hawkeye_reborn | efbca40ddc7442c3e794ec5fb4f1968e9d1b432f4a37ba8da7831ec89f03da56

Analysis

max time kernel
150s
max time network
43s
platform
windows7_x64
resource
win7-20220414-en
submitted
21-05-2022 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Catalogue-Order-202105.exe
Size

789KB
MD5

569522488836413ac64590314af81450
SHA1

0830f265c39c1f32bc0c8931324d04e97ea2773d
SHA256

5df1a3e64559a1056fd1cac70e1b6bbf236eca17c1c3a5e59f1c329710b42dbb
SHA512

c7da8b825b7dfbb8a3408bb63e97634a3d1c6a45c3770fd823a61c66a2af2eea936fd8ed7852ab6dbcac79dd0a106edb19dc50b6398cd9d312fdb7d4d2c2e768

Score

10^/10

hawkeye_reborn collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

Protocol: ftp
Host:
ftp.anuarul-sanatatii.ro
Port:
21
Username:
[email protected]
Password:
I&Z$wYX(9-?n

Mutex

0dc1ff33-2835-4785-b633-6d96c314767d

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:false _Delivery:2 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPort:0 _EmailSSL:false _ExecutionDelay:10 _FTPPassword:I&Z$wYX(9-?n _FTPPort:21 _FTPSFTP:true _FTPServer:ftp.anuarul-sanatatii.ro _FTPUsername:[email protected] _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:57000 _MeltFile:false _Mutex:0dc1ff33-2835-4785-b633-6d96c314767d _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1508-96-0x000000000041211A-mapping.dmp	MailPassView
behavioral1/memory/1508-95-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral1/memory/1508-99-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral1/memory/1508-100-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/836-80-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral1/memory/836-81-0x0000000000444D30-mapping.dmp	WebBrowserPassView
behavioral1/memory/836-84-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral1/memory/836-85-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView

Nirsoft 8 IoCs

resource	yara_rule
behavioral1/memory/836-80-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral1/memory/836-81-0x0000000000444D30-mapping.dmp	Nirsoft
behavioral1/memory/836-84-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral1/memory/836-85-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral1/memory/1508-96-0x000000000041211A-mapping.dmp	Nirsoft
behavioral1/memory/1508-95-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/1508-99-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/1508-100-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 948 set thread context of 2000	948	Catalogue-Order-202105.exe	28
PID 2000 set thread context of 836	2000	Catalogue-Order-202105.exe	30
PID 2000 set thread context of 1508	2000	Catalogue-Order-202105.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
840	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
836	vbc.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 840	948	Catalogue-Order-202105.exe	26
PID 948 wrote to memory of 840	948	Catalogue-Order-202105.exe	26
PID 948 wrote to memory of 840	948	Catalogue-Order-202105.exe	26
PID 948 wrote to memory of 840	948	Catalogue-Order-202105.exe	26
PID 948 wrote to memory of 2000	948	Catalogue-Order-202105.exe	28
PID 948 wrote to memory of 2000	948	Catalogue-Order-202105.exe	28
PID 948 wrote to memory of 2000	948	Catalogue-Order-202105.exe	28
PID 948 wrote to memory of 2000	948	Catalogue-Order-202105.exe	28
PID 948 wrote to memory of 2000	948	Catalogue-Order-202105.exe	28
PID 948 wrote to memory of 2000	948	Catalogue-Order-202105.exe	28
PID 948 wrote to memory of 2000	948	Catalogue-Order-202105.exe	28
PID 948 wrote to memory of 2000	948	Catalogue-Order-202105.exe	28
PID 948 wrote to memory of 2000	948	Catalogue-Order-202105.exe	28
PID 2000 wrote to memory of 836	2000	Catalogue-Order-202105.exe	30
PID 2000 wrote to memory of 836	2000	Catalogue-Order-202105.exe	30
PID 2000 wrote to memory of 836	2000	Catalogue-Order-202105.exe	30
PID 2000 wrote to memory of 836	2000	Catalogue-Order-202105.exe	30
PID 2000 wrote to memory of 836	2000	Catalogue-Order-202105.exe	30
PID 2000 wrote to memory of 836	2000	Catalogue-Order-202105.exe	30
PID 2000 wrote to memory of 836	2000	Catalogue-Order-202105.exe	30
PID 2000 wrote to memory of 836	2000	Catalogue-Order-202105.exe	30
PID 2000 wrote to memory of 836	2000	Catalogue-Order-202105.exe	30
PID 2000 wrote to memory of 836	2000	Catalogue-Order-202105.exe	30
PID 2000 wrote to memory of 1508	2000	Catalogue-Order-202105.exe	32
PID 2000 wrote to memory of 1508	2000	Catalogue-Order-202105.exe	32
PID 2000 wrote to memory of 1508	2000	Catalogue-Order-202105.exe	32
PID 2000 wrote to memory of 1508	2000	Catalogue-Order-202105.exe	32
PID 2000 wrote to memory of 1508	2000	Catalogue-Order-202105.exe	32
PID 2000 wrote to memory of 1508	2000	Catalogue-Order-202105.exe	32
PID 2000 wrote to memory of 1508	2000	Catalogue-Order-202105.exe	32
PID 2000 wrote to memory of 1508	2000	Catalogue-Order-202105.exe	32
PID 2000 wrote to memory of 1508	2000	Catalogue-Order-202105.exe	32
PID 2000 wrote to memory of 1508	2000	Catalogue-Order-202105.exe	32

C:\Users\Admin\AppData\Local\Temp\Catalogue-Order-202105.exe
"C:\Users\Admin\AppData\Local\Temp\Catalogue-Order-202105.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jivhQDWsyfrHHU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7994.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:840
- C:\Users\Admin\AppData\Local\Temp\Catalogue-Order-202105.exe
  "{path}"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpBB54.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:836
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp6089.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7994.tmp

Filesize
1KB

MD5
0df07907468e193dd82b03c802787b29

SHA1
e0ea4d20a2d479f13b0f1303c228b488d383077d

SHA256
f8475cc8b9370d02d59a3312e85a650d1297750e44b73e18922d50ade1238700

SHA512
37e6b14c3230de587d976087feb4895ada6c66132fdbd1046090018e2992ac67979ee77e53ab2279c37a21a56839a0824b161ac48d58864d7691eaa0c1e51894

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBB54.tmp

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/836-85-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/836-72-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/836-84-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/836-80-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/836-78-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/836-76-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/836-74-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/836-71-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/948-54-0x0000000074F21000-0x0000000074F23000-memory.dmp

Filesize
8KB

Download
memory/948-55-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1508-88-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1508-93-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1508-100-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1508-99-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1508-95-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1508-92-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1508-90-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1508-87-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2000-59-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2000-58-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2000-61-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2000-62-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2000-70-0x0000000073CE0000-0x000000007428B000-memory.dmp

Filesize
5.7MB

Download
memory/2000-63-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2000-66-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2000-68-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download