hawkeye_reborn | 4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83

General

Target

4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe
Size

731KB
MD5

f9b4c8d7604d408aa2ab9110408016e0
SHA1

bbe448cbb25205063bc0ed733872f564c4ca6e4c
SHA256

4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83
SHA512

fc166d3103a8b21381b8367b8fcae781f54af583cb49f901bb777ce0faa67511f5bb6700e6073144923e912d4b0b9adb5ffd2c11e4238a468de66624d42eb1cf

Score

10^/10

hawkeye_reborn collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
VjgwnhMNcvpNv8V

Mutex

ca1faa1a-401d-4169-9a01-bbabe6cbb461

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:VjgwnhMNcvpNv8V _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:60 _MeltFile:false _Mutex:ca1faa1a-401d-4169-9a01-bbabe6cbb461 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:false _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/5076-146-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/5076-148-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/5076-149-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/692-139-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/692-141-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/692-142-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/692-143-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

resource	yara_rule
behavioral2/memory/692-139-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/692-141-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/692-142-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/692-143-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/5076-146-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/5076-148-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/5076-149-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3244 set thread context of 480	3244	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	76
PID 480 set thread context of 692	480	RegSvcs.exe	78
PID 480 set thread context of 5076	480	RegSvcs.exe	79

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
692	vbc.exe
692	vbc.exe
692	vbc.exe
692	vbc.exe
480	RegSvcs.exe
480	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	480	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
480	RegSvcs.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 480	3244	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	76
PID 3244 wrote to memory of 480	3244	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	76
PID 3244 wrote to memory of 480	3244	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	76
PID 3244 wrote to memory of 480	3244	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	76
PID 3244 wrote to memory of 480	3244	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	76
PID 3244 wrote to memory of 480	3244	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	76
PID 3244 wrote to memory of 480	3244	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	76
PID 3244 wrote to memory of 480	3244	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	76
PID 480 wrote to memory of 692	480	RegSvcs.exe	78
PID 480 wrote to memory of 692	480	RegSvcs.exe	78
PID 480 wrote to memory of 692	480	RegSvcs.exe	78
PID 480 wrote to memory of 692	480	RegSvcs.exe	78
PID 480 wrote to memory of 692	480	RegSvcs.exe	78
PID 480 wrote to memory of 692	480	RegSvcs.exe	78
PID 480 wrote to memory of 692	480	RegSvcs.exe	78
PID 480 wrote to memory of 692	480	RegSvcs.exe	78
PID 480 wrote to memory of 692	480	RegSvcs.exe	78
PID 480 wrote to memory of 5076	480	RegSvcs.exe	79
PID 480 wrote to memory of 5076	480	RegSvcs.exe	79
PID 480 wrote to memory of 5076	480	RegSvcs.exe	79
PID 480 wrote to memory of 5076	480	RegSvcs.exe	79
PID 480 wrote to memory of 5076	480	RegSvcs.exe	79
PID 480 wrote to memory of 5076	480	RegSvcs.exe	79
PID 480 wrote to memory of 5076	480	RegSvcs.exe	79
PID 480 wrote to memory of 5076	480	RegSvcs.exe	79
PID 480 wrote to memory of 5076	480	RegSvcs.exe	79

C:\Users\Admin\AppData\Local\Temp\4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe
"C:\Users\Admin\AppData\Local\Temp\4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:480
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp63A7.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:692
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp67BF.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:5076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp63A7.tmp

Filesize
4KB

MD5
3041973ccb7e0bbc2401526abd2c56cf

SHA1
aa5e4138103475f43515114778dded3fe2093df5

SHA256
26448887dcdf4fc71cdb0cc1fc66e181b8be6769f05aa12463c1f915a5a59f94

SHA512
c4957b16ba5c7b9bdb1cf70cea564519024501f83b5b068e81644225aaeedb7f33cd3294c6d1bcd785ad272395f1a63df2f9646242825fc574b3f5563cc1a80d

Download Submit
memory/480-136-0x0000000000590000-0x0000000000620000-memory.dmp

Filesize
576KB

Download
memory/480-150-0x0000000005B90000-0x0000000005B9A000-memory.dmp

Filesize
40KB

Download
memory/480-137-0x0000000009760000-0x0000000009D04000-memory.dmp

Filesize
5.6MB

Download
memory/692-142-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/692-141-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/692-143-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/692-139-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3244-132-0x0000000005660000-0x00000000056FC000-memory.dmp

Filesize
624KB

Download
memory/3244-133-0x0000000005900000-0x0000000005966000-memory.dmp

Filesize
408KB

Download
memory/3244-131-0x0000000005030000-0x00000000050C2000-memory.dmp

Filesize
584KB

Download
memory/3244-130-0x0000000000570000-0x000000000062E000-memory.dmp

Filesize
760KB

Download
memory/5076-146-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5076-148-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5076-149-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing