hawkeye_reborn | f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2 | Triage

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
24-06-2022 22:34

Sharing

Report Analysis Logs

General

Target

f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe
Size

576KB
MD5

565ee01d454290a777200cae2110a72d
SHA1

ba9a1954a2ecff7c7a494fddb8d26bc1c923c230
SHA256

f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2
SHA512

b695b666f5aad98ee54308decb3ac548830176a035769319163039e39c298ca6f05f61b4adaa9125527c06ae9c47b5ec834d1724be286612e45f9b1e93ebb604

Score

10^/10

hawkeye_reborn keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

Protocol: smtp
Host:
mail.thecencoa.com
Port:
587
Username:
emeh@thecencoa.com
Password:
1FE],nt0RnrJFV]q@p

Mutex

0735d024-88ff-4937-90d2-5e29dc136e6b

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:1FE],nt0RnrJFV]q@p _EmailPort:587 _EmailSSL:true _EmailServer:mail.thecencoa.com _EmailUsername:emeh@thecencoa.com _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:20 _MeltFile:false _Mutex:0735d024-88ff-4937-90d2-5e29dc136e6b _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

Processes:

f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\IQ2a8jPFCUt68hN7\\QX32ZeyuB7jK.exe\",explorer.exe"	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

22 bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe

description	pid	process	target process
PID 916 set thread context of 3124	916	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe

pid	process
916	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe
916	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe

description	pid	process
Token: SeDebugPrivilege	916	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe
Token: SeDebugPrivilege	916	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe

description	pid	process	target process
PID 916 wrote to memory of 3124	916	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe
PID 916 wrote to memory of 3124	916	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe
PID 916 wrote to memory of 3124	916	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe
PID 916 wrote to memory of 3124	916	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe
PID 916 wrote to memory of 3124	916	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe
PID 916 wrote to memory of 3124	916	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe
PID 916 wrote to memory of 3124	916	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe
PID 916 wrote to memory of 3124	916	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe	f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe

C:\Users\Admin\AppData\Local\Temp\f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe
"C:\Users\Admin\AppData\Local\Temp\f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916

C:\Users\Admin\AppData\Local\Temp\f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe
"C:\Users\Admin\AppData\Local\Temp\f7e9d1cfd5116f8b834a014cad91c3cf3362423c2ef36dfa65c4c5a95c975fd2.exe"
2⤵
PID:3124

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-130-0x0000000074D50000-0x0000000075301000-memory.dmp

Filesize
5.7MB

Download
memory/916-131-0x0000000074D50000-0x0000000075301000-memory.dmp

Filesize
5.7MB

Download
memory/3124-132-0x0000000000000000-mapping.dmp

Download
memory/3124-133-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/3124-134-0x0000000074D50000-0x0000000075301000-memory.dmp

Filesize
5.7MB

Download
memory/3124-135-0x0000000074D50000-0x0000000075301000-memory.dmp

Filesize
5.7MB

Download
memory/3124-136-0x0000000074D50000-0x0000000075301000-memory.dmp

Filesize
5.7MB

Download