hawkeye_reborn | 39ae83af1cd715dadb50a266b91587dab04fffa94d2aa923c03cff634265f9ec

General

Target

BID (ITB).exe
Size

695KB
MD5

252e0a3b8da887d3da7ff844b1864be2
SHA1

614228df1144b4569adec014d365be5f7421102e
SHA256

39ae83af1cd715dadb50a266b91587dab04fffa94d2aa923c03cff634265f9ec
SHA512

f0de08e29e99b0873c8322e417004163aef004c544e8af36d00951e498492f6e7bb396ac5ef414b1f6cfa1169e4c3525a77f22df3dca0b9cd854bf847235d624

Score

10^/10

hawkeye_reborn keylogger spyware stealer trojan upx

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.eagleeyeapparels.com
Port:
587
Username:
faruq@eagleeyeapparels.com
Password:
eagle*qaz

Extracted

Family

hawkeye_reborn

Version

10.0.0.1

Credentials

Protocol: smtp
Host:
mail.eagleeyeapparels.com
Port:
587
Username:
faruq@eagleeyeapparels.com
Password:
eagle*qaz

Mutex

f98d37f4-ca90-4ed7-9f6f-6121c4014605

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:eagle*qaz _EmailPort:587 _EmailSSL:true _EmailServer:mail.eagleeyeapparels.com _EmailUsername:faruq@eagleeyeapparels.com _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:f98d37f4-ca90-4ed7-9f6f-6121c4014605 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.1 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.1, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3932-0-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral2/memory/852-1-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/852-4-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/852-5-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/908-7-0x0000000000400000-0x000000000051E000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 bot.whatismyipaddress.com

flow	ioc
10	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

BID (ITB).exeBID (ITB).exe

description	pid	process	target process
PID 3932 set thread context of 852	3932	BID (ITB).exe	BID (ITB).exe
PID 852 set thread context of 1860	852	BID (ITB).exe	vbc.exe
PID 852 set thread context of 2516	852	BID (ITB).exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 2538 IoCs

Processes:

BID (ITB).exeBID (ITB).exe

pid	process
3932	BID (ITB).exe
3932	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe
908	BID (ITB).exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

BID (ITB).exe

pid process

3932 BID (ITB).exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

BID (ITB).exe

description pid process

Token: SeDebugPrivilege 852 BID (ITB).exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

BID (ITB).exe

pid process

852 BID (ITB).exe

description	pid	process
Token: SeDebugPrivilege	852	BID (ITB).exe

pid	process
852	BID (ITB).exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

BID (ITB).exeBID (ITB).exe

description	pid	process	target process
PID 3932 wrote to memory of 852	3932	BID (ITB).exe	BID (ITB).exe
PID 3932 wrote to memory of 852	3932	BID (ITB).exe	BID (ITB).exe
PID 3932 wrote to memory of 852	3932	BID (ITB).exe	BID (ITB).exe
PID 3932 wrote to memory of 908	3932	BID (ITB).exe	BID (ITB).exe
PID 3932 wrote to memory of 908	3932	BID (ITB).exe	BID (ITB).exe
PID 3932 wrote to memory of 908	3932	BID (ITB).exe	BID (ITB).exe
PID 852 wrote to memory of 1860	852	BID (ITB).exe	vbc.exe
PID 852 wrote to memory of 1860	852	BID (ITB).exe	vbc.exe
PID 852 wrote to memory of 1860	852	BID (ITB).exe	vbc.exe
PID 852 wrote to memory of 1860	852	BID (ITB).exe	vbc.exe
PID 852 wrote to memory of 1860	852	BID (ITB).exe	vbc.exe
PID 852 wrote to memory of 1860	852	BID (ITB).exe	vbc.exe
PID 852 wrote to memory of 1860	852	BID (ITB).exe	vbc.exe
PID 852 wrote to memory of 1860	852	BID (ITB).exe	vbc.exe
PID 852 wrote to memory of 1860	852	BID (ITB).exe	vbc.exe
PID 852 wrote to memory of 2516	852	BID (ITB).exe	vbc.exe
PID 852 wrote to memory of 2516	852	BID (ITB).exe	vbc.exe
PID 852 wrote to memory of 2516	852	BID (ITB).exe	vbc.exe
PID 852 wrote to memory of 2516	852	BID (ITB).exe	vbc.exe
PID 852 wrote to memory of 2516	852	BID (ITB).exe	vbc.exe
PID 852 wrote to memory of 2516	852	BID (ITB).exe	vbc.exe
PID 852 wrote to memory of 2516	852	BID (ITB).exe	vbc.exe
PID 852 wrote to memory of 2516	852	BID (ITB).exe	vbc.exe
PID 852 wrote to memory of 2516	852	BID (ITB).exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3932

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:852

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp381D.tmp"
3⤵
PID:1860

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp3C44.tmp"
3⤵
PID:2516

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe" 2 852 259258734
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:908

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp381D.tmp
MD5
4b07a5386899b8f24a2e893c0f56ac98

SHA1
229dce1c426d9d85b3aeb891510c36dffdbbe698

SHA256
4048f131fe6c373d444e30f03b2b8f6a4c720b66b0ed2511962d43dd00607178

SHA512
29225f383c0d117bb9e591006855d971fdc2c0c0e18b89ad4c17f5771e68b48c365e7e973e5677d53d27d055e2f63657e61b7ac5fcae4c6ff49bcb07e3bb39ee

Download Submit
memory/852-4-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/852-1-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/852-5-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/852-6-0x00000000022F0000-0x0000000002380000-memory.dmp

Filesize
576KB

Download
memory/852-2-0x000000000052B720-mapping.dmp

Download
memory/852-8-0x00000000022E2000-0x00000000022E3000-memory.dmp

Filesize
4KB

Download
memory/908-7-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/908-3-0x0000000000000000-mapping.dmp

Download
memory/1860-9-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1860-10-0x0000000000444D30-mapping.dmp

Download
memory/1860-11-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2516-13-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2516-14-0x000000000041211A-mapping.dmp

Download
memory/2516-15-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3932-0-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads