hawkeye_reborn | 4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83

General

Target

4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe
Size

731KB
MD5

f9b4c8d7604d408aa2ab9110408016e0
SHA1

bbe448cbb25205063bc0ed733872f564c4ca6e4c
SHA256

4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83
SHA512

fc166d3103a8b21381b8367b8fcae781f54af583cb49f901bb777ce0faa67511f5bb6700e6073144923e912d4b0b9adb5ffd2c11e4238a468de66624d42eb1cf

Score

10^/10

hawkeye_reborn keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
VjgwnhMNcvpNv8V

Mutex

ca1faa1a-401d-4169-9a01-bbabe6cbb461

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:VjgwnhMNcvpNv8V _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:60 _MeltFile:false _Mutex:ca1faa1a-401d-4169-9a01-bbabe6cbb461 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:false _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/2000-69-0x00000000047D0000-0x0000000004846000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 6 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/2000-69-0x00000000047D0000-0x0000000004846000-memory.dmp	WebBrowserPassView
behavioral1/memory/1432-80-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral1/memory/1432-81-0x0000000000444D30-mapping.dmp	WebBrowserPassView
behavioral1/memory/1432-84-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral1/memory/1432-86-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral1/memory/1432-87-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

resource	yara_rule
behavioral1/memory/2000-69-0x00000000047D0000-0x0000000004846000-memory.dmp	Nirsoft
behavioral1/memory/1432-80-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral1/memory/1432-81-0x0000000000444D30-mapping.dmp	Nirsoft
behavioral1/memory/1432-84-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral1/memory/1432-86-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral1/memory/1432-87-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1828 set thread context of 2000	1828	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	28
PID 2000 set thread context of 1432	2000	RegSvcs.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1432	vbc.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 2000	1828	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	28
PID 1828 wrote to memory of 2000	1828	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	28
PID 1828 wrote to memory of 2000	1828	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	28
PID 1828 wrote to memory of 2000	1828	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	28
PID 1828 wrote to memory of 2000	1828	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	28
PID 1828 wrote to memory of 2000	1828	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	28
PID 1828 wrote to memory of 2000	1828	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	28
PID 1828 wrote to memory of 2000	1828	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	28
PID 1828 wrote to memory of 2000	1828	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	28
PID 1828 wrote to memory of 2000	1828	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	28
PID 1828 wrote to memory of 2000	1828	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	28
PID 1828 wrote to memory of 2000	1828	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	28
PID 2000 wrote to memory of 1432	2000	RegSvcs.exe	30
PID 2000 wrote to memory of 1432	2000	RegSvcs.exe	30
PID 2000 wrote to memory of 1432	2000	RegSvcs.exe	30
PID 2000 wrote to memory of 1432	2000	RegSvcs.exe	30
PID 2000 wrote to memory of 1432	2000	RegSvcs.exe	30
PID 2000 wrote to memory of 1432	2000	RegSvcs.exe	30
PID 2000 wrote to memory of 1432	2000	RegSvcs.exe	30
PID 2000 wrote to memory of 1432	2000	RegSvcs.exe	30
PID 2000 wrote to memory of 1432	2000	RegSvcs.exe	30
PID 2000 wrote to memory of 1432	2000	RegSvcs.exe	30

C:\Users\Admin\AppData\Local\Temp\4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe
"C:\Users\Admin\AppData\Local\Temp\4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp2E13.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2E13.tmp

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/1432-71-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1432-72-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1432-76-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1432-74-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1432-87-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1432-78-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1432-86-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1432-84-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1432-80-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1828-57-0x0000000000A50000-0x0000000000A5A000-memory.dmp

Filesize
40KB

Download
memory/1828-54-0x0000000000B60000-0x0000000000C1E000-memory.dmp

Filesize
760KB

Download
memory/1828-56-0x00000000050C0000-0x0000000005160000-memory.dmp

Filesize
640KB

Download
memory/1828-55-0x0000000000490000-0x0000000000498000-memory.dmp

Filesize
32KB

Download
memory/2000-58-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2000-70-0x0000000075C91000-0x0000000075C93000-memory.dmp

Filesize
8KB

Download
memory/2000-69-0x00000000047D0000-0x0000000004846000-memory.dmp

Filesize
472KB

Download
memory/2000-68-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2000-66-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2000-62-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2000-85-0x00000000006A5000-0x00000000006B6000-memory.dmp

Filesize
68KB

Download
memory/2000-63-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2000-61-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2000-59-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing