hawkeye_reborn | b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3 | Triage

Analysis

max time kernel
187s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
01-07-2022 07:12

Sharing

Report Analysis Logs

General

Target

b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
Size

494KB
MD5

552c4ca73a5a5ad104651f99a0486061
SHA1

6e7d2d31adba4130f630f02e162c16172a9b33c5
SHA256

b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3
SHA512

01c0522d8dcf7b7d1d4adea9ce3ea8afc489815436e5d31192abe691ea581a29944266e378380ea8f3a27c1a6c132b8e44d87f34500976edc012a726b5a6c18b

Score

10^/10

hawkeye_reborn keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

Protocol: smtp
Host:
mail.thecencoa.com
Port:
587
Username:
amani@thecencoa.com
Password:
1FE],nt0RnrJFV]q@p

Mutex

b309f5e6-ddc0-4879-8d0c-bf32ec076951

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:1FE],nt0RnrJFV]q@p _EmailPort:587 _EmailSSL:true _EmailServer:mail.thecencoa.com _EmailUsername:amani@thecencoa.com _ExecutionDelay:20 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:20 _MeltFile:false _Mutex:b309f5e6-ddc0-4879-8d0c-bf32ec076951 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

Processes:

b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\BX8q1QX4WcDGgAb8\\ar4BQWMXckBt.exe\",explorer.exe"	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

40 bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe

description	pid	process	target process
PID 4516 set thread context of 4796	4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe

pid	process
4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe

description	pid	process
Token: SeDebugPrivilege	4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
Token: SeDebugPrivilege	4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe

description	pid	process	target process
PID 4516 wrote to memory of 4736	4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
PID 4516 wrote to memory of 4736	4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
PID 4516 wrote to memory of 4736	4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
PID 4516 wrote to memory of 2600	4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
PID 4516 wrote to memory of 2600	4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
PID 4516 wrote to memory of 2600	4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
PID 4516 wrote to memory of 4796	4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
PID 4516 wrote to memory of 4796	4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
PID 4516 wrote to memory of 4796	4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
PID 4516 wrote to memory of 4796	4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
PID 4516 wrote to memory of 4796	4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
PID 4516 wrote to memory of 4796	4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
PID 4516 wrote to memory of 4796	4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
PID 4516 wrote to memory of 4796	4516	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe	b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe

C:\Users\Admin\AppData\Local\Temp\b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
"C:\Users\Admin\AppData\Local\Temp\b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516

C:\Users\Admin\AppData\Local\Temp\b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
"C:\Users\Admin\AppData\Local\Temp\b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe"
2⤵
PID:4796

C:\Users\Admin\AppData\Local\Temp\b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
"C:\Users\Admin\AppData\Local\Temp\b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe"
2⤵
PID:2600

C:\Users\Admin\AppData\Local\Temp\b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe
"C:\Users\Admin\AppData\Local\Temp\b7dcef4382414c6e6f7a7ff17e3da86493f93dd12e9dd906128f5781e03803a3.exe"
2⤵
PID:4736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2600-132-0x0000000000000000-mapping.dmp

Download
memory/4516-130-0x0000000074A60000-0x0000000075011000-memory.dmp

Filesize
5.7MB

Download
memory/4516-136-0x0000000074A60000-0x0000000075011000-memory.dmp

Filesize
5.7MB

Download
memory/4736-131-0x0000000000000000-mapping.dmp

Download
memory/4796-134-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4796-133-0x0000000000000000-mapping.dmp

Download
memory/4796-135-0x0000000074A60000-0x0000000075011000-memory.dmp

Filesize
5.7MB

Download
memory/4796-137-0x0000000074A60000-0x0000000075011000-memory.dmp

Filesize
5.7MB

Download
memory/4796-138-0x0000000074A60000-0x0000000075011000-memory.dmp

Filesize
5.7MB

Download