hawkeye_reborn | 59643cb09c6697e43bcb64c8ade22b23c0a95a5ef4106603ce2ead7551af4e20

Analysis

max time kernel
142s
max time network
192s
platform
windows7_x64
resource
win7-20220414-en
submitted
08-05-2022 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BID (ITB).exe
Size

695KB
MD5

252e0a3b8da887d3da7ff844b1864be2
SHA1

614228df1144b4569adec014d365be5f7421102e
SHA256

39ae83af1cd715dadb50a266b91587dab04fffa94d2aa923c03cff634265f9ec
SHA512

f0de08e29e99b0873c8322e417004163aef004c544e8af36d00951e498492f6e7bb396ac5ef414b1f6cfa1169e4c3525a77f22df3dca0b9cd854bf847235d624

Score

10^/10

hawkeye_reborn keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.1

Credentials

Protocol: smtp
Host:
mail.eagleeyeapparels.com
Port:
587
Username:
[email protected]
Password:
eagle*qaz

Mutex

f98d37f4-ca90-4ed7-9f6f-6121c4014605

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:eagle*qaz _EmailPort:587 _EmailSSL:true _EmailServer:mail.eagleeyeapparels.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:f98d37f4-ca90-4ed7-9f6f-6121c4014605 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.1 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.1, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 bot.whatismyipaddress.com

flow	ioc
4	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 6 IoCs

Processes:

BID (ITB).exeBID (ITB).exeBID (ITB).exeBID (ITB).exeBID (ITB).exeBID (ITB).exe

description	pid	process	target process
PID 1988 set thread context of 828	1988	BID (ITB).exe	BID (ITB).exe
PID 816 set thread context of 1528	816	BID (ITB).exe	BID (ITB).exe
PID 1392 set thread context of 1272	1392	BID (ITB).exe	BID (ITB).exe
PID 1088 set thread context of 936	1088	BID (ITB).exe	BID (ITB).exe
PID 1380 set thread context of 2036	1380	BID (ITB).exe	BID (ITB).exe
PID 1624 set thread context of 1664	1624	BID (ITB).exe	BID (ITB).exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

BID (ITB).exeBID (ITB).exeBID (ITB).exeBID (ITB).exe

pid	process
1988	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
2000	BID (ITB).exe
816	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe
608	BID (ITB).exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

BID (ITB).exeBID (ITB).exeBID (ITB).exeBID (ITB).exeBID (ITB).exeBID (ITB).exe

pid process

1988 BID (ITB).exe
816 BID (ITB).exe
1392 BID (ITB).exe
1088 BID (ITB).exe
1380 BID (ITB).exe
1624 BID (ITB).exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

BID (ITB).exeBID (ITB).exeBID (ITB).exeBID (ITB).exeBID (ITB).exeBID (ITB).exeBID (ITB).exeBID (ITB).exeBID (ITB).exeBID (ITB).exeBID (ITB).exe

description	pid	process	target process
PID 1988 wrote to memory of 828	1988	BID (ITB).exe	BID (ITB).exe
PID 1988 wrote to memory of 828	1988	BID (ITB).exe	BID (ITB).exe
PID 1988 wrote to memory of 828	1988	BID (ITB).exe	BID (ITB).exe
PID 1988 wrote to memory of 828	1988	BID (ITB).exe	BID (ITB).exe
PID 1988 wrote to memory of 2000	1988	BID (ITB).exe	BID (ITB).exe
PID 1988 wrote to memory of 2000	1988	BID (ITB).exe	BID (ITB).exe
PID 1988 wrote to memory of 2000	1988	BID (ITB).exe	BID (ITB).exe
PID 1988 wrote to memory of 2000	1988	BID (ITB).exe	BID (ITB).exe
PID 2000 wrote to memory of 816	2000	BID (ITB).exe	BID (ITB).exe
PID 2000 wrote to memory of 816	2000	BID (ITB).exe	BID (ITB).exe
PID 2000 wrote to memory of 816	2000	BID (ITB).exe	BID (ITB).exe
PID 2000 wrote to memory of 816	2000	BID (ITB).exe	BID (ITB).exe
PID 816 wrote to memory of 1528	816	BID (ITB).exe	BID (ITB).exe
PID 816 wrote to memory of 1528	816	BID (ITB).exe	BID (ITB).exe
PID 816 wrote to memory of 1528	816	BID (ITB).exe	BID (ITB).exe
PID 816 wrote to memory of 1528	816	BID (ITB).exe	BID (ITB).exe
PID 816 wrote to memory of 608	816	BID (ITB).exe	BID (ITB).exe
PID 816 wrote to memory of 608	816	BID (ITB).exe	BID (ITB).exe
PID 816 wrote to memory of 608	816	BID (ITB).exe	BID (ITB).exe
PID 816 wrote to memory of 608	816	BID (ITB).exe	BID (ITB).exe
PID 608 wrote to memory of 1392	608	BID (ITB).exe	BID (ITB).exe
PID 608 wrote to memory of 1392	608	BID (ITB).exe	BID (ITB).exe
PID 608 wrote to memory of 1392	608	BID (ITB).exe	BID (ITB).exe
PID 608 wrote to memory of 1392	608	BID (ITB).exe	BID (ITB).exe
PID 1392 wrote to memory of 1272	1392	BID (ITB).exe	BID (ITB).exe
PID 1392 wrote to memory of 1272	1392	BID (ITB).exe	BID (ITB).exe
PID 1392 wrote to memory of 1272	1392	BID (ITB).exe	BID (ITB).exe
PID 1392 wrote to memory of 1272	1392	BID (ITB).exe	BID (ITB).exe
PID 1392 wrote to memory of 956	1392	BID (ITB).exe	BID (ITB).exe
PID 1392 wrote to memory of 956	1392	BID (ITB).exe	BID (ITB).exe
PID 1392 wrote to memory of 956	1392	BID (ITB).exe	BID (ITB).exe
PID 1392 wrote to memory of 956	1392	BID (ITB).exe	BID (ITB).exe
PID 956 wrote to memory of 1088	956	BID (ITB).exe	BID (ITB).exe
PID 956 wrote to memory of 1088	956	BID (ITB).exe	BID (ITB).exe
PID 956 wrote to memory of 1088	956	BID (ITB).exe	BID (ITB).exe
PID 956 wrote to memory of 1088	956	BID (ITB).exe	BID (ITB).exe
PID 1088 wrote to memory of 936	1088	BID (ITB).exe	BID (ITB).exe
PID 1088 wrote to memory of 936	1088	BID (ITB).exe	BID (ITB).exe
PID 1088 wrote to memory of 936	1088	BID (ITB).exe	BID (ITB).exe
PID 1088 wrote to memory of 936	1088	BID (ITB).exe	BID (ITB).exe
PID 1088 wrote to memory of 1540	1088	BID (ITB).exe	BID (ITB).exe
PID 1088 wrote to memory of 1540	1088	BID (ITB).exe	BID (ITB).exe
PID 1088 wrote to memory of 1540	1088	BID (ITB).exe	BID (ITB).exe
PID 1088 wrote to memory of 1540	1088	BID (ITB).exe	BID (ITB).exe
PID 1540 wrote to memory of 1380	1540	BID (ITB).exe	BID (ITB).exe
PID 1540 wrote to memory of 1380	1540	BID (ITB).exe	BID (ITB).exe
PID 1540 wrote to memory of 1380	1540	BID (ITB).exe	BID (ITB).exe
PID 1540 wrote to memory of 1380	1540	BID (ITB).exe	BID (ITB).exe
PID 1380 wrote to memory of 2036	1380	BID (ITB).exe	BID (ITB).exe
PID 1380 wrote to memory of 2036	1380	BID (ITB).exe	BID (ITB).exe
PID 1380 wrote to memory of 2036	1380	BID (ITB).exe	BID (ITB).exe
PID 1380 wrote to memory of 2036	1380	BID (ITB).exe	BID (ITB).exe
PID 1380 wrote to memory of 1524	1380	BID (ITB).exe	BID (ITB).exe
PID 1380 wrote to memory of 1524	1380	BID (ITB).exe	BID (ITB).exe
PID 1380 wrote to memory of 1524	1380	BID (ITB).exe	BID (ITB).exe
PID 1380 wrote to memory of 1524	1380	BID (ITB).exe	BID (ITB).exe
PID 1524 wrote to memory of 1624	1524	BID (ITB).exe	BID (ITB).exe
PID 1524 wrote to memory of 1624	1524	BID (ITB).exe	BID (ITB).exe
PID 1524 wrote to memory of 1624	1524	BID (ITB).exe	BID (ITB).exe
PID 1524 wrote to memory of 1624	1524	BID (ITB).exe	BID (ITB).exe
PID 1624 wrote to memory of 1664	1624	BID (ITB).exe	BID (ITB).exe
PID 1624 wrote to memory of 1664	1624	BID (ITB).exe	BID (ITB).exe
PID 1624 wrote to memory of 1664	1624	BID (ITB).exe	BID (ITB).exe
PID 1624 wrote to memory of 1664	1624	BID (ITB).exe	BID (ITB).exe

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1988

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
2⤵
PID:828

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe" 2 828 7121024
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:816

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe" 2 1528 7153503
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:608

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1392

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
1⤵
PID:1528

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
1⤵
PID:1272

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe" 2 1272 7172114
1⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1088

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
1⤵
PID:936

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe" 2 936 7190756
1⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1380

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
3⤵
PID:2036

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe" 2 2036 7209399
3⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1624

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe" 2 1664 7228056
1⤵
PID:1956

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
2⤵
PID:1548

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
1⤵
PID:1664

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe" 2 952 7246652
1⤵
PID:1692

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
2⤵
PID:1512

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe" 2 296 7265153
3⤵
PID:940

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
3⤵
PID:296

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
1⤵
PID:952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/296-166-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download
memory/296-151-0x0000000001DD0000-0x0000000001E60000-memory.dmp

Filesize
576KB

Download
memory/296-148-0x000000000052B720-mapping.dmp

Download
memory/608-71-0x0000000000000000-mapping.dmp

Download
memory/816-66-0x0000000000000000-mapping.dmp

Download
memory/828-57-0x000000000052B720-mapping.dmp

Download
memory/828-61-0x0000000001E30000-0x0000000001EC0000-memory.dmp

Filesize
576KB

Download
memory/828-59-0x0000000001E30000-0x0000000001EC0000-memory.dmp

Filesize
576KB

Download
memory/828-65-0x0000000074090000-0x000000007463B000-memory.dmp

Filesize
5.7MB

Download
memory/936-99-0x0000000001DE0000-0x0000000001E70000-memory.dmp

Filesize
576KB

Download
memory/936-104-0x0000000074040000-0x00000000745EB000-memory.dmp

Filesize
5.7MB

Download
memory/936-96-0x000000000052B720-mapping.dmp

Download
memory/940-149-0x0000000000000000-mapping.dmp

Download
memory/952-139-0x0000000001E90000-0x0000000001F20000-memory.dmp

Filesize
576KB

Download
memory/952-143-0x0000000074040000-0x00000000745EB000-memory.dmp

Filesize
5.7MB

Download
memory/952-135-0x000000000052B720-mapping.dmp

Download
memory/956-84-0x0000000000000000-mapping.dmp

Download
memory/1088-92-0x0000000000000000-mapping.dmp

Download
memory/1272-86-0x0000000000530000-0x00000000005C0000-memory.dmp

Filesize
576KB

Download
memory/1272-91-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download
memory/1272-83-0x000000000052B720-mapping.dmp

Download
memory/1272-85-0x0000000000530000-0x00000000005C0000-memory.dmp

Filesize
576KB

Download
memory/1380-105-0x0000000000000000-mapping.dmp

Download
memory/1392-79-0x0000000000000000-mapping.dmp

Download
memory/1512-144-0x0000000000000000-mapping.dmp

Download
memory/1524-110-0x0000000000000000-mapping.dmp

Download
memory/1528-72-0x0000000000530000-0x00000000005C0000-memory.dmp

Filesize
576KB

Download
memory/1528-78-0x0000000074040000-0x00000000745EB000-memory.dmp

Filesize
5.7MB

Download
memory/1528-73-0x0000000000530000-0x00000000005C0000-memory.dmp

Filesize
576KB

Download
memory/1528-70-0x000000000052B720-mapping.dmp

Download
memory/1540-97-0x0000000000000000-mapping.dmp

Download
memory/1548-131-0x0000000000000000-mapping.dmp

Download
memory/1624-118-0x0000000000000000-mapping.dmp

Download
memory/1664-125-0x0000000001F30000-0x0000000001FC0000-memory.dmp

Filesize
576KB

Download
memory/1664-122-0x000000000052B720-mapping.dmp

Download
memory/1664-124-0x0000000001F30000-0x0000000001FC0000-memory.dmp

Filesize
576KB

Download
memory/1664-130-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/1692-136-0x0000000000000000-mapping.dmp

Download
memory/1956-123-0x0000000000000000-mapping.dmp

Download
memory/1988-54-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1988-56-0x0000000001FF0000-0x0000000002001000-memory.dmp

Filesize
68KB

Download
memory/2000-58-0x0000000000000000-mapping.dmp

Download
memory/2036-117-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download
memory/2036-109-0x000000000052B720-mapping.dmp

Download
memory/2036-112-0x00000000007A0000-0x0000000000830000-memory.dmp

Filesize
576KB

Download