hawkeye_reborn | 26e69d5cea2a00f353bc26191b00fc79d6a697655d3096741a12f96b9a9e2955

General

Target

PO.exe
Size

722KB
MD5

903ca84d60f53ecf1902600beb652c55
SHA1

4e0d56e8b555a6882cfee2132fff4fa81a2c40cc
SHA256

c6043128c116aedacc1be9abbcb74898065374269665a5387960ce47e805c2c0
SHA512

6ac61af0eee49a3596b92e94a36b63f599803183264ba415220c71784d1db691a1170a8c63a0d2cb940559a50a320889a1d70301656aaa38475b7f3a67ab4be6

Score

10^/10

Family

hawkeye_reborn

Version

10.0.0.1

Credentials

Mutex

f98d37f4-ca90-4ed7-9f6f-6121c4014605

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:eagle*qaz _EmailPort:587 _EmailSSL:true _EmailServer:mail.eagleeyeapparels.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:f98d37f4-ca90-4ed7-9f6f-6121c4014605 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.1 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.1, Culture=neutral, PublicKeyToken=null

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 bot.whatismyipaddress.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

PO.exe

description pid process target process

PID 892 set thread context of 1496 892 PO.exe PO.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

PO.exe

pid process

892 PO.exe
892 PO.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PO.exe

description pid process

Token: SeDebugPrivilege 892 PO.exe

flow	ioc
4	bot.whatismyipaddress.com

description	pid	process	target process
PID 892 set thread context of 1496	892	PO.exe	PO.exe

pid	process
892	PO.exe
892	PO.exe

description	pid	process
Token: SeDebugPrivilege	892	PO.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

PO.exe

description	pid	process	target process
PID 892 wrote to memory of 2040	892	PO.exe	PO.exe
PID 892 wrote to memory of 2040	892	PO.exe	PO.exe
PID 892 wrote to memory of 2040	892	PO.exe	PO.exe
PID 892 wrote to memory of 2040	892	PO.exe	PO.exe
PID 892 wrote to memory of 1496	892	PO.exe	PO.exe
PID 892 wrote to memory of 1496	892	PO.exe	PO.exe
PID 892 wrote to memory of 1496	892	PO.exe	PO.exe
PID 892 wrote to memory of 1496	892	PO.exe	PO.exe
PID 892 wrote to memory of 1496	892	PO.exe	PO.exe
PID 892 wrote to memory of 1496	892	PO.exe	PO.exe
PID 892 wrote to memory of 1496	892	PO.exe	PO.exe
PID 892 wrote to memory of 1496	892	PO.exe	PO.exe
PID 892 wrote to memory of 1496	892	PO.exe	PO.exe

memory/892-54-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/892-55-0x0000000074BD0000-0x000000007517B000-memory.dmp

Filesize
5.7MB

Download
memory/1496-56-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1496-57-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1496-59-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1496-60-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1496-61-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1496-62-0x000000000048B39E-mapping.dmp

Download
memory/1496-64-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1496-66-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1496-68-0x0000000074B60000-0x000000007510B000-memory.dmp

Filesize
5.7MB

Download