hawkeye_reborn | c6043128c116aedacc1be9abbcb74898065374269665a5387960ce47e805c2c0

General

Target

PO.exe
Size

722KB
MD5

903ca84d60f53ecf1902600beb652c55
SHA1

4e0d56e8b555a6882cfee2132fff4fa81a2c40cc
SHA256

c6043128c116aedacc1be9abbcb74898065374269665a5387960ce47e805c2c0
SHA512

6ac61af0eee49a3596b92e94a36b63f599803183264ba415220c71784d1db691a1170a8c63a0d2cb940559a50a320889a1d70301656aaa38475b7f3a67ab4be6

Score

10^/10

hawkeye_reborn keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.eagleeyeapparels.com
Port:
587
Username:
faruq@eagleeyeapparels.com
Password:
eagle*qaz

Extracted

Family

hawkeye_reborn

Version

10.0.0.1

Credentials

Protocol: smtp
Host:
mail.eagleeyeapparels.com
Port:
587
Username:
faruq@eagleeyeapparels.com
Password:
eagle*qaz

Mutex

f98d37f4-ca90-4ed7-9f6f-6121c4014605

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:eagle*qaz _EmailPort:587 _EmailSSL:true _EmailServer:mail.eagleeyeapparels.com _EmailUsername:faruq@eagleeyeapparels.com _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:f98d37f4-ca90-4ed7-9f6f-6121c4014605 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.1 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.1, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 bot.whatismyipaddress.com

flow	ioc
5	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

PO.exePO.exe

description	pid	process	target process
PID 1892 set thread context of 328	1892	PO.exe	PO.exe
PID 328 set thread context of 608	328	PO.exe	vbc.exe
PID 328 set thread context of 1612	328	PO.exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

PO.exevbc.exe

pid process

1892 PO.exe
608 vbc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PO.exe

description pid process

Token: SeDebugPrivilege 1892 PO.exe

pid	process
1892	PO.exe
608	vbc.exe

description	pid	process
Token: SeDebugPrivilege	1892	PO.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

PO.exePO.exe

description	pid	process	target process
PID 1892 wrote to memory of 328	1892	PO.exe	PO.exe
PID 1892 wrote to memory of 328	1892	PO.exe	PO.exe
PID 1892 wrote to memory of 328	1892	PO.exe	PO.exe
PID 1892 wrote to memory of 328	1892	PO.exe	PO.exe
PID 1892 wrote to memory of 328	1892	PO.exe	PO.exe
PID 1892 wrote to memory of 328	1892	PO.exe	PO.exe
PID 1892 wrote to memory of 328	1892	PO.exe	PO.exe
PID 1892 wrote to memory of 328	1892	PO.exe	PO.exe
PID 1892 wrote to memory of 328	1892	PO.exe	PO.exe
PID 328 wrote to memory of 608	328	PO.exe	vbc.exe
PID 328 wrote to memory of 608	328	PO.exe	vbc.exe
PID 328 wrote to memory of 608	328	PO.exe	vbc.exe
PID 328 wrote to memory of 608	328	PO.exe	vbc.exe
PID 328 wrote to memory of 608	328	PO.exe	vbc.exe
PID 328 wrote to memory of 608	328	PO.exe	vbc.exe
PID 328 wrote to memory of 608	328	PO.exe	vbc.exe
PID 328 wrote to memory of 608	328	PO.exe	vbc.exe
PID 328 wrote to memory of 608	328	PO.exe	vbc.exe
PID 328 wrote to memory of 608	328	PO.exe	vbc.exe
PID 328 wrote to memory of 1612	328	PO.exe	vbc.exe
PID 328 wrote to memory of 1612	328	PO.exe	vbc.exe
PID 328 wrote to memory of 1612	328	PO.exe	vbc.exe
PID 328 wrote to memory of 1612	328	PO.exe	vbc.exe
PID 328 wrote to memory of 1612	328	PO.exe	vbc.exe
PID 328 wrote to memory of 1612	328	PO.exe	vbc.exe
PID 328 wrote to memory of 1612	328	PO.exe	vbc.exe
PID 328 wrote to memory of 1612	328	PO.exe	vbc.exe
PID 328 wrote to memory of 1612	328	PO.exe	vbc.exe
PID 328 wrote to memory of 1612	328	PO.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\PO.exe
"C:\Users\Admin\AppData\Local\Temp\PO.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892

C:\Users\Admin\AppData\Local\Temp\PO.exe
"{path}"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:328

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpD928.tmp"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:608

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpDD9C.tmp"
3⤵
PID:1612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD928.tmp
MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/328-1-0x000000000048B39E-mapping.dmp

Download
memory/328-0-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/328-2-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/328-3-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/608-4-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/608-5-0x0000000000444D30-mapping.dmp

Download
memory/608-6-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/924-7-0x000007FEF7730000-0x000007FEF79AA000-memory.dmp

Filesize
2.5MB

Download
memory/1612-9-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1612-10-0x000000000041211A-mapping.dmp

Download
memory/1612-11-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads