hawkeye_reborn | 59643cb09c6697e43bcb64c8ade22b23c0a95a5ef4106603ce2ead7551af4e20

Analysis

Target

BID (ITB).exe
Size

695KB
MD5

252e0a3b8da887d3da7ff844b1864be2
SHA1

614228df1144b4569adec014d365be5f7421102e
SHA256

39ae83af1cd715dadb50a266b91587dab04fffa94d2aa923c03cff634265f9ec
SHA512

f0de08e29e99b0873c8322e417004163aef004c544e8af36d00951e498492f6e7bb396ac5ef414b1f6cfa1169e4c3525a77f22df3dca0b9cd854bf847235d624

Score

10^/10

Family

hawkeye_reborn

Version

10.0.0.1

Credentials

Mutex

f98d37f4-ca90-4ed7-9f6f-6121c4014605

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:eagle*qaz _EmailPort:587 _EmailSSL:true _EmailServer:mail.eagleeyeapparels.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:f98d37f4-ca90-4ed7-9f6f-6121c4014605 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.1 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.1, Culture=neutral, PublicKeyToken=null

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2136 set thread context of 2692	2136	BID (ITB).exe	82

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2136	BID (ITB).exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2692	2136	BID (ITB).exe	82
PID 2136 wrote to memory of 2692	2136	BID (ITB).exe	82
PID 2136 wrote to memory of 2692	2136	BID (ITB).exe	82
PID 2136 wrote to memory of 3004	2136	BID (ITB).exe	83
PID 2136 wrote to memory of 3004	2136	BID (ITB).exe	83
PID 2136 wrote to memory of 3004	2136	BID (ITB).exe	83

C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
"C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
  "C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe"
  2⤵
  PID:2692
- C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe
  "C:\Users\Admin\AppData\Local\Temp\BID (ITB).exe" 2 2692 240599828
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3004

memory/2136-131-0x0000000003E70000-0x0000000003E81000-memory.dmp

Filesize
68KB

Download
memory/2692-136-0x0000000000B40000-0x0000000000BD0000-memory.dmp

Filesize
576KB

Download
memory/2692-137-0x0000000000B40000-0x0000000000BD0000-memory.dmp

Filesize
576KB

Download
memory/2692-138-0x0000000074CD0000-0x0000000075281000-memory.dmp

Filesize
5.7MB

Download