hawkeye_reborn | 58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695

General

Target

58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe
Size

1.9MB
MD5

58f88590c4b146a7899b5b168422f523
SHA1

58a21249e5326ff2781442206b12123446b40e43
SHA256

58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695
SHA512

b3d4e70078249c46900a516662e644ed832f1016c0d7d5ccb8dc97603c20dc790e1970fb309d02c0b9a9c9e273bb51331b10832bf33d531f0aa0e55e0ed19cc1

Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.0.5

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
mobi@israelimonks.us
Password:
youngusd21

Mutex

c87557dc-6bd9-4df8-8fc7-0e9c049de5db

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:youngusd21 _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:mobi@israelimonks.us _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:c87557dc-6bd9-4df8-8fc7-0e9c049de5db _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:true _Version:9.0.0.5 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.0.5, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 9 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

Processes:

resource	yara_rule
behavioral1/memory/1384-57-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1384-62-0x000000000048B20E-mapping.dmp	m00nd3v_logger
behavioral1/memory/1384-63-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1384-64-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/468-76-0x0000000000090000-0x0000000000120000-memory.dmp	m00nd3v_logger
behavioral1/memory/468-81-0x000000000011B20E-mapping.dmp	m00nd3v_logger
behavioral1/memory/468-83-0x0000000000090000-0x0000000000120000-memory.dmp	m00nd3v_logger
behavioral1/memory/468-82-0x0000000000090000-0x0000000000120000-memory.dmp	m00nd3v_logger
behavioral1/memory/2036-98-0x000000000048B20E-mapping.dmp	m00nd3v_logger

Executes dropped EXE 3 IoCs

Processes:

altspace.exealtspace.exealtspace.exe

pid process

1272 altspace.exe
948 altspace.exe
1116 altspace.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 bot.whatismyipaddress.com

pid	process
1272	altspace.exe
948	altspace.exe
1116	altspace.exe

flow	ioc
3	bot.whatismyipaddress.com

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\Narrator\altspace.exe	autoit_exe
C:\Users\Admin\Narrator\altspace.exe	autoit_exe
C:\Users\Admin\Narrator\altspace.exe	autoit_exe
C:\Users\Admin\Narrator\altspace.exe	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exealtspace.exealtspace.exe

description	pid	process	target process
PID 2036 set thread context of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	RegAsm.exe
PID 1272 set thread context of 468	1272	altspace.exe	RegAsm.exe
PID 948 set thread context of 2036	948	altspace.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

756 schtasks.exe
824 schtasks.exe
1356 schtasks.exe

pid	process
756	schtasks.exe
824	schtasks.exe
1356	schtasks.exe

Suspicious use of WriteProcessMemory 51 IoCs

Processes:

58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exetaskeng.exealtspace.exealtspace.exe

description	pid	process	target process
PID 2036 wrote to memory of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	RegAsm.exe
PID 2036 wrote to memory of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	RegAsm.exe
PID 2036 wrote to memory of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	RegAsm.exe
PID 2036 wrote to memory of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	RegAsm.exe
PID 2036 wrote to memory of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	RegAsm.exe
PID 2036 wrote to memory of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	RegAsm.exe
PID 2036 wrote to memory of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	RegAsm.exe
PID 2036 wrote to memory of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	RegAsm.exe
PID 2036 wrote to memory of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	RegAsm.exe
PID 2036 wrote to memory of 756	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	schtasks.exe
PID 2036 wrote to memory of 756	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	schtasks.exe
PID 2036 wrote to memory of 756	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	schtasks.exe
PID 2036 wrote to memory of 756	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	schtasks.exe
PID 1860 wrote to memory of 1272	1860	taskeng.exe	altspace.exe
PID 1860 wrote to memory of 1272	1860	taskeng.exe	altspace.exe
PID 1860 wrote to memory of 1272	1860	taskeng.exe	altspace.exe
PID 1860 wrote to memory of 1272	1860	taskeng.exe	altspace.exe
PID 1272 wrote to memory of 468	1272	altspace.exe	RegAsm.exe
PID 1272 wrote to memory of 468	1272	altspace.exe	RegAsm.exe
PID 1272 wrote to memory of 468	1272	altspace.exe	RegAsm.exe
PID 1272 wrote to memory of 468	1272	altspace.exe	RegAsm.exe
PID 1272 wrote to memory of 468	1272	altspace.exe	RegAsm.exe
PID 1272 wrote to memory of 468	1272	altspace.exe	RegAsm.exe
PID 1272 wrote to memory of 468	1272	altspace.exe	RegAsm.exe
PID 1272 wrote to memory of 468	1272	altspace.exe	RegAsm.exe
PID 1272 wrote to memory of 468	1272	altspace.exe	RegAsm.exe
PID 1272 wrote to memory of 824	1272	altspace.exe	schtasks.exe
PID 1272 wrote to memory of 824	1272	altspace.exe	schtasks.exe
PID 1272 wrote to memory of 824	1272	altspace.exe	schtasks.exe
PID 1272 wrote to memory of 824	1272	altspace.exe	schtasks.exe
PID 1860 wrote to memory of 948	1860	taskeng.exe	altspace.exe
PID 1860 wrote to memory of 948	1860	taskeng.exe	altspace.exe
PID 1860 wrote to memory of 948	1860	taskeng.exe	altspace.exe
PID 1860 wrote to memory of 948	1860	taskeng.exe	altspace.exe
PID 948 wrote to memory of 2036	948	altspace.exe	RegAsm.exe
PID 948 wrote to memory of 2036	948	altspace.exe	RegAsm.exe
PID 948 wrote to memory of 2036	948	altspace.exe	RegAsm.exe
PID 948 wrote to memory of 2036	948	altspace.exe	RegAsm.exe
PID 948 wrote to memory of 2036	948	altspace.exe	RegAsm.exe
PID 948 wrote to memory of 2036	948	altspace.exe	RegAsm.exe
PID 948 wrote to memory of 2036	948	altspace.exe	RegAsm.exe
PID 948 wrote to memory of 2036	948	altspace.exe	RegAsm.exe
PID 948 wrote to memory of 2036	948	altspace.exe	RegAsm.exe
PID 948 wrote to memory of 1356	948	altspace.exe	schtasks.exe
PID 948 wrote to memory of 1356	948	altspace.exe	schtasks.exe
PID 948 wrote to memory of 1356	948	altspace.exe	schtasks.exe
PID 948 wrote to memory of 1356	948	altspace.exe	schtasks.exe
PID 1860 wrote to memory of 1116	1860	taskeng.exe	altspace.exe
PID 1860 wrote to memory of 1116	1860	taskeng.exe	altspace.exe
PID 1860 wrote to memory of 1116	1860	taskeng.exe	altspace.exe
PID 1860 wrote to memory of 1116	1860	taskeng.exe	altspace.exe

C:\Users\Admin\AppData\Local\Temp\58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe
"C:\Users\Admin\AppData\Local\Temp\58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
PID:1384

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn LockAppHost /tr "C:\Users\Admin\Narrator\altspace.exe" /sc minute /mo 1 /F
2⤵
- Creates scheduled task(s)
PID:756

C:\Windows\system32\taskeng.exe
taskeng.exe {30AAAFA9-3606-4948-9C24-151798EE26F7} S-1-5-21-3762437355-3468409815-1164039494-1000:TZEOUYSL\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1860

C:\Users\Admin\Narrator\altspace.exe
C:\Users\Admin\Narrator\altspace.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
3⤵
PID:468

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn LockAppHost /tr "C:\Users\Admin\Narrator\altspace.exe" /sc minute /mo 1 /F
3⤵
- Creates scheduled task(s)
PID:824

C:\Users\Admin\Narrator\altspace.exe
C:\Users\Admin\Narrator\altspace.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
3⤵
PID:2036

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn LockAppHost /tr "C:\Users\Admin\Narrator\altspace.exe" /sc minute /mo 1 /F
3⤵
- Creates scheduled task(s)
PID:1356

C:\Users\Admin\Narrator\altspace.exe
C:\Users\Admin\Narrator\altspace.exe
2⤵
- Executes dropped EXE
PID:1116

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Narrator\altspace.exe
Filesize
755KB

MD5
3ac80c9e7153fc9efb4dfbe24bb585ba

SHA1
fa5bdd8a42c9de9f2b405b38fe027cb3067782a3

SHA256
14c8cca92d81c7ec7b241bc1e7c26422e9bdb15213d23fe58fb2fc4249646350

SHA512
523c5a9e4729780d983eb9dc6c70e0338d7a4e9f2d00ac6537ce63dc22a86cce006d26135990e7a5d42cb8649a4d475a0018f8021cc67420927fb2a6b97ac061

Download Submit
C:\Users\Admin\Narrator\altspace.exe
Filesize
1.9MB

MD5
2a46e0b7624f13764803119c7b65a047

SHA1
3ccf828c5abf47332ba05a874fa0da173f738763

SHA256
39105a98591011488c615744fb9d1cd6f4b2f78554ffba1100c9e5b4d008eefd

SHA512
aa99cc78e6897443c8014cb1aebfdb81be996979983c2e8e6b7592995ef7588d67e27b0eb59b844ae7bb0305a5ac840284bb05d4f15301c218724fe45a9954ba

Download Submit
C:\Users\Admin\Narrator\altspace.exe
Filesize
1.9MB

MD5
2a46e0b7624f13764803119c7b65a047

SHA1
3ccf828c5abf47332ba05a874fa0da173f738763

SHA256
39105a98591011488c615744fb9d1cd6f4b2f78554ffba1100c9e5b4d008eefd

SHA512
aa99cc78e6897443c8014cb1aebfdb81be996979983c2e8e6b7592995ef7588d67e27b0eb59b844ae7bb0305a5ac840284bb05d4f15301c218724fe45a9954ba

Download Submit
C:\Users\Admin\Narrator\altspace.exe
Filesize
1.9MB

MD5
2a46e0b7624f13764803119c7b65a047

SHA1
3ccf828c5abf47332ba05a874fa0da173f738763

SHA256
39105a98591011488c615744fb9d1cd6f4b2f78554ffba1100c9e5b4d008eefd

SHA512
aa99cc78e6897443c8014cb1aebfdb81be996979983c2e8e6b7592995ef7588d67e27b0eb59b844ae7bb0305a5ac840284bb05d4f15301c218724fe45a9954ba

Download Submit
memory/468-81-0x000000000011B20E-mapping.dmp

Download
memory/468-76-0x0000000000090000-0x0000000000120000-memory.dmp

Filesize
576KB

Download
memory/468-87-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/468-86-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/468-82-0x0000000000090000-0x0000000000120000-memory.dmp

Filesize
576KB

Download
memory/468-83-0x0000000000090000-0x0000000000120000-memory.dmp

Filesize
576KB

Download
memory/756-66-0x0000000000000000-mapping.dmp

Download
memory/824-85-0x0000000000000000-mapping.dmp

Download
memory/948-88-0x0000000000000000-mapping.dmp

Download
memory/1116-105-0x0000000000000000-mapping.dmp

Download
memory/1272-71-0x0000000000000000-mapping.dmp

Download
memory/1356-102-0x0000000000000000-mapping.dmp

Download
memory/1384-67-0x00000000748D0000-0x0000000074E7B000-memory.dmp

Filesize
5.7MB

Download
memory/1384-69-0x00000000748D0000-0x0000000074E7B000-memory.dmp

Filesize
5.7MB

Download
memory/1384-68-0x00000000748D0000-0x0000000074E7B000-memory.dmp

Filesize
5.7MB

Download
memory/1384-62-0x000000000048B20E-mapping.dmp

Download
memory/1384-64-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1384-57-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1384-63-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1384-55-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2036-98-0x000000000048B20E-mapping.dmp

Download
memory/2036-103-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/2036-104-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/2036-54-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads