hawkeye_reborn | 5e19889ca24913c6ae660e416467cd2f90f15806d2b1492993874e3d17ebd101

Analysis

max time kernel
151s
max time network
96s
platform
windows7_x64
resource
win7v200430
submitted
22/05/2020, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
swift payments USD_xlsx.exe
Size 649KB
Sample200522-j2anstenl6
SHA256 5e19889ca24913c6ae660e416467cd2f90f15806d2b1492993874e3d17ebd101
MD5 7d965a91754c6100aa88c9253a402fb6
SHA1 63d2d11e4cf95884ed403db282ecf61fb819d02a
SHA512 dca08d5399525b983a93c64de7879a355ad46ca3d1a5cdb2cfc9bf82bcb47fcae745ebc6a5f911fe12679baf0587b5f26f441bab93adef7013ba8b0e9187bee8
MD5 SHA1 SHA512

Score

10^/10

keylogger trojan stealer spyware hawkeye_reborn

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.1.2.5

Credentials

Protocol
smtp
Host
mocha3024.mochahost.com
Port
587
Username
[email protected]
Password
2020password$$

Mutex

4e4f1101-3e2c-4485-be2b-c3f556beb120

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:false _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:2020password$$ _EmailPort:587 _EmailSSL:true _EmailServer:mocha3024.mochahost.com _EmailUsername:[email protected] _EmptyClipboard:false _EmptyKeyStroke:false _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:2 _LoopPasswordStealer:true _MeltFile:false _Mutex:4e4f1101-3e2c-4485-be2b-c3f556beb120 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.1.2.5 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - RebornX, Version=10.1.2.5, Culture=neutral, PublicKeyToken=null

Signatures

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1296 set thread context of 1320	1296	swift payments USD_xlsx.exe	24
PID 1320 set thread context of 1628	1320	swift payments USD_xlsx.exe	29
PID 1320 set thread context of 1620	1320	swift payments USD_xlsx.exe	30

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1320	swift payments USD_xlsx.exe

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1320	1296	swift payments USD_xlsx.exe	24
PID 1296 wrote to memory of 1320	1296	swift payments USD_xlsx.exe	24
PID 1296 wrote to memory of 1320	1296	swift payments USD_xlsx.exe	24
PID 1296 wrote to memory of 1320	1296	swift payments USD_xlsx.exe	24
PID 1296 wrote to memory of 1320	1296	swift payments USD_xlsx.exe	24
PID 1296 wrote to memory of 1320	1296	swift payments USD_xlsx.exe	24
PID 1296 wrote to memory of 1320	1296	swift payments USD_xlsx.exe	24
PID 1296 wrote to memory of 1320	1296	swift payments USD_xlsx.exe	24
PID 1296 wrote to memory of 1320	1296	swift payments USD_xlsx.exe	24
PID 1320 wrote to memory of 1628	1320	swift payments USD_xlsx.exe	29
PID 1320 wrote to memory of 1628	1320	swift payments USD_xlsx.exe	29
PID 1320 wrote to memory of 1628	1320	swift payments USD_xlsx.exe	29
PID 1320 wrote to memory of 1628	1320	swift payments USD_xlsx.exe	29
PID 1320 wrote to memory of 1620	1320	swift payments USD_xlsx.exe	30
PID 1320 wrote to memory of 1620	1320	swift payments USD_xlsx.exe	30
PID 1320 wrote to memory of 1620	1320	swift payments USD_xlsx.exe	30
PID 1320 wrote to memory of 1620	1320	swift payments USD_xlsx.exe	30
PID 1320 wrote to memory of 1620	1320	swift payments USD_xlsx.exe	30
PID 1320 wrote to memory of 1628	1320	swift payments USD_xlsx.exe	29
PID 1320 wrote to memory of 1620	1320	swift payments USD_xlsx.exe	30
PID 1320 wrote to memory of 1628	1320	swift payments USD_xlsx.exe	29
PID 1320 wrote to memory of 1620	1320	swift payments USD_xlsx.exe	30
PID 1320 wrote to memory of 1620	1320	swift payments USD_xlsx.exe	30
PID 1320 wrote to memory of 1628	1320	swift payments USD_xlsx.exe	29
PID 1320 wrote to memory of 1620	1320	swift payments USD_xlsx.exe	30
PID 1320 wrote to memory of 1628	1320	swift payments USD_xlsx.exe	29
PID 1320 wrote to memory of 1628	1320	swift payments USD_xlsx.exe	29
PID 1320 wrote to memory of 1628	1320	swift payments USD_xlsx.exe	29
PID 1320 wrote to memory of 1620	1320	swift payments USD_xlsx.exe	30

C:\Users\Admin\AppData\Local\Temp\swift payments USD_xlsx.exe
"C:\Users\Admin\AppData\Local\Temp\swift payments USD_xlsx.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Users\Admin\AppData\Local\Temp\swift payments USD_xlsx.exe
  "{path}"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpAA52.tmp"
    3⤵
    PID:1628
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpAA62.tmp"
    3⤵
    PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-0-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/1320-1-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/1320-2-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/1620-5-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1628-3-0x0000000000400000-0x000000000041C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads