Overview

overview

10

Static

static

d76bf6c54a...99.exe

windows7_x64

10

d76bf6c54a...99.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699

  • Size

    1.6MB

  • Sample

    210518-7pnlsgpeke

  • MD5

    bcf3d1b95d9abcbd4d6ab23642fcfc81

  • SHA1

    5b475a9743edbf7614e766503fbffdebccb80c72

  • SHA256

    d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699

  • SHA512

    4e2c6322f8ca72b6a6139c9cd18127e68c0bfc8aa1434065049f2e7c3d6d368f430f141d9b07296a5693d86b75b73ebed57c3b595666f9fe52694a3561075abe

Score
10/10
hawkeye_rebornkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    onu66@yandex.com
  • Password:
    h68-6gz-kaT-CKe

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    onu66@yandex.com
  • Password:
    h68-6gz-kaT-CKe
Mutex

8dddd422-8c06-405f-bbe0-e01bafce5d54

Attributes
  • fields

    map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:h68-6gz-kaT-CKe _EmailPort:587 _EmailSSL:true _EmailServer:smtp.yandex.com _EmailUsername:onu66@yandex.com _ExecutionDelay:5 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:3 _MeltFile:false _Mutex:8dddd422-8c06-405f-bbe0-e01bafce5d54 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]

  • name

    HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Targets

    • Target

      d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699

    • Size

      1.6MB

    • MD5

      bcf3d1b95d9abcbd4d6ab23642fcfc81

    • SHA1

      5b475a9743edbf7614e766503fbffdebccb80c72

    • SHA256

      d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699

    • SHA512

      4e2c6322f8ca72b6a6139c9cd18127e68c0bfc8aa1434065049f2e7c3d6d368f430f141d9b07296a5693d86b75b73ebed57c3b595666f9fe52694a3561075abe

    Score
    10/10
    hawkeye_rebornkeyloggerpersistencespywarestealertrojan

    • HawkEye Reborn

      HawkEye Reborn is an enhanced version of the HawkEye malware kit.

      keyloggertrojanstealerspywarehawkeye_reborn

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks