hawkeye_reborn | d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699

Analysis

max time kernel
151s
max time network
59s
platform
windows7_x64
resource
win7v20210410
submitted
18-05-2021 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699.exe
Size

1.6MB
MD5

bcf3d1b95d9abcbd4d6ab23642fcfc81
SHA1

5b475a9743edbf7614e766503fbffdebccb80c72
SHA256

d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699
SHA512

4e2c6322f8ca72b6a6139c9cd18127e68c0bfc8aa1434065049f2e7c3d6d368f430f141d9b07296a5693d86b75b73ebed57c3b595666f9fe52694a3561075abe

Score

10^/10

hawkeye_reborn keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
onu66@yandex.com
Password:
h68-6gz-kaT-CKe

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
onu66@yandex.com
Password:
h68-6gz-kaT-CKe

Mutex

8dddd422-8c06-405f-bbe0-e01bafce5d54

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:h68-6gz-kaT-CKe _EmailPort:587 _EmailSSL:true _EmailServer:smtp.yandex.com _EmailUsername:onu66@yandex.com _ExecutionDelay:5 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:3 _MeltFile:false _Mutex:8dddd422-8c06-405f-bbe0-e01bafce5d54 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/544-77-0x0000000000B70000-0x0000000000BE2000-memory.dmp	MailPassView
behavioral1/memory/1684-85-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral1/memory/1684-86-0x000000000041211A-mapping.dmp	MailPassView
behavioral1/memory/1684-88-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/544-77-0x0000000000B70000-0x0000000000BE2000-memory.dmp	WebBrowserPassView
behavioral1/memory/1728-80-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral1/memory/1728-81-0x0000000000444D30-mapping.dmp	WebBrowserPassView
behavioral1/memory/1728-83-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/544-77-0x0000000000B70000-0x0000000000BE2000-memory.dmp	Nirsoft
behavioral1/memory/1728-80-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral1/memory/1728-81-0x0000000000444D30-mapping.dmp	Nirsoft
behavioral1/memory/1728-83-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral1/memory/1684-85-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/1684-86-0x000000000041211A-mapping.dmp	Nirsoft
behavioral1/memory/1684-88-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Executes dropped EXE 2 IoCs

Processes:

vigcdruw.comRegSvcs.exe

pid process

968 vigcdruw.com
544 RegSvcs.exe

pid	process
968	vigcdruw.com
544	RegSvcs.exe

Loads dropped DLL 5 IoCs

Processes:

d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699.exevigcdruw.com

pid	process
2040	d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699.exe
2040	d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699.exe
2040	d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699.exe
2040	d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699.exe
968	vigcdruw.com

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vigcdruw.com

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	vigcdruw.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\44331869\\vigcdruw.com C:\\Users\\Admin\\AppData\\Local\\Temp\\44331869\\AUPOMP~1.OVT"	vigcdruw.com

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 bot.whatismyipaddress.com

flow	ioc
5	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

vigcdruw.comRegSvcs.exe

description	pid	process	target process
PID 968 set thread context of 544	968	vigcdruw.com	RegSvcs.exe
PID 544 set thread context of 1728	544	RegSvcs.exe	vbc.exe
PID 544 set thread context of 1684	544	RegSvcs.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

RegSvcs.exevbc.exe

pid process

544 RegSvcs.exe
544 RegSvcs.exe
544 RegSvcs.exe
544 RegSvcs.exe
1728 vbc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 544 RegSvcs.exe

pid	process
544	RegSvcs.exe
544	RegSvcs.exe
544	RegSvcs.exe
544	RegSvcs.exe
1728	vbc.exe

description	pid	process
Token: SeDebugPrivilege	544	RegSvcs.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699.exevigcdruw.comRegSvcs.exe

description	pid	process	target process
PID 2040 wrote to memory of 968	2040	d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699.exe	vigcdruw.com
PID 2040 wrote to memory of 968	2040	d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699.exe	vigcdruw.com
PID 2040 wrote to memory of 968	2040	d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699.exe	vigcdruw.com
PID 2040 wrote to memory of 968	2040	d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699.exe	vigcdruw.com
PID 968 wrote to memory of 544	968	vigcdruw.com	RegSvcs.exe
PID 968 wrote to memory of 544	968	vigcdruw.com	RegSvcs.exe
PID 968 wrote to memory of 544	968	vigcdruw.com	RegSvcs.exe
PID 968 wrote to memory of 544	968	vigcdruw.com	RegSvcs.exe
PID 968 wrote to memory of 544	968	vigcdruw.com	RegSvcs.exe
PID 968 wrote to memory of 544	968	vigcdruw.com	RegSvcs.exe
PID 968 wrote to memory of 544	968	vigcdruw.com	RegSvcs.exe
PID 968 wrote to memory of 544	968	vigcdruw.com	RegSvcs.exe
PID 968 wrote to memory of 544	968	vigcdruw.com	RegSvcs.exe
PID 544 wrote to memory of 1728	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1728	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1728	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1728	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1728	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1728	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1728	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1728	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1728	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1728	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1684	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1684	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1684	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1684	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1684	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1684	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1684	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1684	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1684	544	RegSvcs.exe	vbc.exe
PID 544 wrote to memory of 1684	544	RegSvcs.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699.exe
"C:\Users\Admin\AppData\Local\Temp\d76bf6c54a5ba01ef7edcaeb3811500f9896f49726eabdad461375af0dbf1699.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\AppData\Local\Temp\44331869\vigcdruw.com
"C:\Users\Admin\AppData\Local\Temp\44331869\vigcdruw.com" aupompqau.ovt
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:968

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp82F.tmp"
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1728

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpCE1.tmp"
4⤵
PID:1684

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Scripting

T1064

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44331869\aupompqau.ovt
MD5
9004e464f39c7c5d3643aa1709cc34e0

SHA1
2887cce3a6a0649136726e2398e87fc4dfccbfaa

SHA256
a2f00860b3704829e308f35300163123a7ae9ed2f1e06b914ff884c4ec06dd6f

SHA512
928d7bebe62a05167c59c727982ded93f0baf30a97d6aec46072098729842854743ad17a369b4f15a67319c5753fd6f98379cc729d66dc58a664e1baeeba2152

Download Submit
C:\Users\Admin\AppData\Local\Temp\44331869\dtnpkt.ini
MD5
10fc838134b8d62bdb9518aead71d3ea

SHA1
106b9de0c35789ed1e2bb775fcf19e1430793a2e

SHA256
cf6415aff0437524dbf05f9cc2fd7d6be90a5a011d122932cac0ffc7f0dc08ba

SHA512
4e376add492dfb2eef7ca90602aa15f9391bf3415624e375044e8d4a2565d6be6961ad7af97d4e939533f91557449f684204efb1e83936742278cf0dd0c17809

Download Submit
C:\Users\Admin\AppData\Local\Temp\44331869\vigcdruw.com
MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp82F.tmp
MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\Users\Admin\AppData\Local\Temp\44331869\vigcdruw.com
MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
\Users\Admin\AppData\Local\Temp\44331869\vigcdruw.com
MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
\Users\Admin\AppData\Local\Temp\44331869\vigcdruw.com
MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
\Users\Admin\AppData\Local\Temp\44331869\vigcdruw.com
MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
\Users\Admin\AppData\Local\Temp\RegSvcs.exe
MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
memory/544-75-0x0000000000C60000-0x00000000085C2000-memory.dmp

Filesize
121.4MB

Download
memory/544-79-0x000000000C4B5000-0x000000000C4C6000-memory.dmp

Filesize
68KB

Download
memory/544-71-0x0000000000C60000-0x00000000085C2000-memory.dmp

Filesize
121.4MB

Download
memory/544-72-0x0000000000CEB2BE-mapping.dmp

Download
memory/544-77-0x0000000000B70000-0x0000000000BE2000-memory.dmp

Filesize
456KB

Download
memory/544-78-0x000000000C4B0000-0x000000000C4B1000-memory.dmp

Filesize
4KB

Download
memory/968-65-0x0000000000000000-mapping.dmp

Download
memory/1684-85-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1684-86-0x000000000041211A-mapping.dmp

Download
memory/1684-88-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1728-80-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1728-81-0x0000000000444D30-mapping.dmp

Download
memory/1728-83-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2040-60-0x0000000076281000-0x0000000076283000-memory.dmp

Filesize
8KB

Download