hawkeye_reborn | 5df1a3e64559a1056fd1cac70e1b6bbf236eca17c1c3a5e59f1c329710b42dbb

General

Target

Catalogue-Order-202105.exe
Size

789KB
MD5

569522488836413ac64590314af81450
SHA1

0830f265c39c1f32bc0c8931324d04e97ea2773d
SHA256

5df1a3e64559a1056fd1cac70e1b6bbf236eca17c1c3a5e59f1c329710b42dbb
SHA512

c7da8b825b7dfbb8a3408bb63e97634a3d1c6a45c3770fd823a61c66a2af2eea936fd8ed7852ab6dbcac79dd0a106edb19dc50b6398cd9d312fdb7d4d2c2e768

Score

10^/10

hawkeye_reborn keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.anuarul-sanatatii.ro
Port:
21
Username:
[email protected]
Password:
I&Z$wYX(9-?n

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

Protocol: ftp
Host:
ftp.anuarul-sanatatii.ro
Port:
21
Username:
[email protected]
Password:
I&Z$wYX(9-?n

Mutex

0dc1ff33-2835-4785-b633-6d96c314767d

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:false _Delivery:2 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPort:0 _EmailSSL:false _ExecutionDelay:10 _FTPPassword:I&Z$wYX(9-?n _FTPPort:21 _FTPSFTP:true _FTPServer:ftp.anuarul-sanatatii.ro _FTPUsername:[email protected] _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:57000 _MeltFile:false _Mutex:0dc1ff33-2835-4785-b633-6d96c314767d _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 bot.whatismyipaddress.com

flow	ioc
16	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

Catalogue-Order-202105.exeCatalogue-Order-202105.exe

description	pid	process	target process
PID 1172 set thread context of 3964	1172	Catalogue-Order-202105.exe	Catalogue-Order-202105.exe
PID 3964 set thread context of 864	3964	Catalogue-Order-202105.exe	vbc.exe
PID 3964 set thread context of 3136	3964	Catalogue-Order-202105.exe	vbc.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1924 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

vbc.exe

pid process

864 vbc.exe
864 vbc.exe
864 vbc.exe
864 vbc.exe

pid	process
1924	schtasks.exe

pid	process
864	vbc.exe
864	vbc.exe
864	vbc.exe
864	vbc.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

Catalogue-Order-202105.exeCatalogue-Order-202105.exe

description	pid	process	target process
PID 1172 wrote to memory of 1924	1172	Catalogue-Order-202105.exe	schtasks.exe
PID 1172 wrote to memory of 1924	1172	Catalogue-Order-202105.exe	schtasks.exe
PID 1172 wrote to memory of 1924	1172	Catalogue-Order-202105.exe	schtasks.exe
PID 1172 wrote to memory of 3964	1172	Catalogue-Order-202105.exe	Catalogue-Order-202105.exe
PID 1172 wrote to memory of 3964	1172	Catalogue-Order-202105.exe	Catalogue-Order-202105.exe
PID 1172 wrote to memory of 3964	1172	Catalogue-Order-202105.exe	Catalogue-Order-202105.exe
PID 1172 wrote to memory of 3964	1172	Catalogue-Order-202105.exe	Catalogue-Order-202105.exe
PID 1172 wrote to memory of 3964	1172	Catalogue-Order-202105.exe	Catalogue-Order-202105.exe
PID 1172 wrote to memory of 3964	1172	Catalogue-Order-202105.exe	Catalogue-Order-202105.exe
PID 1172 wrote to memory of 3964	1172	Catalogue-Order-202105.exe	Catalogue-Order-202105.exe
PID 1172 wrote to memory of 3964	1172	Catalogue-Order-202105.exe	Catalogue-Order-202105.exe
PID 3964 wrote to memory of 864	3964	Catalogue-Order-202105.exe	vbc.exe
PID 3964 wrote to memory of 864	3964	Catalogue-Order-202105.exe	vbc.exe
PID 3964 wrote to memory of 864	3964	Catalogue-Order-202105.exe	vbc.exe
PID 3964 wrote to memory of 864	3964	Catalogue-Order-202105.exe	vbc.exe
PID 3964 wrote to memory of 864	3964	Catalogue-Order-202105.exe	vbc.exe
PID 3964 wrote to memory of 864	3964	Catalogue-Order-202105.exe	vbc.exe
PID 3964 wrote to memory of 864	3964	Catalogue-Order-202105.exe	vbc.exe
PID 3964 wrote to memory of 864	3964	Catalogue-Order-202105.exe	vbc.exe
PID 3964 wrote to memory of 864	3964	Catalogue-Order-202105.exe	vbc.exe
PID 3964 wrote to memory of 3136	3964	Catalogue-Order-202105.exe	vbc.exe
PID 3964 wrote to memory of 3136	3964	Catalogue-Order-202105.exe	vbc.exe
PID 3964 wrote to memory of 3136	3964	Catalogue-Order-202105.exe	vbc.exe
PID 3964 wrote to memory of 3136	3964	Catalogue-Order-202105.exe	vbc.exe
PID 3964 wrote to memory of 3136	3964	Catalogue-Order-202105.exe	vbc.exe
PID 3964 wrote to memory of 3136	3964	Catalogue-Order-202105.exe	vbc.exe
PID 3964 wrote to memory of 3136	3964	Catalogue-Order-202105.exe	vbc.exe
PID 3964 wrote to memory of 3136	3964	Catalogue-Order-202105.exe	vbc.exe
PID 3964 wrote to memory of 3136	3964	Catalogue-Order-202105.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\Catalogue-Order-202105.exe
"C:\Users\Admin\AppData\Local\Temp\Catalogue-Order-202105.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jivhQDWsyfrHHU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp793D.tmp"
2⤵
- Creates scheduled task(s)
PID:1924

C:\Users\Admin\AppData\Local\Temp\Catalogue-Order-202105.exe
"{path}"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3964

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpA5CB.tmp"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:864

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpADCB.tmp"
3⤵
PID:3136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Catalogue-Order-202105.exe.log

MD5
ef140ef600b2463c9e7dbf064a104046

SHA1
c08fd1853877be95575ea2e860dd8cafef31f54c

SHA256
ad8ae97fdeb174b20f02c7ddf9466981856d77d51133599b5954f48f78a1b616

SHA512
bf16df0994080bdc832cb39a312e0095de57608256fcf0d04d589e0bdf3283f918fb0d6ec86ea28a4b1af6db12813c52a724028f02330ebc3a9d32a4fcda706c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp793D.tmp

MD5
755555984d2e211f2d8662e90269de88

SHA1
c49f22bedeabef61603cdee890c06d8d98c45c01

SHA256
387b1b25b38c2332ecf84a389b5d48f6ec1ed921a84bea2912e408961889b172

SHA512
3d5084adbddaab3df55ab6863687b845a77a6ef7f7e40e4c0f44ec766ef66d0abb68cd2d147f71f021ddeb52d576a88cecc3a0b0f2a43b2c5278d7ed727a24f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA5CB.tmp

MD5
1e69b6d630e694119f4f8c448a430b60

SHA1
b118feca7d85ec706b54279a1dafc71673fe6e54

SHA256
2f7eedbe9e3b0a3aa08df4fa2dc27de189484a8da8925cc6056513d744b7c00e

SHA512
19924161f75cbbcf7bdf122f3aecb43d813186a6693413ccc15bb2945d48401c8f058edf034cc641cedc97ae5e328d88fabfab1b5f324014b83671b3ebd78822

Download Submit
memory/864-5-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/864-6-0x0000000000444D30-mapping.dmp

Download
memory/864-7-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1924-0-0x0000000000000000-mapping.dmp

Download
memory/3136-9-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3136-10-0x000000000041211A-mapping.dmp

Download
memory/3136-11-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3964-2-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/3964-3-0x000000000048B2BE-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads