hawkeye_reborn | 8db8c4d8cf585fc858ef52a8449f3172536dde3e4d9611b11426e1b3e88598d2

General

Target

LATEST PRECAUTIONARY MEASURES_pdf.exe
Size

449KB
MD5

361b4920c1e7f6804609f9a1493ba6df
SHA1

d0f7243729e2734287e627527ff17a597c72b6d1
SHA256

fa933a52aefddd4d8afc31c031c7e2e2fe18a8e64caec310b0ea1a7ea2fe744f
SHA512

748428dd8d0f2d6e151a3c29366a3913466db6245aa6976ab84ff60c00efbf3641aea02380d93949b954aa96d6f388be7173f1901e8415b5d89655c92d87d915

Score

10^/10

hawkeye_reborn m00nd3v_logger collection evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.1.2.2

Credentials

Protocol: smtp
Host:
mail.nabf.com.au
Port:
25
Username:
[email protected]
Password:
r%cd3=De!F8)?Q.VuK

Mutex

1c299e71-7ecf-419a-8954-88ba5287d725

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:r%cd3=De!F8)?Q.VuK _EmailPort:25 _EmailSSL:true _EmailServer:mail.nabf.com.au _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:1c299e71-7ecf-419a-8954-88ba5287d725 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.1.2.2 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - RebornX, Version=10.1.2.2, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

M00nD3v Logger Payload 4 IoCs

Detects M00nD3v Logger payload in memory.

Processes:

resource	yara_rule
behavioral1/memory/1700-74-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1700-75-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1700-76-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1700-77-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 bot.whatismyipaddress.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

installutil.exe

description pid process target process

PID 1180 set thread context of 1700 1180 installutil.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

572 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

installutil.exepowershell.exeRegSvcs.exe

pid process

1180 installutil.exe
724 powershell.exe
1700 RegSvcs.exe
1700 RegSvcs.exe

flow	ioc
4	bot.whatismyipaddress.com

description	pid	process	target process
PID 1180 set thread context of 1700	1180	installutil.exe	RegSvcs.exe

pid	process
572	schtasks.exe

pid	process
1180	installutil.exe
724	powershell.exe
1700	RegSvcs.exe
1700	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

LATEST PRECAUTIONARY MEASURES_pdf.exeinstallutil.exepowershell.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1604	LATEST PRECAUTIONARY MEASURES_pdf.exe
Token: SeDebugPrivilege	1180	installutil.exe
Token: SeDebugPrivilege	724	powershell.exe
Token: SeDebugPrivilege	1700	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

1700 RegSvcs.exe

pid	process
1700	RegSvcs.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

LATEST PRECAUTIONARY MEASURES_pdf.exeinstallutil.exe

description	pid	process	target process
PID 1604 wrote to memory of 1180	1604	LATEST PRECAUTIONARY MEASURES_pdf.exe	installutil.exe
PID 1604 wrote to memory of 1180	1604	LATEST PRECAUTIONARY MEASURES_pdf.exe	installutil.exe
PID 1604 wrote to memory of 1180	1604	LATEST PRECAUTIONARY MEASURES_pdf.exe	installutil.exe
PID 1604 wrote to memory of 1180	1604	LATEST PRECAUTIONARY MEASURES_pdf.exe	installutil.exe
PID 1604 wrote to memory of 1180	1604	LATEST PRECAUTIONARY MEASURES_pdf.exe	installutil.exe
PID 1604 wrote to memory of 1180	1604	LATEST PRECAUTIONARY MEASURES_pdf.exe	installutil.exe
PID 1604 wrote to memory of 1180	1604	LATEST PRECAUTIONARY MEASURES_pdf.exe	installutil.exe
PID 1180 wrote to memory of 724	1180	installutil.exe	powershell.exe
PID 1180 wrote to memory of 724	1180	installutil.exe	powershell.exe
PID 1180 wrote to memory of 724	1180	installutil.exe	powershell.exe
PID 1180 wrote to memory of 724	1180	installutil.exe	powershell.exe
PID 1180 wrote to memory of 572	1180	installutil.exe	schtasks.exe
PID 1180 wrote to memory of 572	1180	installutil.exe	schtasks.exe
PID 1180 wrote to memory of 572	1180	installutil.exe	schtasks.exe
PID 1180 wrote to memory of 572	1180	installutil.exe	schtasks.exe
PID 1180 wrote to memory of 1700	1180	installutil.exe	RegSvcs.exe
PID 1180 wrote to memory of 1700	1180	installutil.exe	RegSvcs.exe
PID 1180 wrote to memory of 1700	1180	installutil.exe	RegSvcs.exe
PID 1180 wrote to memory of 1700	1180	installutil.exe	RegSvcs.exe
PID 1180 wrote to memory of 1700	1180	installutil.exe	RegSvcs.exe
PID 1180 wrote to memory of 1700	1180	installutil.exe	RegSvcs.exe
PID 1180 wrote to memory of 1700	1180	installutil.exe	RegSvcs.exe
PID 1180 wrote to memory of 1700	1180	installutil.exe	RegSvcs.exe
PID 1180 wrote to memory of 1700	1180	installutil.exe	RegSvcs.exe
PID 1180 wrote to memory of 1700	1180	installutil.exe	RegSvcs.exe
PID 1180 wrote to memory of 1700	1180	installutil.exe	RegSvcs.exe
PID 1180 wrote to memory of 1700	1180	installutil.exe	RegSvcs.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\LATEST PRECAUTIONARY MEASURES_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\LATEST PRECAUTIONARY MEASURES_pdf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Local\Temp\LATEST PRECAUTIONARY MEASURES_pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:724

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WkGggWLmOAqiZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1257.tmp"
3⤵
- Creates scheduled task(s)
PID:572

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Modify Existing Service

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1257.tmp

MD5
55cc3c5965b916cc1e28fe1146395565

SHA1
52386dc0886f2914edf2d199cd7fbb1fea1449ea

SHA256
aac2fca48130676e4c01d4c5d0856312722848457862b5f45660306cd05d7745

SHA512
aa995865384df86f96722e2f23d53eb79353bfbbcc68f97a4f5efcea59f0a864830ae0b27a396d5d631e67e33a78b49367fc0c80cd44c2fa2c671d43bb18e286

Download Submit
memory/724-68-0x0000000002430000-0x000000000307A000-memory.dmp

Filesize
12.3MB

Download
memory/724-70-0x0000000002430000-0x000000000307A000-memory.dmp

Filesize
12.3MB

Download
memory/724-69-0x0000000002430000-0x000000000307A000-memory.dmp

Filesize
12.3MB

Download
memory/1180-60-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/1180-57-0x0000000000B40000-0x0000000000B4C000-memory.dmp

Filesize
48KB

Download
memory/1180-61-0x0000000000510000-0x0000000000518000-memory.dmp

Filesize
32KB

Download
memory/1180-62-0x0000000000A20000-0x0000000000A96000-memory.dmp

Filesize
472KB

Download
memory/1180-63-0x0000000005040000-0x00000000050A8000-memory.dmp

Filesize
416KB

Download
memory/1180-64-0x00000000051E0000-0x000000000526E000-memory.dmp

Filesize
568KB

Download
memory/1180-58-0x0000000004970000-0x00000000049E6000-memory.dmp

Filesize
472KB

Download
memory/1604-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1604-56-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download
memory/1604-54-0x0000000000830000-0x00000000008A6000-memory.dmp

Filesize
472KB

Download
memory/1700-72-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1700-73-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1700-74-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1700-75-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1700-76-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1700-77-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1700-78-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/1700-80-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads