hawkeye_reborn | 58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695

Analysis

max time kernel
151s
max time network
111s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
24-07-2022 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe
Size

1.9MB
MD5

58f88590c4b146a7899b5b168422f523
SHA1

58a21249e5326ff2781442206b12123446b40e43
SHA256

58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695
SHA512

b3d4e70078249c46900a516662e644ed832f1016c0d7d5ccb8dc97603c20dc790e1970fb309d02c0b9a9c9e273bb51331b10832bf33d531f0aa0e55e0ed19cc1

Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.0.5

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
youngusd21

Mutex

c87557dc-6bd9-4df8-8fc7-0e9c049de5db

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:youngusd21 _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:c87557dc-6bd9-4df8-8fc7-0e9c049de5db _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:true _Version:9.0.0.5 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.0.5, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 9 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral1/memory/1384-57-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1384-62-0x000000000048B20E-mapping.dmp	m00nd3v_logger
behavioral1/memory/1384-63-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1384-64-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/468-76-0x0000000000090000-0x0000000000120000-memory.dmp	m00nd3v_logger
behavioral1/memory/468-81-0x000000000011B20E-mapping.dmp	m00nd3v_logger
behavioral1/memory/468-83-0x0000000000090000-0x0000000000120000-memory.dmp	m00nd3v_logger
behavioral1/memory/468-82-0x0000000000090000-0x0000000000120000-memory.dmp	m00nd3v_logger
behavioral1/memory/2036-98-0x000000000048B20E-mapping.dmp	m00nd3v_logger

Executes dropped EXE 3 IoCs

pid	Process
1272	altspace.exe
948	altspace.exe
1116	altspace.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	bot.whatismyipaddress.com

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000a00000001233d-70.dat	autoit_exe
behavioral1/files/0x000a00000001233d-72.dat	autoit_exe
behavioral1/files/0x000a00000001233d-89.dat	autoit_exe
behavioral1/files/0x000a00000001233d-106.dat	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2036 set thread context of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	28
PID 1272 set thread context of 468	1272	altspace.exe	34
PID 948 set thread context of 2036	948	altspace.exe	38

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
756	schtasks.exe
824	schtasks.exe
1356	schtasks.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	28
PID 2036 wrote to memory of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	28
PID 2036 wrote to memory of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	28
PID 2036 wrote to memory of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	28
PID 2036 wrote to memory of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	28
PID 2036 wrote to memory of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	28
PID 2036 wrote to memory of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	28
PID 2036 wrote to memory of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	28
PID 2036 wrote to memory of 1384	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	28
PID 2036 wrote to memory of 756	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	29
PID 2036 wrote to memory of 756	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	29
PID 2036 wrote to memory of 756	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	29
PID 2036 wrote to memory of 756	2036	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	29
PID 1860 wrote to memory of 1272	1860	taskeng.exe	33
PID 1860 wrote to memory of 1272	1860	taskeng.exe	33
PID 1860 wrote to memory of 1272	1860	taskeng.exe	33
PID 1860 wrote to memory of 1272	1860	taskeng.exe	33
PID 1272 wrote to memory of 468	1272	altspace.exe	34
PID 1272 wrote to memory of 468	1272	altspace.exe	34
PID 1272 wrote to memory of 468	1272	altspace.exe	34
PID 1272 wrote to memory of 468	1272	altspace.exe	34
PID 1272 wrote to memory of 468	1272	altspace.exe	34
PID 1272 wrote to memory of 468	1272	altspace.exe	34
PID 1272 wrote to memory of 468	1272	altspace.exe	34
PID 1272 wrote to memory of 468	1272	altspace.exe	34
PID 1272 wrote to memory of 468	1272	altspace.exe	34
PID 1272 wrote to memory of 824	1272	altspace.exe	35
PID 1272 wrote to memory of 824	1272	altspace.exe	35
PID 1272 wrote to memory of 824	1272	altspace.exe	35
PID 1272 wrote to memory of 824	1272	altspace.exe	35
PID 1860 wrote to memory of 948	1860	taskeng.exe	37
PID 1860 wrote to memory of 948	1860	taskeng.exe	37
PID 1860 wrote to memory of 948	1860	taskeng.exe	37
PID 1860 wrote to memory of 948	1860	taskeng.exe	37
PID 948 wrote to memory of 2036	948	altspace.exe	38
PID 948 wrote to memory of 2036	948	altspace.exe	38
PID 948 wrote to memory of 2036	948	altspace.exe	38
PID 948 wrote to memory of 2036	948	altspace.exe	38
PID 948 wrote to memory of 2036	948	altspace.exe	38
PID 948 wrote to memory of 2036	948	altspace.exe	38
PID 948 wrote to memory of 2036	948	altspace.exe	38
PID 948 wrote to memory of 2036	948	altspace.exe	38
PID 948 wrote to memory of 2036	948	altspace.exe	38
PID 948 wrote to memory of 1356	948	altspace.exe	39
PID 948 wrote to memory of 1356	948	altspace.exe	39
PID 948 wrote to memory of 1356	948	altspace.exe	39
PID 948 wrote to memory of 1356	948	altspace.exe	39
PID 1860 wrote to memory of 1116	1860	taskeng.exe	41
PID 1860 wrote to memory of 1116	1860	taskeng.exe	41
PID 1860 wrote to memory of 1116	1860	taskeng.exe	41
PID 1860 wrote to memory of 1116	1860	taskeng.exe	41

C:\Users\Admin\AppData\Local\Temp\58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe
"C:\Users\Admin\AppData\Local\Temp\58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:1384
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn LockAppHost /tr "C:\Users\Admin\Narrator\altspace.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:756

C:\Windows\system32\taskeng.exe
taskeng.exe {30AAAFA9-3606-4948-9C24-151798EE26F7} S-1-5-21-3762437355-3468409815-1164039494-1000:TZEOUYSL\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\Narrator\altspace.exe
  C:\Users\Admin\Narrator\altspace.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    PID:468
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn LockAppHost /tr "C:\Users\Admin\Narrator\altspace.exe" /sc minute /mo 1 /F
    3⤵
    - Creates scheduled task(s)
    PID:824
- C:\Users\Admin\Narrator\altspace.exe
  C:\Users\Admin\Narrator\altspace.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    PID:2036
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn LockAppHost /tr "C:\Users\Admin\Narrator\altspace.exe" /sc minute /mo 1 /F
    3⤵
    - Creates scheduled task(s)
    PID:1356
- C:\Users\Admin\Narrator\altspace.exe
  C:\Users\Admin\Narrator\altspace.exe
  2⤵
  - Executes dropped EXE
  PID:1116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Narrator\altspace.exe

Filesize
755KB

MD5
3ac80c9e7153fc9efb4dfbe24bb585ba

SHA1
fa5bdd8a42c9de9f2b405b38fe027cb3067782a3

SHA256
14c8cca92d81c7ec7b241bc1e7c26422e9bdb15213d23fe58fb2fc4249646350

SHA512
523c5a9e4729780d983eb9dc6c70e0338d7a4e9f2d00ac6537ce63dc22a86cce006d26135990e7a5d42cb8649a4d475a0018f8021cc67420927fb2a6b97ac061

Download Submit
C:\Users\Admin\Narrator\altspace.exe

Filesize
1.9MB

MD5
2a46e0b7624f13764803119c7b65a047

SHA1
3ccf828c5abf47332ba05a874fa0da173f738763

SHA256
39105a98591011488c615744fb9d1cd6f4b2f78554ffba1100c9e5b4d008eefd

SHA512
aa99cc78e6897443c8014cb1aebfdb81be996979983c2e8e6b7592995ef7588d67e27b0eb59b844ae7bb0305a5ac840284bb05d4f15301c218724fe45a9954ba

Download Submit
C:\Users\Admin\Narrator\altspace.exe

Filesize
1.9MB

MD5
2a46e0b7624f13764803119c7b65a047

SHA1
3ccf828c5abf47332ba05a874fa0da173f738763

SHA256
39105a98591011488c615744fb9d1cd6f4b2f78554ffba1100c9e5b4d008eefd

SHA512
aa99cc78e6897443c8014cb1aebfdb81be996979983c2e8e6b7592995ef7588d67e27b0eb59b844ae7bb0305a5ac840284bb05d4f15301c218724fe45a9954ba

Download Submit
C:\Users\Admin\Narrator\altspace.exe

Filesize
1.9MB

MD5
2a46e0b7624f13764803119c7b65a047

SHA1
3ccf828c5abf47332ba05a874fa0da173f738763

SHA256
39105a98591011488c615744fb9d1cd6f4b2f78554ffba1100c9e5b4d008eefd

SHA512
aa99cc78e6897443c8014cb1aebfdb81be996979983c2e8e6b7592995ef7588d67e27b0eb59b844ae7bb0305a5ac840284bb05d4f15301c218724fe45a9954ba

Download Submit
memory/468-76-0x0000000000090000-0x0000000000120000-memory.dmp

Filesize
576KB

Download
memory/468-87-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/468-86-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/468-82-0x0000000000090000-0x0000000000120000-memory.dmp

Filesize
576KB

Download
memory/468-83-0x0000000000090000-0x0000000000120000-memory.dmp

Filesize
576KB

Download
memory/1384-67-0x00000000748D0000-0x0000000074E7B000-memory.dmp

Filesize
5.7MB

Download
memory/1384-69-0x00000000748D0000-0x0000000074E7B000-memory.dmp

Filesize
5.7MB

Download
memory/1384-68-0x00000000748D0000-0x0000000074E7B000-memory.dmp

Filesize
5.7MB

Download
memory/1384-64-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1384-57-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1384-63-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1384-55-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2036-103-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/2036-104-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/2036-54-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads