hawkeye_reborn | 4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83

Analysis

max time kernel
153s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe
Size 731KB
Sample220720-ckqq5aade7
SHA256 4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83
MD5 f9b4c8d7604d408aa2ab9110408016e0
SHA1 bbe448cbb25205063bc0ed733872f564c4ca6e4c
SHA512 fc166d3103a8b21381b8367b8fcae781f54af583cb49f901bb777ce0faa67511f5bb6700e6073144923e912d4b0b9adb5ffd2c11e4238a468de66624d42eb1cf
MD5 SHA1 SHA512

Score

10^/10

hawkeye_reborn collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

Protocol
smtp
Host
mail.privateemail.com
Port
587
Username
[email protected]
Password
VjgwnhMNcvpNv8V

Mutex

ca1faa1a-401d-4169-9a01-bbabe6cbb461

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:VjgwnhMNcvpNv8V _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:60 _MeltFile:false _Mutex:ca1faa1a-401d-4169-9a01-bbabe6cbb461 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:false _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/5076-146-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/5076-148-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/5076-149-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/692-139-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/692-141-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/692-142-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/692-143-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

resource	yara_rule
behavioral2/memory/692-139-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/692-141-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/692-142-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/692-143-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/5076-146-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/5076-148-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/5076-149-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3244 set thread context of 480	3244	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	76
PID 480 set thread context of 692	480	RegSvcs.exe	78
PID 480 set thread context of 5076	480	RegSvcs.exe	79

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
692	vbc.exe
692	vbc.exe
692	vbc.exe
692	vbc.exe
480	RegSvcs.exe
480	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	480	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
480	RegSvcs.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 480	3244	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	76
PID 3244 wrote to memory of 480	3244	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	76
PID 3244 wrote to memory of 480	3244	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	76
PID 3244 wrote to memory of 480	3244	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	76
PID 3244 wrote to memory of 480	3244	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	76
PID 3244 wrote to memory of 480	3244	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	76
PID 3244 wrote to memory of 480	3244	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	76
PID 3244 wrote to memory of 480	3244	4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe	76
PID 480 wrote to memory of 692	480	RegSvcs.exe	78
PID 480 wrote to memory of 692	480	RegSvcs.exe	78
PID 480 wrote to memory of 692	480	RegSvcs.exe	78
PID 480 wrote to memory of 692	480	RegSvcs.exe	78
PID 480 wrote to memory of 692	480	RegSvcs.exe	78
PID 480 wrote to memory of 692	480	RegSvcs.exe	78
PID 480 wrote to memory of 692	480	RegSvcs.exe	78
PID 480 wrote to memory of 692	480	RegSvcs.exe	78
PID 480 wrote to memory of 692	480	RegSvcs.exe	78
PID 480 wrote to memory of 5076	480	RegSvcs.exe	79
PID 480 wrote to memory of 5076	480	RegSvcs.exe	79
PID 480 wrote to memory of 5076	480	RegSvcs.exe	79
PID 480 wrote to memory of 5076	480	RegSvcs.exe	79
PID 480 wrote to memory of 5076	480	RegSvcs.exe	79
PID 480 wrote to memory of 5076	480	RegSvcs.exe	79
PID 480 wrote to memory of 5076	480	RegSvcs.exe	79
PID 480 wrote to memory of 5076	480	RegSvcs.exe	79
PID 480 wrote to memory of 5076	480	RegSvcs.exe	79

C:\Users\Admin\AppData\Local\Temp\4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe
"C:\Users\Admin\AppData\Local\Temp\4f6a350db2102e32ea22ce2a194a7077bba6d50b81cf1e914ed25cd5ad30ab83.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:480
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp63A7.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:692
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp67BF.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:5076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp63A7.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp63A7.tmp
Size 4KB
SHA256 26448887dcdf4fc71cdb0cc1fc66e181b8be6769f05aa12463c1f915a5a59f94
MD5 3041973ccb7e0bbc2401526abd2c56cf
SHA1 aa5e4138103475f43515114778dded3fe2093df5
SHA512 c4957b16ba5c7b9bdb1cf70cea564519024501f83b5b068e81644225aaeedb7f33cd3294c6d1bcd785ad272395f1a63df2f9646242825fc574b3f5563cc1a80d
SSDEEP 48:wvvv0azxfvvcazxfdvv0azxBvv0azxakvv0az7:mv9xvlp1v9Pv9bv97
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/480-136-0x0000000000590000-0x0000000000620000-memory.dmp

Download

memory/480-150-0x0000000005B90000-0x0000000005B9A000-memory.dmp

Download

memory/480-137-0x0000000009760000-0x0000000009D04000-memory.dmp

Download

memory/692-142-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/692-139-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/692-143-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/692-141-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/3244-130-0x0000000000570000-0x000000000062E000-memory.dmp

Download

memory/3244-132-0x0000000005660000-0x00000000056FC000-memory.dmp

Download

memory/3244-131-0x0000000005030000-0x00000000050C2000-memory.dmp

Download

memory/3244-133-0x0000000005900000-0x0000000005966000-memory.dmp

Download

memory/5076-146-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5076-148-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5076-149-0x0000000000400000-0x000000000041C000-memory.dmp

Download