Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 04:01
Static task
static1
Behavioral task
behavioral1
Sample
AWB Number 6789001.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
AWB Number 6789001.exe
Resource
win10v2004-20240426-en
General
-
Target
AWB Number 6789001.exe
-
Size
3.9MB
-
MD5
c0fda04886ee7618b7e694c43975ef3d
-
SHA1
62d2276ed3e79835111e7fb5a455da6ec7fdbdb8
-
SHA256
6d1d95ed0d6911495c2c91b757fec55f04544ab2ef8baa261be2821231b3aaba
-
SHA512
492875d54185f3f24a5d34eb6d9a08bac3c6c82fdc07b19df4f238ee6141eb9f6ed87ccee2cd4aecd0de12377bac244ea59e68340d2058cda6cd3251b8d71a94
-
SSDEEP
98304:k5u58ymD+ZlLYZXtwb18PG14k9zdbkoAb6WReU:k0nzLoXtwb18PG14+JAfv
Malware Config
Extracted
hawkeye_reborn
- fields
- name
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
resource yara_rule behavioral2/memory/2044-27-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger -
NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/2044-30-0x0000000007AE0000-0x0000000007B56000-memory.dmp MailPassView behavioral2/memory/4224-41-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/4224-42-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/4224-44-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/2044-30-0x0000000007AE0000-0x0000000007B56000-memory.dmp WebBrowserPassView behavioral2/memory/3032-32-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/3032-33-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/3032-39-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
resource yara_rule behavioral2/memory/2044-30-0x0000000007AE0000-0x0000000007B56000-memory.dmp Nirsoft behavioral2/memory/3032-32-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3032-33-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3032-39-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/4224-41-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/4224-42-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/4224-44-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation AWB Number 6789001.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation chrome.exe -
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe\:Zone.Identifier:$DATA cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe:Zone.Identifier cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 5024 chrome.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome.exe -boot" chrome.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 5024 set thread context of 2044 5024 chrome.exe 106 PID 2044 set thread context of 3032 2044 AppLaunch.exe 108 PID 2044 set thread context of 4224 2044 AppLaunch.exe 109 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NTFS ADS 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\AWB Number 6789001.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\AWB Number 6789001.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3032 vbc.exe 3032 vbc.exe 3032 vbc.exe 3032 vbc.exe 3032 vbc.exe 3032 vbc.exe 3032 vbc.exe 3032 vbc.exe 3032 vbc.exe 3032 vbc.exe 3032 vbc.exe 3032 vbc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3444 AWB Number 6789001.exe Token: SeDebugPrivilege 5024 chrome.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 3444 wrote to memory of 4608 3444 AWB Number 6789001.exe 90 PID 3444 wrote to memory of 4608 3444 AWB Number 6789001.exe 90 PID 3444 wrote to memory of 4608 3444 AWB Number 6789001.exe 90 PID 3444 wrote to memory of 2200 3444 AWB Number 6789001.exe 92 PID 3444 wrote to memory of 2200 3444 AWB Number 6789001.exe 92 PID 3444 wrote to memory of 2200 3444 AWB Number 6789001.exe 92 PID 3444 wrote to memory of 1216 3444 AWB Number 6789001.exe 96 PID 3444 wrote to memory of 1216 3444 AWB Number 6789001.exe 96 PID 3444 wrote to memory of 1216 3444 AWB Number 6789001.exe 96 PID 3444 wrote to memory of 4644 3444 AWB Number 6789001.exe 99 PID 3444 wrote to memory of 4644 3444 AWB Number 6789001.exe 99 PID 3444 wrote to memory of 4644 3444 AWB Number 6789001.exe 99 PID 4644 wrote to memory of 5024 4644 cmd.exe 101 PID 4644 wrote to memory of 5024 4644 cmd.exe 101 PID 4644 wrote to memory of 5024 4644 cmd.exe 101 PID 5024 wrote to memory of 1372 5024 chrome.exe 102 PID 5024 wrote to memory of 1372 5024 chrome.exe 102 PID 5024 wrote to memory of 1372 5024 chrome.exe 102 PID 5024 wrote to memory of 4232 5024 chrome.exe 104 PID 5024 wrote to memory of 4232 5024 chrome.exe 104 PID 5024 wrote to memory of 4232 5024 chrome.exe 104 PID 5024 wrote to memory of 2044 5024 chrome.exe 106 PID 5024 wrote to memory of 2044 5024 chrome.exe 106 PID 5024 wrote to memory of 2044 5024 chrome.exe 106 PID 5024 wrote to memory of 2044 5024 chrome.exe 106 PID 5024 wrote to memory of 2044 5024 chrome.exe 106 PID 5024 wrote to memory of 2044 5024 chrome.exe 106 PID 5024 wrote to memory of 2044 5024 chrome.exe 106 PID 5024 wrote to memory of 2044 5024 chrome.exe 106 PID 2044 wrote to memory of 3032 2044 AppLaunch.exe 108 PID 2044 wrote to memory of 3032 2044 AppLaunch.exe 108 PID 2044 wrote to memory of 3032 2044 AppLaunch.exe 108 PID 2044 wrote to memory of 3032 2044 AppLaunch.exe 108 PID 2044 wrote to memory of 3032 2044 AppLaunch.exe 108 PID 2044 wrote to memory of 3032 2044 AppLaunch.exe 108 PID 2044 wrote to memory of 3032 2044 AppLaunch.exe 108 PID 2044 wrote to memory of 3032 2044 AppLaunch.exe 108 PID 2044 wrote to memory of 3032 2044 AppLaunch.exe 108 PID 2044 wrote to memory of 4224 2044 AppLaunch.exe 109 PID 2044 wrote to memory of 4224 2044 AppLaunch.exe 109 PID 2044 wrote to memory of 4224 2044 AppLaunch.exe 109 PID 2044 wrote to memory of 4224 2044 AppLaunch.exe 109 PID 2044 wrote to memory of 4224 2044 AppLaunch.exe 109 PID 2044 wrote to memory of 4224 2044 AppLaunch.exe 109 PID 2044 wrote to memory of 4224 2044 AppLaunch.exe 109 PID 2044 wrote to memory of 4224 2044 AppLaunch.exe 109 PID 2044 wrote to memory of 4224 2044 AppLaunch.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\AWB Number 6789001.exe"C:\Users\Admin\AppData\Local\Temp\AWB Number 6789001.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\AWB Number 6789001.exe:Zone.Identifier"2⤵
- NTFS ADS
PID:4608
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\AWB Number 6789001.exe:Zone.Identifier"2⤵
- NTFS ADS
PID:2200
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AWB Number 6789001.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe"2⤵
- Drops startup file
PID:1216
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe:Zone.Identifier"4⤵
- Drops startup file
PID:1372
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe:Zone.Identifier"4⤵
- Drops startup file
PID:4232
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp65E4.tmp"5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3032
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp69EC.tmp"5⤵
- Accesses Microsoft Outlook accounts
PID:4224
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5a35b8711bea28d54fb7a350adceb3f76
SHA15872d7a95a74ec6de08194283027fcf2cdb96390
SHA256a90449e696cb37fa289ab8dcd0888734c74d0b61273231a0ce0e93adfd2d8137
SHA512d997e0ace25eff648f16395a4771402465b39fa059d3b0f36efbd743c691bf4308c58d5585e3aebc63c206d18d01edf46f14b0cb5cffe6f1d5bf9132d76d9210
-
Filesize
3.9MB
MD5c0fda04886ee7618b7e694c43975ef3d
SHA162d2276ed3e79835111e7fb5a455da6ec7fdbdb8
SHA2566d1d95ed0d6911495c2c91b757fec55f04544ab2ef8baa261be2821231b3aaba
SHA512492875d54185f3f24a5d34eb6d9a08bac3c6c82fdc07b19df4f238ee6141eb9f6ed87ccee2cd4aecd0de12377bac244ea59e68340d2058cda6cd3251b8d71a94