Resubmissions
26/02/2024, 03:29
240226-d2btzacb9w1021/02/2024, 10:44
240221-ms4m3aef651014/02/2024, 10:19
240214-mcq22agh2810Analysis
- max time kernel
145s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
14/02/2024, 10:19
General
- Target 9b6b4686d55afe1479011ee77b5ffb24.exe
- Size 526KB
- Sample240214-mcq22agh28
- SHA256 c0498d7a70e78c236241d0e91b3bb599c1961ea62a10bd76a16fe7b18824f646
Malware Config
Extracted
-
hawkeye_reborn
- fields
- name
Signatures
- HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
- M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- M00nD3v Logger payload 1 IoCs
Detects M00nD3v Logger payload in memory.
- NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
- Nirsoft 8 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b6b4686d55afe1479011ee77b5ffb24.exe"C:\Users\Admin\AppData\Local\Temp\9b6b4686d55afe1479011ee77b5ffb24.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9b6b4686d55afe1479011ee77b5ffb24.exe"C:\Users\Admin\AppData\Local\Temp\9b6b4686d55afe1479011ee77b5ffb24.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpCC25.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpE5F7.tmp"3⤵
- Accesses Microsoft Outlook accounts
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 10842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2248 -ip 22481⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmpCC25.tmp
memory/1704-30-0x0000000000400000-0x000000000041C000-memory.dmp
memory/1704-28-0x0000000000400000-0x000000000041C000-memory.dmp
memory/1704-25-0x0000000000400000-0x000000000041C000-memory.dmp
memory/1704-23-0x0000000000400000-0x000000000041C000-memory.dmp
memory/2216-26-0x0000000074D30000-0x00000000752E1000-memory.dmp
memory/2216-27-0x0000000001810000-0x0000000001820000-memory.dmp
memory/2216-34-0x0000000001810000-0x0000000001820000-memory.dmp
memory/2216-33-0x0000000001810000-0x0000000001820000-memory.dmp
memory/2216-32-0x0000000001810000-0x0000000001820000-memory.dmp
memory/2216-31-0x0000000001810000-0x0000000001820000-memory.dmp
memory/2216-8-0x0000000074D30000-0x00000000752E1000-memory.dmp
memory/2216-7-0x0000000001810000-0x0000000001820000-memory.dmp
memory/2216-6-0x0000000074D30000-0x00000000752E1000-memory.dmp
memory/2216-5-0x0000000000400000-0x0000000000490000-memory.dmp
memory/2248-1-0x0000000001070000-0x0000000001080000-memory.dmp
memory/2248-0-0x0000000074D30000-0x00000000752E1000-memory.dmp
memory/2248-2-0x0000000074D30000-0x00000000752E1000-memory.dmp
memory/2248-10-0x0000000074D30000-0x00000000752E1000-memory.dmp
memory/3700-21-0x0000000000400000-0x000000000045B000-memory.dmp
memory/3700-15-0x0000000000400000-0x000000000045B000-memory.dmp
memory/3700-14-0x0000000000400000-0x000000000045B000-memory.dmp
memory/3700-12-0x0000000000400000-0x000000000045B000-memory.dmp