hawkeye_reborn | 0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
23-05-2022 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe
Size

1.1MB
MD5

57891e3ebca46827417e80d42e876903
SHA1

67e316a5690928b6499a5539f18be81d9623a890
SHA256

0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926
SHA512

5b7fd3ffbb2ebb95b39aa653b1bd8d73a9782237b2f500762c49e0e4a6eb6642982fd4046166556baf1a330e2e27c69f055aec0b3ac308906f3ba4fc59e558aa

Score

10^/10

hawkeye_reborn collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.1

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
@qwerty12345

Mutex

c9231530-30df-47c3-9ed0-26e3238a5231

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:@qwerty12345 _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:c9231530-30df-47c3-9ed0-26e3238a5231 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:false _Version:10.0.0.1 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.1, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2300 set thread context of 4692	2300	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	83
PID 4692 set thread context of 4460	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	85
PID 4692 set thread context of 4452	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4460	vbc.exe
4460	vbc.exe
4460	vbc.exe
4460	vbc.exe
4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe
4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 3704	2300	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	78
PID 2300 wrote to memory of 3704	2300	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	78
PID 2300 wrote to memory of 3704	2300	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	78
PID 2300 wrote to memory of 4692	2300	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	83
PID 2300 wrote to memory of 4692	2300	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	83
PID 2300 wrote to memory of 4692	2300	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	83
PID 2300 wrote to memory of 4692	2300	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	83
PID 2300 wrote to memory of 4692	2300	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	83
PID 2300 wrote to memory of 4692	2300	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	83
PID 2300 wrote to memory of 4692	2300	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	83
PID 2300 wrote to memory of 4692	2300	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	83
PID 4692 wrote to memory of 4460	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	85
PID 4692 wrote to memory of 4460	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	85
PID 4692 wrote to memory of 4460	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	85
PID 4692 wrote to memory of 4460	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	85
PID 4692 wrote to memory of 4460	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	85
PID 4692 wrote to memory of 4460	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	85
PID 4692 wrote to memory of 4460	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	85
PID 4692 wrote to memory of 4460	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	85
PID 4692 wrote to memory of 4460	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	85
PID 4692 wrote to memory of 4452	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	86
PID 4692 wrote to memory of 4452	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	86
PID 4692 wrote to memory of 4452	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	86
PID 4692 wrote to memory of 4452	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	86
PID 4692 wrote to memory of 4452	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	86
PID 4692 wrote to memory of 4452	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	86
PID 4692 wrote to memory of 4452	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	86
PID 4692 wrote to memory of 4452	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	86
PID 4692 wrote to memory of 4452	4692	0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe	86

C:\Users\Admin\AppData\Local\Temp\0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe
"C:\Users\Admin\AppData\Local\Temp\0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GANoZxhqS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7ED9.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3704
- C:\Users\Admin\AppData\Local\Temp\0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe
  "{path}"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpFADF.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4460
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpB1D.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:4452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\0ffe5ec768100c95dff7a6546a52e86ca14560a4810aa32bc2530ae50be27926.exe.log

Filesize
496B

MD5
cb76b18ebed3a9f05a14aed43d35fba6

SHA1
836a4b4e351846fca08b84149cb734cb59b8c0d6

SHA256
8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

SHA512
7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7ED9.tmp

Filesize
1KB

MD5
ee0263dac4f3ab67d27b734233cecdc3

SHA1
fa6dc70245e6a3d0352b8a7e7f1d753afda0b9fe

SHA256
f5477c58c87bb71bcec2e3217c40afd1d80363146bab59d1e3fe301d7da04915

SHA512
beb2628987d5827e3271cbec53d4472b732a816c5dd95bf3921f429694ba68ee21b79ad9417a32ecd75fe9b5da9ad40948ed1564894e840afd5e5acb4176e435

Download Submit
memory/2300-130-0x0000000074BC0000-0x0000000075171000-memory.dmp

Filesize
5.7MB

Download
memory/4452-144-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4452-147-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4452-146-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4460-138-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4460-140-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4460-141-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4692-136-0x0000000074BC0000-0x0000000075171000-memory.dmp

Filesize
5.7MB

Download
memory/4692-134-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download