hawkeye_reborn | 26e69d5cea2a00f353bc26191b00fc79d6a697655d3096741a12f96b9a9e2955

General

Target

PO.exe
Size

722KB
MD5

903ca84d60f53ecf1902600beb652c55
SHA1

4e0d56e8b555a6882cfee2132fff4fa81a2c40cc
SHA256

c6043128c116aedacc1be9abbcb74898065374269665a5387960ce47e805c2c0
SHA512

6ac61af0eee49a3596b92e94a36b63f599803183264ba415220c71784d1db691a1170a8c63a0d2cb940559a50a320889a1d70301656aaa38475b7f3a67ab4be6

Score

10^/10

hawkeye_reborn keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.1

Credentials

Protocol: smtp
Host:
mail.eagleeyeapparels.com
Port:
587
Username:
[email protected]
Password:
eagle*qaz

Mutex

f98d37f4-ca90-4ed7-9f6f-6121c4014605

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:eagle*qaz _EmailPort:587 _EmailSSL:true _EmailServer:mail.eagleeyeapparels.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:f98d37f4-ca90-4ed7-9f6f-6121c4014605 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.1 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.1, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 892 set thread context of 1496	892	PO.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
892	PO.exe
892	PO.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	892	PO.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 2040	892	PO.exe	27
PID 892 wrote to memory of 2040	892	PO.exe	27
PID 892 wrote to memory of 2040	892	PO.exe	27
PID 892 wrote to memory of 2040	892	PO.exe	27
PID 892 wrote to memory of 1496	892	PO.exe	28
PID 892 wrote to memory of 1496	892	PO.exe	28
PID 892 wrote to memory of 1496	892	PO.exe	28
PID 892 wrote to memory of 1496	892	PO.exe	28
PID 892 wrote to memory of 1496	892	PO.exe	28
PID 892 wrote to memory of 1496	892	PO.exe	28
PID 892 wrote to memory of 1496	892	PO.exe	28
PID 892 wrote to memory of 1496	892	PO.exe	28
PID 892 wrote to memory of 1496	892	PO.exe	28

C:\Users\Admin\AppData\Local\Temp\PO.exe
"C:\Users\Admin\AppData\Local\Temp\PO.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892
- C:\Users\Admin\AppData\Local\Temp\PO.exe
  "{path}"
  2⤵
  PID:2040
- C:\Users\Admin\AppData\Local\Temp\PO.exe
  "{path}"
  2⤵
  PID:1496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/892-54-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/892-55-0x0000000074BD0000-0x000000007517B000-memory.dmp

Filesize
5.7MB

Download
memory/1496-56-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1496-57-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1496-59-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1496-60-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1496-61-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1496-64-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1496-66-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1496-68-0x0000000074B60000-0x000000007510B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing