hawkeye_reborn | 56b02707b5f12fd4e8f79fdd9dd9f7eb82394798317a76e499c7d0d659b2d759

General

Target

Po reference Details 00001.exe
Size

690KB
MD5

779713e710d891c7de1bf69bb5557684
SHA1

1d48c2c1bd87c68cdeeda3aee856833f10400ed4
SHA256

56b02707b5f12fd4e8f79fdd9dd9f7eb82394798317a76e499c7d0d659b2d759
SHA512

ea90c8e3302b2562cc5d545523ea442604a739ae56af1fcc13250016b18903bf996e8333401b6c9a792da15aa9c85b4a47ead233648a7554d0b93543d5e0a214

Score

10^/10

hawkeye_reborn m00nd3v_logger keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.1.2.5

Credentials

Protocol: smtp
Host:
mail.gajjarlaser.com
Port:
587
Username:
info@gajjarlaser.com
Password:
#info#123$

Mutex

10351c26-c9ab-4c8e-9c6c-194a12242888

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:false _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:#info#123$ _EmailPort:587 _EmailSSL:true _EmailServer:mail.gajjarlaser.com _EmailUsername:info@gajjarlaser.com _EmptyClipboard:false _EmptyKeyStroke:false _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:10 _LoopPasswordStealer:false _MeltFile:false _Mutex:10351c26-c9ab-4c8e-9c6c-194a12242888 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.1.2.5 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - RebornX, Version=10.1.2.5, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger Payload 2 IoCs

Detects M00nD3v Logger payload in memory.

Processes:

resource	yara_rule
behavioral2/memory/3828-0-0x0000000000400000-0x000000000049C000-memory.dmp	m00nd3v_logger
behavioral2/memory/3828-1-0x0000000000497C3E-mapping.dmp	m00nd3v_logger

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 4 IoCs

Processes:

Po reference Details 00001.exeRegSvcs.exe

description	pid	process	target process
PID 500 set thread context of 3828	500	Po reference Details 00001.exe	RegSvcs.exe
PID 3828 set thread context of 2028	3828	RegSvcs.exe	vbc.exe
PID 3828 set thread context of 3548	3828	RegSvcs.exe	vbc.exe
PID 3828 set thread context of 1532	3828	RegSvcs.exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Po reference Details 00001.exe

pid process

500 Po reference Details 00001.exe
500 Po reference Details 00001.exe
500 Po reference Details 00001.exe
500 Po reference Details 00001.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Po reference Details 00001.exe

description pid process

Token: SeDebugPrivilege 500 Po reference Details 00001.exe

pid	process
500	Po reference Details 00001.exe
500	Po reference Details 00001.exe
500	Po reference Details 00001.exe
500	Po reference Details 00001.exe

description	pid	process
Token: SeDebugPrivilege	500	Po reference Details 00001.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

Po reference Details 00001.exeRegSvcs.exe

description	pid	process	target process
PID 500 wrote to memory of 3212	500	Po reference Details 00001.exe	RegSvcs.exe
PID 500 wrote to memory of 3212	500	Po reference Details 00001.exe	RegSvcs.exe
PID 500 wrote to memory of 3212	500	Po reference Details 00001.exe	RegSvcs.exe
PID 500 wrote to memory of 3208	500	Po reference Details 00001.exe	RegSvcs.exe
PID 500 wrote to memory of 3208	500	Po reference Details 00001.exe	RegSvcs.exe
PID 500 wrote to memory of 3208	500	Po reference Details 00001.exe	RegSvcs.exe
PID 500 wrote to memory of 3828	500	Po reference Details 00001.exe	RegSvcs.exe
PID 500 wrote to memory of 3828	500	Po reference Details 00001.exe	RegSvcs.exe
PID 500 wrote to memory of 3828	500	Po reference Details 00001.exe	RegSvcs.exe
PID 500 wrote to memory of 3828	500	Po reference Details 00001.exe	RegSvcs.exe
PID 500 wrote to memory of 3828	500	Po reference Details 00001.exe	RegSvcs.exe
PID 500 wrote to memory of 3828	500	Po reference Details 00001.exe	RegSvcs.exe
PID 500 wrote to memory of 3828	500	Po reference Details 00001.exe	RegSvcs.exe
PID 500 wrote to memory of 3828	500	Po reference Details 00001.exe	RegSvcs.exe
PID 3828 wrote to memory of 2028	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 2028	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 2028	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 2028	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 2028	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 2028	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 2028	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 2028	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 2028	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 3548	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 3548	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 3548	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 3548	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 3548	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 3548	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 3548	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 3548	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 3548	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 1532	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 1532	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 1532	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 1532	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 1532	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 1532	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 1532	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 1532	3828	RegSvcs.exe	vbc.exe
PID 3828 wrote to memory of 1532	3828	RegSvcs.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\Po reference Details 00001.exe
"C:\Users\Admin\AppData\Local\Temp\Po reference Details 00001.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:500

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"{path}"
2⤵
PID:3212

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"{path}"
2⤵
PID:3208

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"{path}"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3828

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpB27D.tmp"
3⤵
PID:2028

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpA5A8.tmp"
3⤵
PID:3548

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp97AA.tmp"
3⤵
PID:1532

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1532-9-0x000000000041211A-mapping.dmp

Download
memory/2028-2-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2028-3-0x000000000041211A-mapping.dmp

Download
memory/2028-4-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3548-6-0x000000000041211A-mapping.dmp

Download
memory/3828-0-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/3828-1-0x0000000000497C3E-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads