hawkeye_reborn | fa933a52aefddd4d8afc31c031c7e2e2fe18a8e64caec310b0ea1a7ea2fe744f

General

Target

fa933a52aefddd4d8afc31c031c7e2e2fe18a8e64caec310b0ea1a7ea2fe744f.exe
Size

449KB
MD5

361b4920c1e7f6804609f9a1493ba6df
SHA1

d0f7243729e2734287e627527ff17a597c72b6d1
SHA256

fa933a52aefddd4d8afc31c031c7e2e2fe18a8e64caec310b0ea1a7ea2fe744f
SHA512

748428dd8d0f2d6e151a3c29366a3913466db6245aa6976ab84ff60c00efbf3641aea02380d93949b954aa96d6f388be7173f1901e8415b5d89655c92d87d915

Score

10^/10

hawkeye_reborn m00nd3v_logger collection evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.1.2.2

Credentials

Protocol: smtp
Host:
mail.nabf.com.au
Port:
25
Username:
[email protected]
Password:
r%cd3=De!F8)?Q.VuK

Mutex

1c299e71-7ecf-419a-8954-88ba5287d725

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:r%cd3=De!F8)?Q.VuK _EmailPort:25 _EmailSSL:true _EmailServer:mail.nabf.com.au _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:1c299e71-7ecf-419a-8954-88ba5287d725 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.1.2.2 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - RebornX, Version=10.1.2.2, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

M00nD3v Logger Payload 4 IoCs

Detects M00nD3v Logger payload in memory.

Processes:

resource	yara_rule
behavioral1/memory/984-73-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/984-74-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/984-75-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/984-76-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 bot.whatismyipaddress.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

installutil.exe

description pid process target process

PID 1452 set thread context of 984 1452 installutil.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1672 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

installutil.exepowershell.exeRegSvcs.exe

pid process

1452 installutil.exe
268 powershell.exe
984 RegSvcs.exe
984 RegSvcs.exe

flow	ioc
4	bot.whatismyipaddress.com

description	pid	process	target process
PID 1452 set thread context of 984	1452	installutil.exe	RegSvcs.exe

pid	process
1672	schtasks.exe

pid	process
1452	installutil.exe
268	powershell.exe
984	RegSvcs.exe
984	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

fa933a52aefddd4d8afc31c031c7e2e2fe18a8e64caec310b0ea1a7ea2fe744f.exeinstallutil.exepowershell.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1664	fa933a52aefddd4d8afc31c031c7e2e2fe18a8e64caec310b0ea1a7ea2fe744f.exe
Token: SeDebugPrivilege	1452	installutil.exe
Token: SeDebugPrivilege	268	powershell.exe
Token: SeDebugPrivilege	984	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

984 RegSvcs.exe

pid	process
984	RegSvcs.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

fa933a52aefddd4d8afc31c031c7e2e2fe18a8e64caec310b0ea1a7ea2fe744f.exeinstallutil.exe

description	pid	process	target process
PID 1664 wrote to memory of 1452	1664	fa933a52aefddd4d8afc31c031c7e2e2fe18a8e64caec310b0ea1a7ea2fe744f.exe	installutil.exe
PID 1664 wrote to memory of 1452	1664	fa933a52aefddd4d8afc31c031c7e2e2fe18a8e64caec310b0ea1a7ea2fe744f.exe	installutil.exe
PID 1664 wrote to memory of 1452	1664	fa933a52aefddd4d8afc31c031c7e2e2fe18a8e64caec310b0ea1a7ea2fe744f.exe	installutil.exe
PID 1664 wrote to memory of 1452	1664	fa933a52aefddd4d8afc31c031c7e2e2fe18a8e64caec310b0ea1a7ea2fe744f.exe	installutil.exe
PID 1664 wrote to memory of 1452	1664	fa933a52aefddd4d8afc31c031c7e2e2fe18a8e64caec310b0ea1a7ea2fe744f.exe	installutil.exe
PID 1664 wrote to memory of 1452	1664	fa933a52aefddd4d8afc31c031c7e2e2fe18a8e64caec310b0ea1a7ea2fe744f.exe	installutil.exe
PID 1664 wrote to memory of 1452	1664	fa933a52aefddd4d8afc31c031c7e2e2fe18a8e64caec310b0ea1a7ea2fe744f.exe	installutil.exe
PID 1452 wrote to memory of 268	1452	installutil.exe	powershell.exe
PID 1452 wrote to memory of 268	1452	installutil.exe	powershell.exe
PID 1452 wrote to memory of 268	1452	installutil.exe	powershell.exe
PID 1452 wrote to memory of 268	1452	installutil.exe	powershell.exe
PID 1452 wrote to memory of 1672	1452	installutil.exe	schtasks.exe
PID 1452 wrote to memory of 1672	1452	installutil.exe	schtasks.exe
PID 1452 wrote to memory of 1672	1452	installutil.exe	schtasks.exe
PID 1452 wrote to memory of 1672	1452	installutil.exe	schtasks.exe
PID 1452 wrote to memory of 984	1452	installutil.exe	RegSvcs.exe
PID 1452 wrote to memory of 984	1452	installutil.exe	RegSvcs.exe
PID 1452 wrote to memory of 984	1452	installutil.exe	RegSvcs.exe
PID 1452 wrote to memory of 984	1452	installutil.exe	RegSvcs.exe
PID 1452 wrote to memory of 984	1452	installutil.exe	RegSvcs.exe
PID 1452 wrote to memory of 984	1452	installutil.exe	RegSvcs.exe
PID 1452 wrote to memory of 984	1452	installutil.exe	RegSvcs.exe
PID 1452 wrote to memory of 984	1452	installutil.exe	RegSvcs.exe
PID 1452 wrote to memory of 984	1452	installutil.exe	RegSvcs.exe
PID 1452 wrote to memory of 984	1452	installutil.exe	RegSvcs.exe
PID 1452 wrote to memory of 984	1452	installutil.exe	RegSvcs.exe
PID 1452 wrote to memory of 984	1452	installutil.exe	RegSvcs.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\fa933a52aefddd4d8afc31c031c7e2e2fe18a8e64caec310b0ea1a7ea2fe744f.exe
"C:\Users\Admin\AppData\Local\Temp\fa933a52aefddd4d8afc31c031c7e2e2fe18a8e64caec310b0ea1a7ea2fe744f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Local\Temp\fa933a52aefddd4d8afc31c031c7e2e2fe18a8e64caec310b0ea1a7ea2fe744f.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:268

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WkGggWLmOAqiZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2D27.tmp"
3⤵
- Creates scheduled task(s)
PID:1672

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Modify Existing Service

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2D27.tmp

MD5
89e80410634cc7adce7de2b2bd0dca7d

SHA1
88ff36a8b6d0e30c9325a78827bc99a9946e8851

SHA256
6312e3aa433c4664a8773c91f4b876734ef16832257ad6316c9bf87751649a80

SHA512
0938bc04ad7e32a9798b7faa7859a4a47d41b81672c19fef2c7262f87dd2fb487c3e6460e4d2b7b4a7a8aa7d65a9e3f204ec75b73eab90fb205d20a94153c005

Download Submit
memory/268-68-0x0000000002440000-0x000000000308A000-memory.dmp

Filesize
12.3MB

Download
memory/268-69-0x0000000002440000-0x000000000308A000-memory.dmp

Filesize
12.3MB

Download
memory/984-73-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/984-71-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/984-80-0x0000000004A85000-0x0000000004A96000-memory.dmp

Filesize
68KB

Download
memory/984-79-0x0000000004A80000-0x0000000004A81000-memory.dmp

Filesize
4KB

Download
memory/984-77-0x0000000000550000-0x0000000000556000-memory.dmp

Filesize
24KB

Download
memory/984-76-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/984-75-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/984-74-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/984-72-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1452-63-0x0000000004F10000-0x0000000004F78000-memory.dmp

Filesize
416KB

Download
memory/1452-57-0x0000000000B10000-0x0000000000B1C000-memory.dmp

Filesize
48KB

Download
memory/1452-64-0x0000000007490000-0x000000000751E000-memory.dmp

Filesize
568KB

Download
memory/1452-58-0x0000000001F20000-0x0000000001F96000-memory.dmp

Filesize
472KB

Download
memory/1452-62-0x0000000000660000-0x00000000006D6000-memory.dmp

Filesize
472KB

Download
memory/1452-61-0x0000000000610000-0x0000000000618000-memory.dmp

Filesize
32KB

Download
memory/1452-60-0x0000000004710000-0x0000000004711000-memory.dmp

Filesize
4KB

Download
memory/1664-55-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/1664-56-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/1664-54-0x0000000000CD0000-0x0000000000D46000-memory.dmp

Filesize
472KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads