Resubmissions
26/02/2024, 03:29
240226-d2btzacb9w1021/02/2024, 10:44
240221-ms4m3aef651014/02/2024, 10:19
240214-mcq22agh2810Analysis
- max time kernel
105s - max time network
116s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
- submitted
21/02/2024, 10:44
General
- Target 9b6b4686d55afe1479011ee77b5ffb24.exe
- Size 526KB
- Sample240221-ms4m3aef65
- SHA256 c0498d7a70e78c236241d0e91b3bb599c1961ea62a10bd76a16fe7b18824f646
Malware Config
Extracted
-
hawkeye_reborn
- fields
- name
Signatures
- HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
- M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- M00nD3v Logger payload 1 IoCs
Detects M00nD3v Logger payload in memory.
- NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
- Nirsoft 7 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b6b4686d55afe1479011ee77b5ffb24.exe"C:\Users\Admin\AppData\Local\Temp\9b6b4686d55afe1479011ee77b5ffb24.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9b6b4686d55afe1479011ee77b5ffb24.exe"C:\Users\Admin\AppData\Local\Temp\9b6b4686d55afe1479011ee77b5ffb24.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpBF77.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpC38F.tmp"3⤵
- Accesses Microsoft Outlook accounts
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 10882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2464 -ip 24641⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmpBF77.tmp
memory/2464-1-0x0000000075560000-0x0000000075B11000-memory.dmp
memory/2464-2-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2464-10-0x0000000075560000-0x0000000075B11000-memory.dmp
memory/2464-0-0x0000000075560000-0x0000000075B11000-memory.dmp
memory/3408-5-0x0000000000400000-0x0000000000490000-memory.dmp
memory/3408-6-0x0000000075560000-0x0000000075B11000-memory.dmp
memory/3408-7-0x0000000001840000-0x0000000001850000-memory.dmp
memory/3408-8-0x0000000075560000-0x0000000075B11000-memory.dmp
memory/3408-31-0x0000000001840000-0x0000000001850000-memory.dmp
memory/3408-30-0x0000000001840000-0x0000000001850000-memory.dmp
memory/3408-29-0x0000000075560000-0x0000000075B11000-memory.dmp
memory/4572-25-0x0000000000400000-0x000000000041C000-memory.dmp
memory/4572-23-0x0000000000400000-0x000000000041C000-memory.dmp
memory/4572-27-0x0000000000400000-0x000000000041C000-memory.dmp
memory/4756-21-0x0000000000400000-0x000000000045B000-memory.dmp
memory/4756-20-0x0000000000460000-0x0000000000529000-memory.dmp
memory/4756-15-0x0000000000400000-0x000000000045B000-memory.dmp
memory/4756-14-0x0000000000400000-0x000000000045B000-memory.dmp
memory/4756-12-0x0000000000400000-0x000000000045B000-memory.dmp