 92 PID 3580 wrote to memory of 4308 3580 RegAsm.exe 92 PID 3580 wrote to memory of 4308 3580 RegAsm.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f.exe"C:\Users\Admin\AppData\Local\Temp\e7574c264ee15cf16c4f804638d3c1175df476b5eeefb9eea6d0e83a4c753c0f.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpF695.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3172
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpFADC.tmp"3⤵
- Accesses Microsoft Outlook accounts
PID:4308
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD554d17c01d3613ecc97a5d124fe81d1c5
SHA1e01797c68d6fd612a27a37f7ef90b959684eecb7
SHA256c1d2c9a98b16c076536013fec064cb5ef60f426c41d3a139987ee4ff5f30f52e
SHA512b610204d8bb41b6b04ec1b3b4ea604ab8976ebed4303520a176e427dcb963eb8c75fde17039865cbb0852312f05eccf32c5f1f88a7a381939a2112997b32834c