hawkeye_reborn | 3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae

Analysis

max time kernel
174s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
16-05-2022 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe
Size

711KB
MD5

c575b4cdb4334c3df3a53ef1306762f8
SHA1

5ee8a15f47e68312a302298eed84d70ba80047a4
SHA256

3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae
SHA512

caf86b2711b1e843be8c8e5dd8b74bf259facc95066df576998c851f02dd62af5397888a206e3a2e759764654e6679f22359addd45fa5cb70dd49e95f1254613

Score

10^/10

hawkeye_reborn collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.1

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
BIGgod1234

Mutex

ede6588b-3e3c-4759-a2b6-3c9f7078307d

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:BIGgod1234 _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:ede6588b-3e3c-4759-a2b6-3c9f7078307d _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:false _Version:10.0.0.1 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.1, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4976-143-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4976-145-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4976-146-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4244-137-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/4244-139-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/4244-140-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

resource	yara_rule
behavioral2/memory/4244-137-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/4244-139-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/4244-140-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/4976-143-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4976-145-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4976-146-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
36	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3024 set thread context of 4376	3024	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	84
PID 4376 set thread context of 4244	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	85
PID 4376 set thread context of 4976	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4244	vbc.exe
4244	vbc.exe
4244	vbc.exe
4244	vbc.exe
4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe
4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 4280	3024	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	83
PID 3024 wrote to memory of 4280	3024	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	83
PID 3024 wrote to memory of 4280	3024	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	83
PID 3024 wrote to memory of 4376	3024	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	84
PID 3024 wrote to memory of 4376	3024	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	84
PID 3024 wrote to memory of 4376	3024	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	84
PID 3024 wrote to memory of 4376	3024	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	84
PID 3024 wrote to memory of 4376	3024	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	84
PID 3024 wrote to memory of 4376	3024	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	84
PID 3024 wrote to memory of 4376	3024	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	84
PID 3024 wrote to memory of 4376	3024	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	84
PID 4376 wrote to memory of 4244	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	85
PID 4376 wrote to memory of 4244	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	85
PID 4376 wrote to memory of 4244	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	85
PID 4376 wrote to memory of 4244	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	85
PID 4376 wrote to memory of 4244	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	85
PID 4376 wrote to memory of 4244	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	85
PID 4376 wrote to memory of 4244	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	85
PID 4376 wrote to memory of 4244	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	85
PID 4376 wrote to memory of 4244	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	85
PID 4376 wrote to memory of 4976	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	86
PID 4376 wrote to memory of 4976	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	86
PID 4376 wrote to memory of 4976	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	86
PID 4376 wrote to memory of 4976	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	86
PID 4376 wrote to memory of 4976	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	86
PID 4376 wrote to memory of 4976	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	86
PID 4376 wrote to memory of 4976	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	86
PID 4376 wrote to memory of 4976	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	86
PID 4376 wrote to memory of 4976	4376	3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe	86

C:\Users\Admin\AppData\Local\Temp\3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe
"C:\Users\Admin\AppData\Local\Temp\3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VHPeqyzH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp22DA.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4280
- C:\Users\Admin\AppData\Local\Temp\3b75cbcad5615d88443317f9ccfb93a6292835db6e8a4e1f3a11bf5dc1e0eaae.exe
  "{path}"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp7271.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4244
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpB2B7.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:4976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp22DA.tmp

Filesize
1KB

MD5
dd2abfa9abeb6ad7307d5e710d944b2b

SHA1
082fef05f7a82b9fd8d9ae090d04fc47f3c9c216

SHA256
9b1431f55969ac4d6e2308ddceb116f47f944a862c10b9ec0157a4a5381d3d03

SHA512
67c125bc29a9c97889797705eac02e85bdf4f0b3027d8b6d18345f4bf5f09847722916d14f268c21489ce879492b33b51e69dd2eed09dd96d269d9228519ae27

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7271.tmp

Filesize
4KB

MD5
a44410c464bc23ac615f732de976447c

SHA1
e13bb8bfa077dd78dda795b3c21750f217ba4d36

SHA256
a1a6fab77bd9c6713b610b41cb025ba806b8fd64fb80b862e1c44ab2277545a6

SHA512
15e8af0f65161d9ffe068f10083bb2aebfa9be89a36ca6816853f05b58dd05ea46c5abd2f306a354b6ce9eeab20f26a900c6cf3233553bacf168dcbefb79e31a

Download Submit
memory/3024-130-0x0000000074A70000-0x0000000075021000-memory.dmp

Filesize
5.7MB

Download
memory/4244-140-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4244-137-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4244-139-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4376-134-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4376-135-0x0000000074A70000-0x0000000075021000-memory.dmp

Filesize
5.7MB

Download
memory/4976-143-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4976-145-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4976-146-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download