hawkeye_reborn | 5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a

General

Target

5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe
Size

632KB
MD5

4303f3fcacaf8b8c4c7a78691c6c9fa4
SHA1

c162f8882a9f2764df4589498b22919820d5764b
SHA256

5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a
SHA512

ce6e06cebc3bc8efc64fde7a7d496e3499a06b0fb2b46db2d194b28650963152b5d6e6b2ac99393d31ef53f40da943917545269cccb7cfef8c9a59f744e69dbe

Score

10^/10

hawkeye_reborn keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

Protocol: smtp
Host:
mail.novaa-ship.com
Port:
587
Username:
[email protected]
Password:
_i8Rk0dPBcrh1(b6k]

Mutex

e1954f76-8351-490e-88cc-4bbf50796b54

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:_i8Rk0dPBcrh1(b6k] _EmailPort:587 _EmailSSL:true _EmailServer:mail.novaa-ship.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:20 _MeltFile:false _Mutex:e1954f76-8351-490e-88cc-4bbf50796b54 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:true _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/1452-57-0x0000000004F40000-0x0000000004FDA000-memory.dmp	disable_win_def

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/1980-77-0x00000000041C0000-0x0000000004236000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/1980-77-0x00000000041C0000-0x0000000004236000-memory.dmp	WebBrowserPassView

Nirsoft 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1980-77-0x00000000041C0000-0x0000000004236000-memory.dmp	Nirsoft

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 bot.whatismyipaddress.com

flow	ioc
5	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe

description	pid	process	target process
PID 1452 set thread context of 1980	1452	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1804 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1980 RegSvcs.exe

pid	process
1804	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1980	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe

description	pid	process	target process
PID 1452 wrote to memory of 1804	1452	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	schtasks.exe
PID 1452 wrote to memory of 1804	1452	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	schtasks.exe
PID 1452 wrote to memory of 1804	1452	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	schtasks.exe
PID 1452 wrote to memory of 1804	1452	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	schtasks.exe
PID 1452 wrote to memory of 1980	1452	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe
PID 1452 wrote to memory of 1980	1452	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe
PID 1452 wrote to memory of 1980	1452	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe
PID 1452 wrote to memory of 1980	1452	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe
PID 1452 wrote to memory of 1980	1452	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe
PID 1452 wrote to memory of 1980	1452	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe
PID 1452 wrote to memory of 1980	1452	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe
PID 1452 wrote to memory of 1980	1452	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe
PID 1452 wrote to memory of 1980	1452	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe
PID 1452 wrote to memory of 1980	1452	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe
PID 1452 wrote to memory of 1980	1452	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe
PID 1452 wrote to memory of 1980	1452	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe
"C:\Users\Admin\AppData\Local\Temp\5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IuhfqGPHnsTDsu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBE32.tmp"
2⤵
- Creates scheduled task(s)
PID:1804

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpBE32.tmp

Filesize
1KB

MD5
93307ec9ed326185bca75140c5b1957c

SHA1
c76144ccbf6eaf7941231dec18ba2689eda7901f

SHA256
67c6666fac0f908e9818fecc75daa294549958ee279b0496a4d8b056fedd5042

SHA512
3d998fc8b29dd83792f931fb752ed72a2a7072dc73e0948b20400476e0ed8ae9ba058500837b0a48f77b1289b447b644b365eeb6836f30343cd5c9ef7cffcfd1

Download Submit
memory/1452-54-0x0000000000CC0000-0x0000000000D64000-memory.dmp

Filesize
656KB

Download
memory/1452-55-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/1452-56-0x0000000000430000-0x0000000000438000-memory.dmp

Filesize
32KB

Download
memory/1452-57-0x0000000004F40000-0x0000000004FDA000-memory.dmp

Filesize
616KB

Download
memory/1452-60-0x0000000000700000-0x000000000070A000-memory.dmp

Filesize
40KB

Download
memory/1804-58-0x0000000000000000-mapping.dmp

Download
memory/1980-62-0x0000000000090000-0x0000000000120000-memory.dmp

Filesize
576KB

Download
memory/1980-61-0x0000000000090000-0x0000000000120000-memory.dmp

Filesize
576KB

Download
memory/1980-64-0x0000000000090000-0x0000000000120000-memory.dmp

Filesize
576KB

Download
memory/1980-65-0x0000000000090000-0x0000000000120000-memory.dmp

Filesize
576KB

Download
memory/1980-67-0x000000000048B2BE-mapping.dmp

Download
memory/1980-68-0x0000000000090000-0x0000000000120000-memory.dmp

Filesize
576KB

Download
memory/1980-69-0x0000000000090000-0x0000000000120000-memory.dmp

Filesize
576KB

Download
memory/1980-73-0x0000000000090000-0x0000000000120000-memory.dmp

Filesize
576KB

Download
memory/1980-76-0x0000000000090000-0x0000000000120000-memory.dmp

Filesize
576KB

Download
memory/1980-77-0x00000000041C0000-0x0000000004236000-memory.dmp

Filesize
472KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads