Analysis

  • max time kernel
    149s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    25/09/2024, 06:48 UTC

General

  • Target

    f56df09a5bae12d07a968bbd6daa34f5_JaffaCakes118.exe

  • Size

    2.4MB

  • MD5

    f56df09a5bae12d07a968bbd6daa34f5

  • SHA1

    140e8f1c87e59c336b3003dcabde4ed3fed3f0cc

  • SHA256

    6a76ea6a6951daf1682605f6827aca812abcc863d55eab8fbcd5df0204363425

  • SHA512

    f9c1d26eb5045b58c18283d8cec69fb7d802c9fd88cdd059a47c09d0cbdd3c8136fb072aa072f75598a825ab5cdc3f8ba9e5567f52d315fdd876cfc04f3670e9

  • SSDEEP

    24576:XAHnh+eWsN3skA4RV1Hom2KXMmHaR1plDdpGB5D76mqiQzA/SfGi8Oxs5:Kh+ZkldoPK8YaR4nb

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.consorcioradiohaus.com.br
  • Port:
    21
  • Username:
    hk@consorcioradiohaus.com.br
  • Password:
    Team2318@
Mutex

6027986e-0c17-440b-b246-199db85505be

Attributes
  • fields

    map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:false _Delivery:2 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPort:0 _EmailSSL:false _ExecutionDelay:10 _FTPPassword:Team2318@ _FTPPort:21 _FTPSFTP:true _FTPServer:ftp.consorcioradiohaus.com.br _FTPUsername:hk@consorcioradiohaus.com.br _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:10 _MeltFile:false _Mutex:6027986e-0c17-440b-b246-199db85505be _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]

  • name

    HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Signatures

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

  • Detected Nirsoft tools 8 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • M00nD3v Logger payload 3 IoCs

    Detects M00nD3v Logger payload in memory.

  • NirSoft MailPassView 4 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 4 IoCs

    Password recovery tool for various web browsers

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f56df09a5bae12d07a968bbd6daa34f5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f56df09a5bae12d07a968bbd6daa34f5_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp18BE.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2312
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpA6D.tmp"
        3⤵
        • Accesses Microsoft Outlook accounts
        • System Location Discovery: System Language Discovery
        PID:1484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp18BE.tmp

    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

  • memory/1484-52-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1484-50-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1484-49-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1484-35-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1484-37-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1484-39-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1484-41-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1484-43-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1484-47-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2312-19-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2312-15-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2312-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2312-21-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2312-13-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2312-17-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2312-27-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2312-33-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2312-28-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2312-25-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2380-0-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

  • memory/2916-11-0x0000000074A12000-0x0000000074A14000-memory.dmp

    Filesize

    8KB

  • memory/2916-10-0x0000000074A12000-0x0000000074A14000-memory.dmp

    Filesize

    8KB

  • memory/2916-2-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

  • memory/2916-8-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

  • memory/2916-9-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

  • memory/2916-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2916-1-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.