hawkeye_reborn | 5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a

General

Target

5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe
Size

632KB
MD5

4303f3fcacaf8b8c4c7a78691c6c9fa4
SHA1

c162f8882a9f2764df4589498b22919820d5764b
SHA256

5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a
SHA512

ce6e06cebc3bc8efc64fde7a7d496e3499a06b0fb2b46db2d194b28650963152b5d6e6b2ac99393d31ef53f40da943917545269cccb7cfef8c9a59f744e69dbe

Score

10^/10

hawkeye_reborn keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

Protocol: smtp
Host:
mail.novaa-ship.com
Port:
587
Username:
[email protected]
Password:
_i8Rk0dPBcrh1(b6k]

Mutex

e1954f76-8351-490e-88cc-4bbf50796b54

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:_i8Rk0dPBcrh1(b6k] _EmailPort:587 _EmailSSL:true _EmailServer:mail.novaa-ship.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:20 _MeltFile:false _Mutex:e1954f76-8351-490e-88cc-4bbf50796b54 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:true _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

41 bot.whatismyipaddress.com

flow	ioc
41	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe

description	pid	process	target process
PID 3988 set thread context of 2836	3988	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4152 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2836 RegSvcs.exe

pid	process
4152	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	2836	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe

description	pid	process	target process
PID 3988 wrote to memory of 4152	3988	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	schtasks.exe
PID 3988 wrote to memory of 4152	3988	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	schtasks.exe
PID 3988 wrote to memory of 4152	3988	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	schtasks.exe
PID 3988 wrote to memory of 2836	3988	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe
PID 3988 wrote to memory of 2836	3988	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe
PID 3988 wrote to memory of 2836	3988	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe
PID 3988 wrote to memory of 2836	3988	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe
PID 3988 wrote to memory of 2836	3988	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe
PID 3988 wrote to memory of 2836	3988	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe
PID 3988 wrote to memory of 2836	3988	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe
PID 3988 wrote to memory of 2836	3988	5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe
"C:\Users\Admin\AppData\Local\Temp\5ff66e9d2704804bb33690a6518c6a998bf76b786d382595d24d8433857e555a.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3988

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IuhfqGPHnsTDsu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp470B.tmp"
2⤵
- Creates scheduled task(s)
PID:4152

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp470B.tmp

Filesize
1KB

MD5
288cd0e75064bff0e88e339cccdee498

SHA1
339b2404686ad575d8912eea319ec19720909bb0

SHA256
cd11e19e51344424a829e29e93d4937772cab1ae3622e38cfb7e4b5bc1c070d0

SHA512
fc462c8951488616772c231f1a78e68ea69f8e80571b4793067417f7c1f3ed7a586db8190b25e6698f014676f73043a544fed0b9b27f36994c92f73535747514

Download Submit
memory/2836-138-0x0000000000000000-mapping.dmp

Download
memory/2836-139-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/3988-130-0x00000000006E0000-0x0000000000784000-memory.dmp

Filesize
656KB

Download
memory/3988-131-0x00000000057A0000-0x0000000005D44000-memory.dmp

Filesize
5.6MB

Download
memory/3988-132-0x0000000005120000-0x00000000051B2000-memory.dmp

Filesize
584KB

Download
memory/3988-133-0x00000000052E0000-0x00000000052EA000-memory.dmp

Filesize
40KB

Download
memory/3988-134-0x0000000005450000-0x00000000054EC000-memory.dmp

Filesize
624KB

Download
memory/3988-135-0x0000000007D00000-0x0000000007D66000-memory.dmp

Filesize
408KB

Download
memory/4152-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads