hawkeye_reborn | 5605dc33794314d872d1761749149d2c72a60be8f40fdc2153dacfdb908c0686

General

Target

(ITBD)..exe
Size

638KB
MD5

61b91b3bb375436570df81e5d981e823
SHA1

9c4124467c4308afe1b79782f447ffc7d40cb50b
SHA256

3c0f1342da1381efcb02db88a6f0c2c5da6006288915b146684e5de5e4bd7a8b
SHA512

54f5e78631bcf5cb747889bb9044a8745e590aade7123526d50c6a591204442c1c282bfa51ef62fc0dc22aaf71c2719b8cc38f9505d5b9bfba7282922802aff9

Score

10^/10

hawkeye_reborn keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.1

Credentials

Protocol: smtp
Host:
mail.eagleeyeapparels.com
Port:
587
Username:
[email protected]
Password:
eagle*qaz

Mutex

f98d37f4-ca90-4ed7-9f6f-6121c4014605

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:eagle*qaz _EmailPort:587 _EmailSSL:true _EmailServer:mail.eagleeyeapparels.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:f98d37f4-ca90-4ed7-9f6f-6121c4014605 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.1 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.1, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
32	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2068 set thread context of 4184	2068	(ITBD)..exe	90

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2068	(ITBD)..exe
2068	(ITBD)..exe
2068	(ITBD)..exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	(ITBD)..exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 4376	2068	(ITBD)..exe	89
PID 2068 wrote to memory of 4376	2068	(ITBD)..exe	89
PID 2068 wrote to memory of 4376	2068	(ITBD)..exe	89
PID 2068 wrote to memory of 4184	2068	(ITBD)..exe	90
PID 2068 wrote to memory of 4184	2068	(ITBD)..exe	90
PID 2068 wrote to memory of 4184	2068	(ITBD)..exe	90
PID 2068 wrote to memory of 4184	2068	(ITBD)..exe	90
PID 2068 wrote to memory of 4184	2068	(ITBD)..exe	90
PID 2068 wrote to memory of 4184	2068	(ITBD)..exe	90
PID 2068 wrote to memory of 4184	2068	(ITBD)..exe	90
PID 2068 wrote to memory of 4184	2068	(ITBD)..exe	90

C:\Users\Admin\AppData\Local\Temp\(ITBD)..exe
"C:\Users\Admin\AppData\Local\Temp\(ITBD)..exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Local\Temp\(ITBD)..exe
  "{path}"
  2⤵
  PID:4376
- C:\Users\Admin\AppData\Local\Temp\(ITBD)..exe
  "{path}"
  2⤵
  PID:4184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\(ITBD)..exe.log

Filesize
496B

MD5
cb76b18ebed3a9f05a14aed43d35fba6

SHA1
836a4b4e351846fca08b84149cb734cb59b8c0d6

SHA256
8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

SHA512
7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

Download Submit
memory/2068-130-0x00000000747B0000-0x0000000074D61000-memory.dmp

Filesize
5.7MB

Download
memory/4184-133-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4184-134-0x00000000747B0000-0x0000000074D61000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing