hawkeye_reborn | 0cbc00669e5e1a815fca7b7c248898bcea712647dd92986812d9e357d011b00f

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20-04-2022 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Samples_0576-JPG.exe
Size

936KB
MD5

4937b1715d4d8fbdcdf454e3bfcc683c
SHA1

8c2bc71df040c0563638693db430b506c9ea99e5
SHA256

8a525d55d517847b7379170a844775e1ea1ddc79816e4650d74787da63141d65
SHA512

a6e4aecfe1d853e957bc75a019c9dd25e7ba4b04ab3b8cfdecabf983d92511cb61c97f4667bc886aab7bafb38ffa0114ac61a57cd14b8bee5179b2f77b3d51c3

Score

10^/10

hawkeye_reborn m00nd3v_logger collection infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

Protocol: smtp
Host:
smtp.yandex.ru
Port:
587
Username:
[email protected]
Password:
sunday1983

Mutex

db3c0ca3-2c46-4994-9d4d-09d928dc2eb7

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:sunday1983 _EmailPort:587 _EmailSSL:true _EmailServer:smtp.yandex.ru _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:db3c0ca3-2c46-4994-9d4d-09d928dc2eb7 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger Payload 1 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral2/memory/368-142-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/260-152-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/260-154-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/260-155-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2352-146-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/2352-148-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/2352-149-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

resource	yara_rule
behavioral2/memory/2352-146-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/2352-148-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/2352-149-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/260-152-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/260-154-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/260-155-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	Samples_0576-JPG.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4220 set thread context of 368	4220	Samples_0576-JPG.exe	88
PID 368 set thread context of 2352	368	Samples_0576-JPG.exe	90
PID 368 set thread context of 260	368	Samples_0576-JPG.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4196	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4220	Samples_0576-JPG.exe
4220	Samples_0576-JPG.exe
4220	Samples_0576-JPG.exe
4220	Samples_0576-JPG.exe
4220	Samples_0576-JPG.exe
4220	Samples_0576-JPG.exe
4220	Samples_0576-JPG.exe
2352	vbc.exe
2352	vbc.exe
2352	vbc.exe
2352	vbc.exe
2352	vbc.exe
2352	vbc.exe
2352	vbc.exe
2352	vbc.exe
2352	vbc.exe
2352	vbc.exe
2352	vbc.exe
2352	vbc.exe
368	Samples_0576-JPG.exe
368	Samples_0576-JPG.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4220	Samples_0576-JPG.exe
Token: SeDebugPrivilege	368	Samples_0576-JPG.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
368	Samples_0576-JPG.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 4196	4220	Samples_0576-JPG.exe	84
PID 4220 wrote to memory of 4196	4220	Samples_0576-JPG.exe	84
PID 4220 wrote to memory of 4196	4220	Samples_0576-JPG.exe	84
PID 4220 wrote to memory of 1476	4220	Samples_0576-JPG.exe	86
PID 4220 wrote to memory of 1476	4220	Samples_0576-JPG.exe	86
PID 4220 wrote to memory of 1476	4220	Samples_0576-JPG.exe	86
PID 4220 wrote to memory of 4764	4220	Samples_0576-JPG.exe	87
PID 4220 wrote to memory of 4764	4220	Samples_0576-JPG.exe	87
PID 4220 wrote to memory of 4764	4220	Samples_0576-JPG.exe	87
PID 4220 wrote to memory of 2344	4220	Samples_0576-JPG.exe	89
PID 4220 wrote to memory of 2344	4220	Samples_0576-JPG.exe	89
PID 4220 wrote to memory of 2344	4220	Samples_0576-JPG.exe	89
PID 4220 wrote to memory of 368	4220	Samples_0576-JPG.exe	88
PID 4220 wrote to memory of 368	4220	Samples_0576-JPG.exe	88
PID 4220 wrote to memory of 368	4220	Samples_0576-JPG.exe	88
PID 4220 wrote to memory of 368	4220	Samples_0576-JPG.exe	88
PID 4220 wrote to memory of 368	4220	Samples_0576-JPG.exe	88
PID 4220 wrote to memory of 368	4220	Samples_0576-JPG.exe	88
PID 4220 wrote to memory of 368	4220	Samples_0576-JPG.exe	88
PID 4220 wrote to memory of 368	4220	Samples_0576-JPG.exe	88
PID 368 wrote to memory of 2352	368	Samples_0576-JPG.exe	90
PID 368 wrote to memory of 2352	368	Samples_0576-JPG.exe	90
PID 368 wrote to memory of 2352	368	Samples_0576-JPG.exe	90
PID 368 wrote to memory of 2352	368	Samples_0576-JPG.exe	90
PID 368 wrote to memory of 2352	368	Samples_0576-JPG.exe	90
PID 368 wrote to memory of 2352	368	Samples_0576-JPG.exe	90
PID 368 wrote to memory of 2352	368	Samples_0576-JPG.exe	90
PID 368 wrote to memory of 2352	368	Samples_0576-JPG.exe	90
PID 368 wrote to memory of 2352	368	Samples_0576-JPG.exe	90
PID 368 wrote to memory of 260	368	Samples_0576-JPG.exe	91
PID 368 wrote to memory of 260	368	Samples_0576-JPG.exe	91
PID 368 wrote to memory of 260	368	Samples_0576-JPG.exe	91
PID 368 wrote to memory of 260	368	Samples_0576-JPG.exe	91
PID 368 wrote to memory of 260	368	Samples_0576-JPG.exe	91
PID 368 wrote to memory of 260	368	Samples_0576-JPG.exe	91
PID 368 wrote to memory of 260	368	Samples_0576-JPG.exe	91
PID 368 wrote to memory of 260	368	Samples_0576-JPG.exe	91
PID 368 wrote to memory of 260	368	Samples_0576-JPG.exe	91

C:\Users\Admin\AppData\Local\Temp\Samples_0576-JPG.exe
"C:\Users\Admin\AppData\Local\Temp\Samples_0576-JPG.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jDvaPKwvWfgTqG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB5F2.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4196
- C:\Users\Admin\AppData\Local\Temp\Samples_0576-JPG.exe
  "C:\Users\Admin\AppData\Local\Temp\Samples_0576-JPG.exe"
  2⤵
  PID:1476
- C:\Users\Admin\AppData\Local\Temp\Samples_0576-JPG.exe
  "C:\Users\Admin\AppData\Local\Temp\Samples_0576-JPG.exe"
  2⤵
  PID:4764
- C:\Users\Admin\AppData\Local\Temp\Samples_0576-JPG.exe
  "C:\Users\Admin\AppData\Local\Temp\Samples_0576-JPG.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpE687.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2352
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpEAAF.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:260
- C:\Users\Admin\AppData\Local\Temp\Samples_0576-JPG.exe
  "C:\Users\Admin\AppData\Local\Temp\Samples_0576-JPG.exe"
  2⤵
  PID:2344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Samples_0576-JPG.exe.log

Filesize
1KB

MD5
17573558c4e714f606f997e5157afaac

SHA1
13e16e9415ceef429aaf124139671ebeca09ed23

SHA256
c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553

SHA512
f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB5F2.tmp

Filesize
1KB

MD5
d2b2716b6890b8bbd1d06d1589a39eae

SHA1
3139351b490e63e9bc43fffaa103d35fc8f1d32f

SHA256
517d4793be2e5f887f62a515f5343fc8fa63206e000bc867f5746e08a9ca17ed

SHA512
ff4a581430783396c985eaeac2b45992821762faf14794b1c06a786703785f8da3699962c11a3b1ba3b95a4f9ebced1ff6be5706d5a72b19e8c9c9b6d2ee330a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE687.tmp

Filesize
4KB

MD5
bdf65f70610625cc771c5cc7ce168c7d

SHA1
a8829b1c071ed0521d11925a98468c12a53a03b8

SHA256
b66236dd86f140ca02db0c296e45032b272de2895c4f047a562e73bc8395dba5

SHA512
add2db50b0440b07ecc48a5fde7f0b72e84b76f11ea060944afa28ddd03791e6adb3bfca704254131fb3f591f484b37f7276fab96b0c4776a27cb526bcf5f3a4

Download Submit
memory/260-155-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/260-154-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/260-152-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/368-142-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/368-144-0x0000000005240000-0x00000000052A6000-memory.dmp

Filesize
408KB

Download
memory/2352-148-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2352-146-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2352-149-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4220-130-0x0000000000FC0000-0x00000000010B0000-memory.dmp

Filesize
960KB

Download
memory/4220-135-0x0000000005D20000-0x0000000005D76000-memory.dmp

Filesize
344KB

Download
memory/4220-134-0x0000000005A40000-0x0000000005A4A000-memory.dmp

Filesize
40KB

Download
memory/4220-133-0x0000000005B30000-0x0000000005BC2000-memory.dmp

Filesize
584KB

Download
memory/4220-132-0x00000000060E0000-0x0000000006684000-memory.dmp

Filesize
5.6MB

Download
memory/4220-131-0x0000000005A90000-0x0000000005B2C000-memory.dmp

Filesize
624KB

Download