hawkeye_reborn | c6043128c116aedacc1be9abbcb74898065374269665a5387960ce47e805c2c0

General

Target

PO.exe
Size

722KB
MD5

903ca84d60f53ecf1902600beb652c55
SHA1

4e0d56e8b555a6882cfee2132fff4fa81a2c40cc
SHA256

c6043128c116aedacc1be9abbcb74898065374269665a5387960ce47e805c2c0
SHA512

6ac61af0eee49a3596b92e94a36b63f599803183264ba415220c71784d1db691a1170a8c63a0d2cb940559a50a320889a1d70301656aaa38475b7f3a67ab4be6

Score

10^/10

hawkeye_reborn keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.eagleeyeapparels.com
Port:
587
Username:
faruq@eagleeyeapparels.com
Password:
eagle*qaz

Extracted

Family

hawkeye_reborn

Version

10.0.0.1

Credentials

Protocol: smtp
Host:
mail.eagleeyeapparels.com
Port:
587
Username:
faruq@eagleeyeapparels.com
Password:
eagle*qaz

Mutex

f98d37f4-ca90-4ed7-9f6f-6121c4014605

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:eagle*qaz _EmailPort:587 _EmailSSL:true _EmailServer:mail.eagleeyeapparels.com _EmailUsername:faruq@eagleeyeapparels.com _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:f98d37f4-ca90-4ed7-9f6f-6121c4014605 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.1 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.1, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 bot.whatismyipaddress.com

flow	ioc
18	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

PO.exePO.exe

description	pid	process	target process
PID 540 set thread context of 204	540	PO.exe	PO.exe
PID 204 set thread context of 3704	204	PO.exe	vbc.exe
PID 204 set thread context of 2440	204	PO.exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

vbc.exePO.exe

pid process

3704 vbc.exe
3704 vbc.exe
3704 vbc.exe
3704 vbc.exe
204 PO.exe
204 PO.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PO.exe

description pid process

Token: SeDebugPrivilege 204 PO.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

PO.exe

pid process

204 PO.exe

pid	process
3704	vbc.exe
3704	vbc.exe
3704	vbc.exe
3704	vbc.exe
204	PO.exe
204	PO.exe

description	pid	process
Token: SeDebugPrivilege	204	PO.exe

pid	process
204	PO.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

PO.exePO.exe

description	pid	process	target process
PID 540 wrote to memory of 204	540	PO.exe	PO.exe
PID 540 wrote to memory of 204	540	PO.exe	PO.exe
PID 540 wrote to memory of 204	540	PO.exe	PO.exe
PID 540 wrote to memory of 204	540	PO.exe	PO.exe
PID 540 wrote to memory of 204	540	PO.exe	PO.exe
PID 540 wrote to memory of 204	540	PO.exe	PO.exe
PID 540 wrote to memory of 204	540	PO.exe	PO.exe
PID 540 wrote to memory of 204	540	PO.exe	PO.exe
PID 204 wrote to memory of 3704	204	PO.exe	vbc.exe
PID 204 wrote to memory of 3704	204	PO.exe	vbc.exe
PID 204 wrote to memory of 3704	204	PO.exe	vbc.exe
PID 204 wrote to memory of 3704	204	PO.exe	vbc.exe
PID 204 wrote to memory of 3704	204	PO.exe	vbc.exe
PID 204 wrote to memory of 3704	204	PO.exe	vbc.exe
PID 204 wrote to memory of 3704	204	PO.exe	vbc.exe
PID 204 wrote to memory of 3704	204	PO.exe	vbc.exe
PID 204 wrote to memory of 3704	204	PO.exe	vbc.exe
PID 204 wrote to memory of 2440	204	PO.exe	vbc.exe
PID 204 wrote to memory of 2440	204	PO.exe	vbc.exe
PID 204 wrote to memory of 2440	204	PO.exe	vbc.exe
PID 204 wrote to memory of 2440	204	PO.exe	vbc.exe
PID 204 wrote to memory of 2440	204	PO.exe	vbc.exe
PID 204 wrote to memory of 2440	204	PO.exe	vbc.exe
PID 204 wrote to memory of 2440	204	PO.exe	vbc.exe
PID 204 wrote to memory of 2440	204	PO.exe	vbc.exe
PID 204 wrote to memory of 2440	204	PO.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\PO.exe
"C:\Users\Admin\AppData\Local\Temp\PO.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:540

C:\Users\Admin\AppData\Local\Temp\PO.exe
"{path}"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:204

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp5B40.tmp"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3704

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp635F.tmp"
3⤵
PID:2440

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5B40.tmp
MD5
814b5ce4cad79d36055d2d4b5958cc31

SHA1
2a06a869615f0858479371b0415899681fb0c7d8

SHA256
6d1fa1a75faec2b39e8a2a1df8dd0f15e5256de7da7c527225ecf22fdacaf559

SHA512
a82fa1594ccbe1df93a973a01c787a6baa0ce8a97c0b0b0a844c90cb6be092b1094636b4d88c568fece95cd9bdfe4412875011abe318373a4fcfc218f93d1278

Download Submit
memory/204-0-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/204-1-0x000000000048B39E-mapping.dmp

Download
memory/2440-6-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2440-7-0x000000000041211A-mapping.dmp

Download
memory/2440-8-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3704-3-0x0000000000444D30-mapping.dmp

Download
memory/3704-2-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3704-4-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads