Analysis

  • max time kernel
    135s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-05-2024 18:23

General

  • Target

    DAILY PICK UP DETAILS.exe

  • Size

    925KB

  • MD5

    5bf757b62ee654ad58118227ffc8ef5d

  • SHA1

    81f0a4c130ec7ac0fc61a40856c20ce0e3f0b1bf

  • SHA256

    faf2bc046695592f8a809a0864f71a326206f9dd4075ac36fedc95654f99ce91

  • SHA512

    d17e8b3c10a613a9af5a04e901862bf179dab8320895ee94ad1a9ac6d06b7378d2ee7dca8bc95f5489aaaff328632b24055cf1c13723fb19eb356d910ba2ed9c

  • SSDEEP

    24576:hQiSpPmlPPUTBW8LoaTVDcolx3UeT0vpJ0rmQKH5/t9AA:uiSAlndGd3xkeovpJ0rqH5

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

  • Protocol:
    smtp
  • Host:
    mail.oppobihar.in
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    oppo@12345
Mutex

ba1e53be-21d5-4b75-92f5-e24f34036bcb

Attributes
  • fields

    map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:oppo@12345 _EmailPort:587 _EmailSSL:false _EmailServer:mail.oppobihar.in _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:ba1e53be-21d5-4b75-92f5-e24f34036bcb _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]

  • name

    HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Signatures

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • M00nD3v Logger payload 1 IoCs

    Detects M00nD3v Logger payload in memory.

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 4 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 7 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Uses the VBS compiler for execution 1 TTPs
  • Windows security modification 2 TTPs 2 IoCs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DAILY PICK UP DETAILS.exe
    "C:\Users\Admin\AppData\Local\Temp\DAILY PICK UP DETAILS.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Windows security modification
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4980
    • C:\Users\Admin\AppData\Local\Temp\DAILY PICK UP DETAILS.exe
      "C:\Users\Admin\AppData\Local\Temp\DAILY PICK UP DETAILS.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:900
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp6230.tmp"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1760
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp6657.tmp"
        3⤵
        • Accesses Microsoft Outlook accounts
        PID:3268

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\DAILY PICK UP DETAILS.exe.log

    Filesize

    680B

    MD5

    f94345ac912a59f4e45424d0f5097e7d

    SHA1

    e77ca1a71f479dbef84049c6c4a5a036f009888a

    SHA256

    5b8473c0e3ca2187c394644e5c0e0b65bd10dcd5bb5422da927cba7b1caf3100

    SHA512

    68a9fbb50900b21c2e6712a7f8ee834c86f61e02a426268a5a2ee3cedcb235e5be67e26fbee164835fd1aab95a76bec304cb34b7a16610f82576373bd16b55a1

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gaf4xulg.xug.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmp6230.tmp

    Filesize

    4KB

    MD5

    2f9f3e06c08fbefb9d972eb45910783e

    SHA1

    f8452829b8404981ee3f7ac2f8f4b16825014c14

    SHA256

    41fcf3117cab8796adc9854cf66a6533fc2766f0e36abdaf04ce5fd7c13f5a50

    SHA512

    db33ff568a991b3b7d6574e0b4514236f22d3df30c26593a18d7f2d879be2f6831e9d9361800ca349303ba9c43591643f04c090fb16dfc99f7301e197ff48dec

  • memory/900-76-0x0000000075570000-0x0000000075B21000-memory.dmp

    Filesize

    5.7MB

  • memory/900-58-0x0000000075570000-0x0000000075B21000-memory.dmp

    Filesize

    5.7MB

  • memory/900-53-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

  • memory/900-75-0x0000000075572000-0x0000000075573000-memory.dmp

    Filesize

    4KB

  • memory/900-56-0x0000000075572000-0x0000000075573000-memory.dmp

    Filesize

    4KB

  • memory/1760-62-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/1760-63-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/1760-60-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/1760-68-0x0000000000460000-0x0000000000529000-memory.dmp

    Filesize

    804KB

  • memory/1760-69-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2748-2-0x0000000075570000-0x0000000075B21000-memory.dmp

    Filesize

    5.7MB

  • memory/2748-0-0x0000000075572000-0x0000000075573000-memory.dmp

    Filesize

    4KB

  • memory/2748-4-0x0000000075570000-0x0000000075B21000-memory.dmp

    Filesize

    5.7MB

  • memory/2748-3-0x0000000075572000-0x0000000075573000-memory.dmp

    Filesize

    4KB

  • memory/2748-57-0x0000000075570000-0x0000000075B21000-memory.dmp

    Filesize

    5.7MB

  • memory/2748-1-0x0000000075570000-0x0000000075B21000-memory.dmp

    Filesize

    5.7MB

  • memory/2748-52-0x0000000000D60000-0x0000000000D70000-memory.dmp

    Filesize

    64KB

  • memory/3268-71-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/3268-72-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/3268-74-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/4980-11-0x0000000006030000-0x0000000006096000-memory.dmp

    Filesize

    408KB

  • memory/4980-36-0x0000000006CB0000-0x0000000006CCE000-memory.dmp

    Filesize

    120KB

  • memory/4980-42-0x0000000007AC0000-0x0000000007ACA000-memory.dmp

    Filesize

    40KB

  • memory/4980-43-0x0000000007CD0000-0x0000000007D66000-memory.dmp

    Filesize

    600KB

  • memory/4980-44-0x0000000007C50000-0x0000000007C61000-memory.dmp

    Filesize

    68KB

  • memory/4980-45-0x0000000007C80000-0x0000000007C8E000-memory.dmp

    Filesize

    56KB

  • memory/4980-46-0x0000000007C90000-0x0000000007CA4000-memory.dmp

    Filesize

    80KB

  • memory/4980-47-0x0000000007D90000-0x0000000007DAA000-memory.dmp

    Filesize

    104KB

  • memory/4980-48-0x0000000007D70000-0x0000000007D78000-memory.dmp

    Filesize

    32KB

  • memory/4980-51-0x0000000072E50000-0x0000000073600000-memory.dmp

    Filesize

    7.7MB

  • memory/4980-41-0x00000000054A0000-0x00000000054BA000-memory.dmp

    Filesize

    104KB

  • memory/4980-38-0x00000000078E0000-0x0000000007983000-memory.dmp

    Filesize

    652KB

  • memory/4980-39-0x0000000072E50000-0x0000000073600000-memory.dmp

    Filesize

    7.7MB

  • memory/4980-40-0x0000000008080000-0x00000000086FA000-memory.dmp

    Filesize

    6.5MB

  • memory/4980-37-0x0000000072E50000-0x0000000073600000-memory.dmp

    Filesize

    7.7MB

  • memory/4980-26-0x000000006F2F0000-0x000000006F33C000-memory.dmp

    Filesize

    304KB

  • memory/4980-25-0x0000000006CD0000-0x0000000006D02000-memory.dmp

    Filesize

    200KB

  • memory/4980-24-0x0000000006740000-0x000000000678C000-memory.dmp

    Filesize

    304KB

  • memory/4980-23-0x0000000006720000-0x000000000673E000-memory.dmp

    Filesize

    120KB

  • memory/4980-15-0x0000000006110000-0x0000000006464000-memory.dmp

    Filesize

    3.3MB

  • memory/4980-12-0x00000000060A0000-0x0000000006106000-memory.dmp

    Filesize

    408KB

  • memory/4980-10-0x0000000005940000-0x0000000005962000-memory.dmp

    Filesize

    136KB

  • memory/4980-9-0x0000000072E50000-0x0000000073600000-memory.dmp

    Filesize

    7.7MB

  • memory/4980-8-0x0000000072E50000-0x0000000073600000-memory.dmp

    Filesize

    7.7MB

  • memory/4980-7-0x0000000005990000-0x0000000005FB8000-memory.dmp

    Filesize

    6.2MB

  • memory/4980-6-0x0000000002DE0000-0x0000000002E16000-memory.dmp

    Filesize

    216KB

  • memory/4980-5-0x0000000072E5E000-0x0000000072E5F000-memory.dmp

    Filesize

    4KB