hawkeye_reborn | efbca40ddc7442c3e794ec5fb4f1968e9d1b432f4a37ba8da7831ec89f03da56

General

Target

Catalogue-Order-202105.exe
Size

789KB
MD5

569522488836413ac64590314af81450
SHA1

0830f265c39c1f32bc0c8931324d04e97ea2773d
SHA256

5df1a3e64559a1056fd1cac70e1b6bbf236eca17c1c3a5e59f1c329710b42dbb
SHA512

c7da8b825b7dfbb8a3408bb63e97634a3d1c6a45c3770fd823a61c66a2af2eea936fd8ed7852ab6dbcac79dd0a106edb19dc50b6398cd9d312fdb7d4d2c2e768

Score

10^/10

hawkeye_reborn collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

Protocol: ftp
Host:
ftp.anuarul-sanatatii.ro
Port:
21
Username:
[email protected]
Password:
I&Z$wYX(9-?n

Mutex

0dc1ff33-2835-4785-b633-6d96c314767d

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:false _Delivery:2 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPort:0 _EmailSSL:false _ExecutionDelay:10 _FTPPassword:I&Z$wYX(9-?n _FTPPort:21 _FTPSFTP:true _FTPServer:ftp.anuarul-sanatatii.ro _FTPUsername:[email protected] _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:57000 _MeltFile:false _Mutex:0dc1ff33-2835-4785-b633-6d96c314767d _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/4612-144-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4612-146-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4612-147-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/3924-138-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/3924-140-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/3924-141-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3924-138-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/3924-140-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/3924-141-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/4612-144-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4612-146-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4612-147-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Catalogue-Order-202105.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	Catalogue-Order-202105.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

36 bot.whatismyipaddress.com

flow	ioc
36	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

Catalogue-Order-202105.exeCatalogue-Order-202105.exe

description	pid	process	target process
PID 3124 set thread context of 4696	3124	Catalogue-Order-202105.exe	Catalogue-Order-202105.exe
PID 4696 set thread context of 3924	4696	Catalogue-Order-202105.exe	vbc.exe
PID 4696 set thread context of 4612	4696	Catalogue-Order-202105.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3176 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

vbc.exe

pid process

3924 vbc.exe
3924 vbc.exe
3924 vbc.exe
3924 vbc.exe

pid	process
3176	schtasks.exe

pid	process
3924	vbc.exe
3924	vbc.exe
3924	vbc.exe
3924	vbc.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

Catalogue-Order-202105.exeCatalogue-Order-202105.exe

description	pid	process	target process
PID 3124 wrote to memory of 3176	3124	Catalogue-Order-202105.exe	schtasks.exe
PID 3124 wrote to memory of 3176	3124	Catalogue-Order-202105.exe	schtasks.exe
PID 3124 wrote to memory of 3176	3124	Catalogue-Order-202105.exe	schtasks.exe
PID 3124 wrote to memory of 4696	3124	Catalogue-Order-202105.exe	Catalogue-Order-202105.exe
PID 3124 wrote to memory of 4696	3124	Catalogue-Order-202105.exe	Catalogue-Order-202105.exe
PID 3124 wrote to memory of 4696	3124	Catalogue-Order-202105.exe	Catalogue-Order-202105.exe
PID 3124 wrote to memory of 4696	3124	Catalogue-Order-202105.exe	Catalogue-Order-202105.exe
PID 3124 wrote to memory of 4696	3124	Catalogue-Order-202105.exe	Catalogue-Order-202105.exe
PID 3124 wrote to memory of 4696	3124	Catalogue-Order-202105.exe	Catalogue-Order-202105.exe
PID 3124 wrote to memory of 4696	3124	Catalogue-Order-202105.exe	Catalogue-Order-202105.exe
PID 3124 wrote to memory of 4696	3124	Catalogue-Order-202105.exe	Catalogue-Order-202105.exe
PID 4696 wrote to memory of 3924	4696	Catalogue-Order-202105.exe	vbc.exe
PID 4696 wrote to memory of 3924	4696	Catalogue-Order-202105.exe	vbc.exe
PID 4696 wrote to memory of 3924	4696	Catalogue-Order-202105.exe	vbc.exe
PID 4696 wrote to memory of 3924	4696	Catalogue-Order-202105.exe	vbc.exe
PID 4696 wrote to memory of 3924	4696	Catalogue-Order-202105.exe	vbc.exe
PID 4696 wrote to memory of 3924	4696	Catalogue-Order-202105.exe	vbc.exe
PID 4696 wrote to memory of 3924	4696	Catalogue-Order-202105.exe	vbc.exe
PID 4696 wrote to memory of 3924	4696	Catalogue-Order-202105.exe	vbc.exe
PID 4696 wrote to memory of 3924	4696	Catalogue-Order-202105.exe	vbc.exe
PID 4696 wrote to memory of 4612	4696	Catalogue-Order-202105.exe	vbc.exe
PID 4696 wrote to memory of 4612	4696	Catalogue-Order-202105.exe	vbc.exe
PID 4696 wrote to memory of 4612	4696	Catalogue-Order-202105.exe	vbc.exe
PID 4696 wrote to memory of 4612	4696	Catalogue-Order-202105.exe	vbc.exe
PID 4696 wrote to memory of 4612	4696	Catalogue-Order-202105.exe	vbc.exe
PID 4696 wrote to memory of 4612	4696	Catalogue-Order-202105.exe	vbc.exe
PID 4696 wrote to memory of 4612	4696	Catalogue-Order-202105.exe	vbc.exe
PID 4696 wrote to memory of 4612	4696	Catalogue-Order-202105.exe	vbc.exe
PID 4696 wrote to memory of 4612	4696	Catalogue-Order-202105.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\Catalogue-Order-202105.exe
"C:\Users\Admin\AppData\Local\Temp\Catalogue-Order-202105.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jivhQDWsyfrHHU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp98DA.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3176
- C:\Users\Admin\AppData\Local\Temp\Catalogue-Order-202105.exe
  "{path}"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpC931.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3924
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpD18E.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:4612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Catalogue-Order-202105.exe.log

Filesize
496B

MD5
cb76b18ebed3a9f05a14aed43d35fba6

SHA1
836a4b4e351846fca08b84149cb734cb59b8c0d6

SHA256
8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

SHA512
7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp98DA.tmp

Filesize
1KB

MD5
cc211dc74f2946b6af39c3c51ef3eea0

SHA1
6cba432c0f967a12f61825c155307ab413be5388

SHA256
90c750cd0c057cf7016c0088ecdb3687e7c03c4a5e84637ac9537d5b5029ae10

SHA512
e9e975175235dcd229bb29715179e38be6f8ba0df6ebc3b54bed44dcd7cdb90154874c358873de1dd56925884b96f29b00a3ad99ce9fd6be05d53bcf028a6390

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC931.tmp

Filesize
4KB

MD5
bdf65f70610625cc771c5cc7ce168c7d

SHA1
a8829b1c071ed0521d11925a98468c12a53a03b8

SHA256
b66236dd86f140ca02db0c296e45032b272de2895c4f047a562e73bc8395dba5

SHA512
add2db50b0440b07ecc48a5fde7f0b72e84b76f11ea060944afa28ddd03791e6adb3bfca704254131fb3f591f484b37f7276fab96b0c4776a27cb526bcf5f3a4

Download Submit
memory/3124-130-0x0000000075330000-0x00000000758E1000-memory.dmp

Filesize
5.7MB

Download
memory/3176-131-0x0000000000000000-mapping.dmp

Download
memory/3924-140-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3924-141-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3924-137-0x0000000000000000-mapping.dmp

Download
memory/3924-138-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4612-143-0x0000000000000000-mapping.dmp

Download
memory/4612-144-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4612-146-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4612-147-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4696-136-0x0000000075330000-0x00000000758E1000-memory.dmp

Filesize
5.7MB

Download
memory/4696-134-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4696-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads