hawkeye_reborn | 729bb1c1ef5a32944905a3a261cc1fcd9d3d3fd811ea78bf13c1db0c8fc79537

General

Target

Notifikatiounsdokument 031020.exe
Sample

200205-2py68krddx
SHA256

729bb1c1ef5a32944905a3a261cc1fcd9d3d3fd811ea78bf13c1db0c8fc79537

Score

10^/10

keylogger trojan stealer spyware hawkeye_reborn

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Reads browser user data or profiles (possible credential harvesting) 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Notifikatiounsdokument 031020.exe

pid process

4920 Notifikatiounsdokument 031020.exe

pid	process
4920	Notifikatiounsdokument 031020.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Notifikatiounsdokument 031020.exeRegAsm.exe

description	pid	process	target process
PID 4920 wrote to memory of 356	4920	Notifikatiounsdokument 031020.exe	RegAsm.exe
PID 356 wrote to memory of 4520	356	RegAsm.exe	vbc.exe
PID 356 wrote to memory of 4656	356	RegAsm.exe	vbc.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Notifikatiounsdokument 031020.exe

pid process

4920 Notifikatiounsdokument 031020.exe
HawkEye Reborn
HawkEye Reborn is an enchanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Notifikatiounsdokument 031020.exe

pid process

4920 Notifikatiounsdokument 031020.exe

pid	process
4920	Notifikatiounsdokument 031020.exe

pid	process
4920	Notifikatiounsdokument 031020.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Notifikatiounsdokument 031020.exeRegAsm.exe

description	pid	process	target process
PID 4920 set thread context of 356	4920	Notifikatiounsdokument 031020.exe	RegAsm.exe
PID 356 set thread context of 4520	356	RegAsm.exe	vbc.exe
PID 356 set thread context of 4656	356	RegAsm.exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

vbc.exe

pid process

4520 vbc.exe

pid	process
4520	vbc.exe

C:\Users\Admin\AppData\Local\Temp\Notifikatiounsdokument 031020.exe
"C:\Users\Admin\AppData\Local\Temp\Notifikatiounsdokument 031020.exe"
1⤵
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetThreadContext
PID:4920

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:356

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpD6F7.tmp"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4520

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpC957.tmp"
3⤵
PID:4656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD6F7.tmp

Download Submit
memory/356-0-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4520-1-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4520-2-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4656-4-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4656-5-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing