Article Content Edmund Brumaghin and Holger Unterbrink authored this blog post.Executive summaryMalware designed to steal sensitive information has been a threat to organizations around the world for a long time The emergence of the greyware market and the increased commercialization of keyloggers, stealers, and remote access trojans (RATs) has magnified this threat by reducing the barrier to entry for attackers In many cases, the adversaries leveraging these tools do not need to possess programming skills or in-depth computer science expertise, as they are now being provided as commercial offerings across the cybercriminal underground We have previously released in-depth analyses of these types of threats and how malicious attackers are leveraging them to attack organizations with Remcos in August and Agent Tesla in October.HawkEye is another example of a malware kit that is actively being marketed across various hacking forums Over the past several months, Talos observed ongoing malware distribution campaigns attempting to leverage the latest version of the HawkEye keylogger/stealer, HawkEye Reborn v9, against organizations to steal sensitive information and account credentials for use in additional attacks and account compromise History of HawkEyeHawkEye is a malware kit that has been around for several years and has seen continuous development and iterations since at least 2013 It features robust stealing capabilities as it can be used to obtain sensitive information from a variety of different applications Talos has recently identified several changes concerning HawkEye Reborn in the latest version, HawkEye Reborn v9 The exploit works similarly to what we saw with Agent Tesla in October It leverages a buffer overflow in the Equation Editor, which occurs if someone hands over a font name that's too long The shellcode starts after the MTEF font tag "08 13 36" in this case.After execution in the Equation Editor (EQNEDT32.EXE) context, it downloads the malicious data from the malware server as you can see in the ThreatGrid Process Timeline screenshot below After a successful download, it creates and starts the RegAsm.exe process.This RegAsm.exe process is a heavily obfuscated AutoIT script compiled into a PE It first creates the "winrshost" mutex Then, it extracts the final payload malware from two objects in the PE resource section (capisp1, appsruprov2).It concatenates them and uses AES to decrypt the result, using the hardcoded key "pydbdio…" which is handed over to the DecryptData function (see above) The shellcode in HEXCODE1 is very similar to this RunPE example Version 9 is still using the well-known MailPassView and WebBrowserPassView freeware tools from Nirsoft to steal web and email passwords These tools are embedded in the PE file in the form of data which is decoded at runtime and added to the local resources They are starting an instance of vbc.exe via ProcessCreate, injecting the tool and resume the threat The stolen passwords are ending up in a temporary file, which is read in and added to the list of data to be exfiltrated HawkEye has been active across the threat landscape for a long time and will likely continue to be leveraged in the future as long as the developer of this kit can monetize their efforts While the Terms of Service have been written in an attempt to absolve the developer of any wrongdoing, it is actively leveraged by malicious adversaries Organizations should be aware of this and similar threats and deploy countermeasures such as Multi-Factor Authentication (MFA) solutions such as Duo, to help reduce the impact of credential theft within their environments
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Edmund Brumaghin and Holger Unterbrink authored this blog post.Executive summaryMalware designed to steal sensitive information has been a threat to organizations around the world for a long time The emergence of the greyware market and the increased commercialization of keyloggers, stealers, and remote access trojans (RATs) has magnified this threat by reducing the barrier to entry for attackers In many cases, the adversaries leveraging these tools do not need to possess programming skills or in-depth computer science expertise, as they are now being provided as commercial offerings across the cybercriminal underground We have previously released in-depth analyses of these types of threats and how malicious attackers are leveraging them to attack organizations with Remcos in August and Agent Tesla in October.HawkEye is another example of a malware kit that is actively being marketed across various hacking forums Over the past several months, Talos observed ongoing malware distribution campaigns attempting to leverage the latest version of the HawkEye keylogger/stealer, HawkEye Reborn v9, against organizations to steal sensitive information and account credentials for use in additional attacks and account compromise History of HawkEyeHawkEye is a malware kit that has been around for several years and has seen continuous development and iterations since at least 2013 It features robust stealing capabilities as it can be used to obtain sensitive information from a variety of different applications Talos has recently identified several changes concerning HawkEye Reborn in the latest version, HawkEye Reborn v9 The exploit works similarly to what we saw with Agent Tesla in October It leverages a buffer overflow in the Equation Editor, which occurs if someone hands over a font name that's too long The shellcode starts after the MTEF font tag "08 13 36" in this case.After execution in the Equation Editor (EQNEDT32.EXE) context, it downloads the malicious data from the malware server as you can see in the ThreatGrid Process Timeline screenshot below After a successful download, it creates and starts the RegAsm.exe process.This RegAsm.exe process is a heavily obfuscated AutoIT script compiled into a PE It first creates the "winrshost" mutex Then, it extracts the final payload malware from two objects in the PE resource section (capisp1, appsruprov2).It concatenates them and uses AES to decrypt the result, using the hardcoded key "pydbdio…" which is handed over to the DecryptData function (see above) The shellcode in HEXCODE1 is very similar to this RunPE example Version 9 is still using the well-known MailPassView and WebBrowserPassView freeware tools from Nirsoft to steal web and email passwords These tools are embedded in the PE file in the form of data which is decoded at runtime and added to the local resources They are starting an instance of vbc.exe via ProcessCreate, injecting the tool and resume the threat The stolen passwords are ending up in a temporary file, which is read in and added to the list of data to be exfiltrated HawkEye has been active across the threat landscape for a long time and will likely continue to be leveraged in the future as long as the developer of this kit can monetize their efforts While the Terms of Service have been written in an attempt to absolve the developer of any wrongdoing, it is actively leveraged by malicious adversaries Organizations should be aware of this and similar threats and deploy countermeasures such as Multi-Factor Authentication (MFA) solutions such as Duo, to help reduce the impact of credential theft within their environments ### Response: .