hawkeye_reborn | 8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d | Triage

Analysis

max time kernel
150s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
01-07-2022 04:01

Sharing

Report Analysis Logs

General

Target

8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
Size

520KB
MD5

e7b08fcae6df3fd74d5002568602dcc8
SHA1

2d9b2af7baf1a4b43c2761d73aa71a3a0f9b538e
SHA256

8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d
SHA512

8ba9f4ddd1baf5e8569a7e72e993b6935faffdffe7737d08711ca47154a5e44903ef032a0e7e5dcdce22c59e153962d0f645af014f1a1cbf18dd3864f0bac5d0

Score

10^/10

hawkeye_reborn keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

Protocol: smtp
Host:
mail.thecencoa.com
Port:
587
Username:
collins@thecencoa.com
Password:
1FE],nt0RnrJFV]q@p

Mutex

8ebc2f9c-2b75-439d-a65a-92ca1f9a0bf7

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:1FE],nt0RnrJFV]q@p _EmailPort:587 _EmailSSL:true _EmailServer:mail.thecencoa.com _EmailUsername:collins@thecencoa.com _ExecutionDelay:20 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:20 _MeltFile:false _Mutex:8ebc2f9c-2b75-439d-a65a-92ca1f9a0bf7 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

Processes:

8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Z4ymm3ispc7E855J\\JCxrUYH1X56e.exe\",explorer.exe"	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe

description	pid	process	target process
PID 1544 set thread context of 1400	1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe

pid	process
1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe

description	pid	process
Token: SeDebugPrivilege	1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
Token: SeDebugPrivilege	1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe

description	pid	process	target process
PID 1544 wrote to memory of 1776	1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
PID 1544 wrote to memory of 1776	1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
PID 1544 wrote to memory of 1776	1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
PID 1544 wrote to memory of 1776	1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
PID 1544 wrote to memory of 1400	1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
PID 1544 wrote to memory of 1400	1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
PID 1544 wrote to memory of 1400	1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
PID 1544 wrote to memory of 1400	1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
PID 1544 wrote to memory of 1400	1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
PID 1544 wrote to memory of 1400	1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
PID 1544 wrote to memory of 1400	1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
PID 1544 wrote to memory of 1400	1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
PID 1544 wrote to memory of 1400	1544	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe	8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe

C:\Users\Admin\AppData\Local\Temp\8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
"C:\Users\Admin\AppData\Local\Temp\8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544

C:\Users\Admin\AppData\Local\Temp\8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
"C:\Users\Admin\AppData\Local\Temp\8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe"
2⤵
PID:1776

C:\Users\Admin\AppData\Local\Temp\8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe
"C:\Users\Admin\AppData\Local\Temp\8f47f3e72baad600c4f9a4ea3f632a68f2f8ec0e562799b72ee73447ec01b17d.exe"
2⤵
PID:1400

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1400-56-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1400-57-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1400-59-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1400-60-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1400-62-0x000000000048B2BE-mapping.dmp

Download
memory/1400-61-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1544-54-0x0000000075721000-0x0000000075723000-memory.dmp

Filesize
8KB

Download
memory/1544-55-0x00000000744D0000-0x0000000074A7B000-memory.dmp

Filesize
5.7MB

Download
memory/1544-64-0x00000000744D0000-0x0000000074A7B000-memory.dmp

Filesize
5.7MB

Download