hawkeye_reborn | fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29

Analysis

max time kernel
151s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
24/05/2022, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe
Size 685KB
Sample220524-bkbfrsbcf3
SHA256 fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29
MD5 1363c43fb6f7638ba383efbe641a899f
SHA1 f4a3141b5adcbda77fcc9c1dd6d843f874e39fd1
SHA512 c0ee4c15a4521e23887e02b0d8d077e74f6a3ee68edde7745166c891aa591fcf409d4f82f06f4e4a4225b8bea1fb51d08083b99443286faa3467d15a26ee0694
MD5 SHA1 SHA512

Score

10^/10

hawkeye_reborn keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.1

Credentials

Protocol
smtp
Host
mail.privateemail.com
Port
587
Username
[email protected]
Password
WHYworry??#

Mutex

90e74980-dae1-46fe-a90e-4dc9a4069f3d

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:WHYworry??# _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:90e74980-dae1-46fe-a90e-4dc9a4069f3d _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:false _Version:10.0.0.1 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.1, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/1788-81-0x0000000000444D30-mapping.dmp	WebBrowserPassView
behavioral1/memory/1788-80-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral1/memory/1788-84-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral1/memory/1788-85-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView

Nirsoft 4 IoCs

resource	yara_rule
behavioral1/memory/1788-81-0x0000000000444D30-mapping.dmp	Nirsoft
behavioral1/memory/1788-80-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral1/memory/1788-84-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral1/memory/1788-85-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 1388	1964	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	28
PID 1388 set thread context of 1788	1388	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1788	vbc.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1384	1964	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	26
PID 1964 wrote to memory of 1384	1964	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	26
PID 1964 wrote to memory of 1384	1964	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	26
PID 1964 wrote to memory of 1384	1964	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	26
PID 1964 wrote to memory of 1388	1964	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	28
PID 1964 wrote to memory of 1388	1964	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	28
PID 1964 wrote to memory of 1388	1964	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	28
PID 1964 wrote to memory of 1388	1964	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	28
PID 1964 wrote to memory of 1388	1964	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	28
PID 1964 wrote to memory of 1388	1964	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	28
PID 1964 wrote to memory of 1388	1964	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	28
PID 1964 wrote to memory of 1388	1964	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	28
PID 1964 wrote to memory of 1388	1964	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	28
PID 1388 wrote to memory of 1788	1388	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	30
PID 1388 wrote to memory of 1788	1388	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	30
PID 1388 wrote to memory of 1788	1388	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	30
PID 1388 wrote to memory of 1788	1388	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	30
PID 1388 wrote to memory of 1788	1388	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	30
PID 1388 wrote to memory of 1788	1388	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	30
PID 1388 wrote to memory of 1788	1388	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	30
PID 1388 wrote to memory of 1788	1388	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	30
PID 1388 wrote to memory of 1788	1388	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	30
PID 1388 wrote to memory of 1788	1388	fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe	30

C:\Users\Admin\AppData\Local\Temp\fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe
"C:\Users\Admin\AppData\Local\Temp\fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SSQzgcRwvxXd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7D2C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1384
- C:\Users\Admin\AppData\Local\Temp\fdeffbf985e774fb43983c4c0d9e2d6e64b29e6a1828e8af59cb7fbe990ede29.exe
  "{path}"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpE512.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp7D2C.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp7D2C.tmp
Size 1KB
SHA256 0b5156bf05541997e4668004b79420cce1d3e742210cfa5acea709a9eb83ac31
MD5 27760f9f1b82b9295dbd640b3798b12d
SHA1 6223af19aa2ea2a086b6627822b65de4475d3611
SHA512 28ce8dc56354a0fc8282d7db6bbc1db03023983a093c8dbf831961ca15a0bfea0b739f0c7bc0d472ec22aa23e280d0993423841113f40051b342c427bcd6c50e
MD5 SHA1 SHA512

Submit Download

tmpE512.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpE512.tmp
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1388-66-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/1388-70-0x00000000743E0000-0x000000007498B000-memory.dmp

Download

memory/1388-59-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/1388-61-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/1388-62-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/1388-63-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/1388-58-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/1388-68-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/1788-71-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1788-72-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1788-74-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1788-76-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1788-78-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1788-80-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1788-84-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1788-85-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1964-54-0x00000000756E1000-0x00000000756E3000-memory.dmp

Download

memory/1964-55-0x00000000743E0000-0x000000007498B000-memory.dmp

Download