hawkeye_reborn | 26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0

General

Target

26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0.exe
Size

1.2MB
MD5

b5c62f489422f627cff6c315b8556a2f
SHA1

afbef151e8d4037c68c00c51094aadf2d733b136
SHA256

26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0
SHA512

18ec6e684301732d94f018438174939eaf6681328f567a6659a74c380eb389f5510bbbd6c9151276ad1a110c4cd61b6e05f63986b642d7190cf364ced7e97d4d

Score

10^/10

hawkeye_reborn m00nd3v_logger collection infostealer keylogger spyware stealer trojan upx

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

Protocol: smtp
Host:
mail.jointexbd.com
Port:
587
Username:
[email protected]
Password:
Jkwl#2018

Mutex

4f444b86-60f0-4ef5-ac81-fd992cbc807c

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:Jkwl#2018 _EmailPort:587 _EmailSSL:true _EmailServer:mail.jointexbd.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:45 _MeltFile:false _Mutex:4f444b86-60f0-4ef5-ac81-fd992cbc807c _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 5 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral2/memory/3096-135-0x0000000000400000-0x000000000052D000-memory.dmp	m00nd3v_logger
behavioral2/memory/3096-138-0x0000000000B60000-0x0000000000BF0000-memory.dmp	m00nd3v_logger
behavioral2/memory/3096-137-0x0000000000400000-0x000000000052D000-memory.dmp	m00nd3v_logger
behavioral2/memory/3096-136-0x0000000000B60000-0x0000000000BF0000-memory.dmp	m00nd3v_logger
behavioral2/memory/3096-140-0x0000000000400000-0x000000000052D000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3792-152-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/3792-150-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/3792-153-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4332-143-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/4332-145-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/4332-146-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/4332-147-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

resource	yara_rule
behavioral2/memory/4332-143-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/4332-145-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/4332-146-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/4332-147-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/3792-152-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/3792-150-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/3792-153-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Executes dropped EXE 2 IoCs

pid	Process
4596	bobyse.exe
3096	bobyse.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3096-135-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/3096-137-0x0000000000400000-0x000000000052D000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4596 set thread context of 3096	4596	bobyse.exe	84
PID 3096 set thread context of 4332	3096	bobyse.exe	85
PID 3096 set thread context of 3792	3096	bobyse.exe	86

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\bodbof\bobyse.exe:ZoneIdentifier	26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
740	26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0.exe
740	26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0.exe
4596	bobyse.exe
4596	bobyse.exe
4332	vbc.exe
4332	vbc.exe
4332	vbc.exe
4332	vbc.exe
4332	vbc.exe
4332	vbc.exe
4332	vbc.exe
4332	vbc.exe
4332	vbc.exe
4332	vbc.exe
4332	vbc.exe
4332	vbc.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4596	bobyse.exe
4596	bobyse.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 4596	740	26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0.exe	83
PID 740 wrote to memory of 4596	740	26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0.exe	83
PID 740 wrote to memory of 4596	740	26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0.exe	83
PID 4596 wrote to memory of 3096	4596	bobyse.exe	84
PID 4596 wrote to memory of 3096	4596	bobyse.exe	84
PID 4596 wrote to memory of 3096	4596	bobyse.exe	84
PID 3096 wrote to memory of 4332	3096	bobyse.exe	85
PID 3096 wrote to memory of 4332	3096	bobyse.exe	85
PID 3096 wrote to memory of 4332	3096	bobyse.exe	85
PID 3096 wrote to memory of 4332	3096	bobyse.exe	85
PID 3096 wrote to memory of 4332	3096	bobyse.exe	85
PID 3096 wrote to memory of 4332	3096	bobyse.exe	85
PID 3096 wrote to memory of 4332	3096	bobyse.exe	85
PID 3096 wrote to memory of 4332	3096	bobyse.exe	85
PID 3096 wrote to memory of 4332	3096	bobyse.exe	85
PID 3096 wrote to memory of 3792	3096	bobyse.exe	86
PID 3096 wrote to memory of 3792	3096	bobyse.exe	86
PID 3096 wrote to memory of 3792	3096	bobyse.exe	86
PID 3096 wrote to memory of 3792	3096	bobyse.exe	86
PID 3096 wrote to memory of 3792	3096	bobyse.exe	86
PID 3096 wrote to memory of 3792	3096	bobyse.exe	86
PID 3096 wrote to memory of 3792	3096	bobyse.exe	86
PID 3096 wrote to memory of 3792	3096	bobyse.exe	86
PID 3096 wrote to memory of 3792	3096	bobyse.exe	86

C:\Users\Admin\AppData\Local\Temp\26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0.exe
"C:\Users\Admin\AppData\Local\Temp\26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0.exe"
1⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Roaming\bodbof\bobyse.exe
  "C:\Users\Admin\AppData\Roaming\bodbof\bobyse.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Users\Admin\AppData\Roaming\bodbof\bobyse.exe
    "C:\Users\Admin\AppData\Roaming\bodbof\bobyse.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp771F.tmp"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4332
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp7F2F.tmp"
      4⤵
      Accesses Microsoft Outlook accounts
      PID:3792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp771F.tmp

Filesize
4KB

MD5
a44410c464bc23ac615f732de976447c

SHA1
e13bb8bfa077dd78dda795b3c21750f217ba4d36

SHA256
a1a6fab77bd9c6713b610b41cb025ba806b8fd64fb80b862e1c44ab2277545a6

SHA512
15e8af0f65161d9ffe068f10083bb2aebfa9be89a36ca6816853f05b58dd05ea46c5abd2f306a354b6ce9eeab20f26a900c6cf3233553bacf168dcbefb79e31a

Download Submit
C:\Users\Admin\AppData\Roaming\bodbof\bobyse.exe

Filesize
1.2MB

MD5
b5c62f489422f627cff6c315b8556a2f

SHA1
afbef151e8d4037c68c00c51094aadf2d733b136

SHA256
26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0

SHA512
18ec6e684301732d94f018438174939eaf6681328f567a6659a74c380eb389f5510bbbd6c9151276ad1a110c4cd61b6e05f63986b642d7190cf364ced7e97d4d

Download Submit
C:\Users\Admin\AppData\Roaming\bodbof\bobyse.exe

Filesize
1.2MB

MD5
b5c62f489422f627cff6c315b8556a2f

SHA1
afbef151e8d4037c68c00c51094aadf2d733b136

SHA256
26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0

SHA512
18ec6e684301732d94f018438174939eaf6681328f567a6659a74c380eb389f5510bbbd6c9151276ad1a110c4cd61b6e05f63986b642d7190cf364ced7e97d4d

Download Submit
C:\Users\Admin\AppData\Roaming\bodbof\bobyse.exe

Filesize
1.2MB

MD5
b5c62f489422f627cff6c315b8556a2f

SHA1
afbef151e8d4037c68c00c51094aadf2d733b136

SHA256
26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0

SHA512
18ec6e684301732d94f018438174939eaf6681328f567a6659a74c380eb389f5510bbbd6c9151276ad1a110c4cd61b6e05f63986b642d7190cf364ced7e97d4d

Download Submit
memory/3096-140-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/3096-138-0x0000000000B60000-0x0000000000BF0000-memory.dmp

Filesize
576KB

Download
memory/3096-137-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/3096-136-0x0000000000B60000-0x0000000000BF0000-memory.dmp

Filesize
576KB

Download
memory/3096-139-0x0000000074D50000-0x0000000075301000-memory.dmp

Filesize
5.7MB

Download
memory/3096-135-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/3096-141-0x0000000074D50000-0x0000000075301000-memory.dmp

Filesize
5.7MB

Download
memory/3792-152-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3792-150-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3792-153-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4332-143-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4332-145-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4332-146-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4332-147-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing