hawkeye_reborn | 7efffc190ffed0203e3628c22d62f2450b0af7a7d5d03f15e1b62274a5acc171

General

Target

94d842858cae2530e7f3b91f6eb368dc_JaffaCakes118.exe
Size

2.1MB
MD5

94d842858cae2530e7f3b91f6eb368dc
SHA1

95624366b632b4e403ab705b95b4bd96abe684b4
SHA256

7efffc190ffed0203e3628c22d62f2450b0af7a7d5d03f15e1b62274a5acc171
SHA512

75d821aac30c93949792109793b3a8a72f408bc5565acfd8dcdac05fa136574785268e109641e885078766d7bb5ef5f15f701596dd7f88257b09fac01ef1edce
SSDEEP

12288:210NYGq5iGarLcGAugfUzdwmnX4xBDGSD2vMnw6+uJFhMKDEv+iSV:2c5cibyugGwu4xZGsnw6/JFhhQ8

Score

10^/10

hawkeye_reborn m00nd3v_logger collection infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.zoho.com
Port:
587
Username:
[email protected]
Password:
angelboy12

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 2 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral2/memory/4492-6-0x0000000005960000-0x00000000059F0000-memory.dmp	m00nd3v_logger
behavioral2/memory/1364-8-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4308-24-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4308-26-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4308-27-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2740-12-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/2740-14-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/2740-21-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

resource	yara_rule
behavioral2/memory/2740-12-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/2740-14-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/2740-21-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/4308-24-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4308-26-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4308-27-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsm.url	94d842858cae2530e7f3b91f6eb368dc_JaffaCakes118.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4492 set thread context of 1364	4492	94d842858cae2530e7f3b91f6eb368dc_JaffaCakes118.exe	82
PID 1364 set thread context of 2740	1364	RegAsm.exe	92
PID 1364 set thread context of 4308	1364	RegAsm.exe	93

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4492	94d842858cae2530e7f3b91f6eb368dc_JaffaCakes118.exe
4492	94d842858cae2530e7f3b91f6eb368dc_JaffaCakes118.exe
2740	vbc.exe
2740	vbc.exe
2740	vbc.exe
2740	vbc.exe
2740	vbc.exe
2740	vbc.exe
2740	vbc.exe
2740	vbc.exe
2740	vbc.exe
2740	vbc.exe
2740	vbc.exe
2740	vbc.exe
1364	RegAsm.exe
1364	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4492	94d842858cae2530e7f3b91f6eb368dc_JaffaCakes118.exe
Token: SeDebugPrivilege	1364	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1364	RegAsm.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 1364	4492	94d842858cae2530e7f3b91f6eb368dc_JaffaCakes118.exe	82
PID 4492 wrote to memory of 1364	4492	94d842858cae2530e7f3b91f6eb368dc_JaffaCakes118.exe	82
PID 4492 wrote to memory of 1364	4492	94d842858cae2530e7f3b91f6eb368dc_JaffaCakes118.exe	82
PID 4492 wrote to memory of 1364	4492	94d842858cae2530e7f3b91f6eb368dc_JaffaCakes118.exe	82
PID 4492 wrote to memory of 1364	4492	94d842858cae2530e7f3b91f6eb368dc_JaffaCakes118.exe	82
PID 4492 wrote to memory of 1364	4492	94d842858cae2530e7f3b91f6eb368dc_JaffaCakes118.exe	82
PID 4492 wrote to memory of 1364	4492	94d842858cae2530e7f3b91f6eb368dc_JaffaCakes118.exe	82
PID 4492 wrote to memory of 1364	4492	94d842858cae2530e7f3b91f6eb368dc_JaffaCakes118.exe	82
PID 1364 wrote to memory of 2740	1364	RegAsm.exe	92
PID 1364 wrote to memory of 2740	1364	RegAsm.exe	92
PID 1364 wrote to memory of 2740	1364	RegAsm.exe	92
PID 1364 wrote to memory of 2740	1364	RegAsm.exe	92
PID 1364 wrote to memory of 2740	1364	RegAsm.exe	92
PID 1364 wrote to memory of 2740	1364	RegAsm.exe	92
PID 1364 wrote to memory of 2740	1364	RegAsm.exe	92
PID 1364 wrote to memory of 2740	1364	RegAsm.exe	92
PID 1364 wrote to memory of 2740	1364	RegAsm.exe	92
PID 1364 wrote to memory of 4308	1364	RegAsm.exe	93
PID 1364 wrote to memory of 4308	1364	RegAsm.exe	93
PID 1364 wrote to memory of 4308	1364	RegAsm.exe	93
PID 1364 wrote to memory of 4308	1364	RegAsm.exe	93
PID 1364 wrote to memory of 4308	1364	RegAsm.exe	93
PID 1364 wrote to memory of 4308	1364	RegAsm.exe	93
PID 1364 wrote to memory of 4308	1364	RegAsm.exe	93
PID 1364 wrote to memory of 4308	1364	RegAsm.exe	93
PID 1364 wrote to memory of 4308	1364	RegAsm.exe	93

C:\Users\Admin\AppData\Local\Temp\94d842858cae2530e7f3b91f6eb368dc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\94d842858cae2530e7f3b91f6eb368dc_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp65BF.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2740
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp69C7.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp65BF.tmp

Filesize
4KB

MD5
788d7419b32411807cc6753cbbccecbe

SHA1
761b99a1e5bc168f525181d78cff3f6ed82daa14

SHA256
76150e857b36f1f070422d2ad4df17f87454466348e4bfc158b028977378140b

SHA512
3003f104b0b07870015ff4e9e0d254c2e537d4c68ef664a772d7018827b0ccbeb5481a2ce587b88e6ab1d71d6ce523a620c11c00c676857d5fd5ab949fa617b4

Download Submit
memory/1364-8-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1364-10-0x0000000074700000-0x0000000074D08000-memory.dmp

Filesize
6.0MB

Download
memory/2740-22-0x0000000074700000-0x0000000074D08000-memory.dmp

Filesize
6.0MB

Download
memory/2740-12-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2740-14-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2740-15-0x0000000074700000-0x0000000074D08000-memory.dmp

Filesize
6.0MB

Download
memory/2740-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4308-24-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4308-29-0x0000000074700000-0x0000000074D08000-memory.dmp

Filesize
6.0MB

Download
memory/4308-28-0x0000000074700000-0x0000000074D08000-memory.dmp

Filesize
6.0MB

Download
memory/4308-27-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4308-26-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4492-2-0x00000000058C0000-0x000000000595A000-memory.dmp

Filesize
616KB

Download
memory/4492-1-0x0000000000E40000-0x0000000000FDC000-memory.dmp

Filesize
1.6MB

Download
memory/4492-0-0x0000000074C5E000-0x0000000074C5F000-memory.dmp

Filesize
4KB

Download
memory/4492-6-0x0000000005960000-0x00000000059F0000-memory.dmp

Filesize
576KB

Download
memory/4492-3-0x0000000003430000-0x000000000343C000-memory.dmp

Filesize
48KB

Download
memory/4492-7-0x0000000005B10000-0x0000000005BAC000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads