hawkeye_reborn | 729bb1c1ef5a32944905a3a261cc1fcd9d3d3fd811ea78bf13c1db0c8fc79537

General

Target

Notifikatiounsdokument 031020.exe
Sample

200205-2py68krddx
SHA256

729bb1c1ef5a32944905a3a261cc1fcd9d3d3fd811ea78bf13c1db0c8fc79537

Score

10^/10

spyware keylogger trojan stealer hawkeye_reborn

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Notifikatiounsdokument 031020.exeRegAsm.exe

description	pid	process	target process
PID 1412 wrote to memory of 1796	1412	Notifikatiounsdokument 031020.exe	RegAsm.exe
PID 1796 wrote to memory of 1536	1796	RegAsm.exe	vbc.exe
PID 1796 wrote to memory of 1968	1796	RegAsm.exe	vbc.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Notifikatiounsdokument 031020.exe

pid process

1412 Notifikatiounsdokument 031020.exe
HawkEye Reborn
HawkEye Reborn is an enchanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Notifikatiounsdokument 031020.exe

pid process

1412 Notifikatiounsdokument 031020.exe

pid	process
1412	Notifikatiounsdokument 031020.exe

pid	process
1412	Notifikatiounsdokument 031020.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Notifikatiounsdokument 031020.exeRegAsm.exe

description	pid	process	target process
PID 1412 set thread context of 1796	1412	Notifikatiounsdokument 031020.exe	RegAsm.exe
PID 1796 set thread context of 1536	1796	RegAsm.exe	vbc.exe
PID 1796 set thread context of 1968	1796	RegAsm.exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

vbc.exe

pid process

1536 vbc.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Reads browser user data or profiles (possible credential harvesting) 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Notifikatiounsdokument 031020.exe

pid process

1412 Notifikatiounsdokument 031020.exe

pid	process
1536	vbc.exe

pid	process
1412	Notifikatiounsdokument 031020.exe

C:\Users\Admin\AppData\Local\Temp\Notifikatiounsdokument 031020.exe
"C:\Users\Admin\AppData\Local\Temp\Notifikatiounsdokument 031020.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SendNotifyMessage
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
PID:1412

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1796

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpA3FB.tmp"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp95F8.tmp"
3⤵
PID:1968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA3FB.tmp

Download Submit
memory/1536-3-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1536-4-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1796-0-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1796-1-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1796-2-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1968-6-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1968-7-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing