hawkeye_reborn | 3c0f1342da1381efcb02db88a6f0c2c5da6006288915b146684e5de5e4bd7a8b

General

Target

(ITBD)..exe
Size

638KB
MD5

61b91b3bb375436570df81e5d981e823
SHA1

9c4124467c4308afe1b79782f447ffc7d40cb50b
SHA256

3c0f1342da1381efcb02db88a6f0c2c5da6006288915b146684e5de5e4bd7a8b
SHA512

54f5e78631bcf5cb747889bb9044a8745e590aade7123526d50c6a591204442c1c282bfa51ef62fc0dc22aaf71c2719b8cc38f9505d5b9bfba7282922802aff9

Score

10^/10

keylogger trojan stealer spyware hawkeye_reborn m00nd3v_logger

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.1

Credentials

Protocol: smtp
Host:
mail.eagleeyeapparels.com
Port:
587
Username:
[email protected]
Password:
eagle*qaz

Mutex

f98d37f4-ca90-4ed7-9f6f-6121c4014605

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:eagle*qaz _EmailPort:587 _EmailSSL:true _EmailServer:mail.eagleeyeapparels.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:f98d37f4-ca90-4ed7-9f6f-6121c4014605 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.1 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.1, Culture=neutral, PublicKeyToken=null

Signatures

M00nD3v Logger Payload 3 IoCs

Detects M00nD3v Logger payload in memory.

Processes:

resource	yara_rule
behavioral1/memory/1672-0-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1672-2-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1672-3-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 bot.whatismyipaddress.com

flow	ioc
5	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

(ITBD)..exe(ITBD)..exe

description	pid	process	target process
PID 1292 set thread context of 1672	1292	(ITBD)..exe	(ITBD)..exe
PID 1672 set thread context of 1648	1672	(ITBD)..exe	vbc.exe
PID 1672 set thread context of 1872	1672	(ITBD)..exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

vbc.exe

pid process

1648 vbc.exe

pid	process
1648	vbc.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

(ITBD)..exe(ITBD)..exe

description	pid	process	target process
PID 1292 wrote to memory of 1672	1292	(ITBD)..exe	(ITBD)..exe
PID 1292 wrote to memory of 1672	1292	(ITBD)..exe	(ITBD)..exe
PID 1292 wrote to memory of 1672	1292	(ITBD)..exe	(ITBD)..exe
PID 1292 wrote to memory of 1672	1292	(ITBD)..exe	(ITBD)..exe
PID 1292 wrote to memory of 1672	1292	(ITBD)..exe	(ITBD)..exe
PID 1292 wrote to memory of 1672	1292	(ITBD)..exe	(ITBD)..exe
PID 1292 wrote to memory of 1672	1292	(ITBD)..exe	(ITBD)..exe
PID 1292 wrote to memory of 1672	1292	(ITBD)..exe	(ITBD)..exe
PID 1292 wrote to memory of 1672	1292	(ITBD)..exe	(ITBD)..exe
PID 1672 wrote to memory of 1648	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1648	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1648	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1648	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1648	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1648	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1648	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1648	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1648	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1648	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1872	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1872	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1872	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1872	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1872	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1872	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1872	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1872	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1872	1672	(ITBD)..exe	vbc.exe
PID 1672 wrote to memory of 1872	1672	(ITBD)..exe	vbc.exe

M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

C:\Users\Admin\AppData\Local\Temp\(ITBD)..exe
"C:\Users\Admin\AppData\Local\Temp\(ITBD)..exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1292

C:\Users\Admin\AppData\Local\Temp\(ITBD)..exe
"{path}"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp78EE.tmp"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1648

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp6B0A.tmp"
3⤵
PID:1872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp78EE.tmp

Download Submit
memory/1648-4-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1648-5-0x0000000000444D30-mapping.dmp

Download
memory/1648-6-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1672-0-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1672-1-0x000000000048B39E-mapping.dmp

Download
memory/1672-2-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1672-3-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1872-8-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1872-9-0x000000000041211A-mapping.dmp

Download
memory/1872-10-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads