hawkeye_reborn | 15c7c3a3e619c5db49470198804b7a3a6cf925daceeea180fd0b9cc91bb2e4d1 | Triage

Sharing

General

Target

DOC131020-13102020161809.pdf.exe
Size

816KB
Sample

201109-zbs3ml13sa
MD5

71edcf18af1984f6164e817f01901be8
SHA1

92433522129ad461a913a9b93375b77ec0cfbe1b
SHA256

15c7c3a3e619c5db49470198804b7a3a6cf925daceeea180fd0b9cc91bb2e4d1
SHA512

bc6068001ee3529a3b764e5919f0d73b5cdff49931d5c4c6faf9950df36c061ec449f730830937f859bc15ac89c2fa994eee8de1fe9abb55aee14f461c266d3b

Score

10^/10

hawkeye_reborn m00nd3v_logger keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.1.2.7

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
melfordee@yandex.com
Password:
hhxfdjsihnlsxrzf

Mutex

b229d537-6551-4a40-9bd3-ad959ca672e3

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:hhxfdjsihnlsxrzf _EmailPort:587 _EmailSSL:true _EmailServer:smtp.yandex.com _EmailUsername:melfordee@yandex.com _EmptyClipboard:true _EmptyKeyStroke:true _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:5 _LoopPasswordStealer:true _MeltFile:false _Mutex:b229d537-6551-4a40-9bd3-ad959ca672e3 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:false _Version:10.1.2.7 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - RebornX, Version=10.1.2.7, Culture=neutral, PublicKeyToken=null

Targets

- Target
  
  DOC131020-13102020161809.pdf.exe
- Size
  
  816KB
- MD5
  
  71edcf18af1984f6164e817f01901be8
- SHA1
  
  92433522129ad461a913a9b93375b77ec0cfbe1b
- SHA256
  
  15c7c3a3e619c5db49470198804b7a3a6cf925daceeea180fd0b9cc91bb2e4d1
- SHA512
  
  bc6068001ee3529a3b764e5919f0d73b5cdff49931d5c4c6faf9950df36c061ec449f730830937f859bc15ac89c2fa994eee8de1fe9abb55aee14f461c266d3b
Score

10^/10

hawkeye_reborn m00nd3v_logger keylogger persistence spyware stealer trojan
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- M00nD3v Logger Payload
  Detects M00nD3v Logger payload in memory.
- Modifies service
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

hawkeye_rebornm00nd3v_loggerkeyloggerpersistencespywarestealertrojan

behavioral2

hawkeye_rebornm00nd3v_loggerkeyloggerspywarestealertrojan