hawkeye_reborn | 58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695

General

Target

58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe
Size

1.9MB
MD5

58f88590c4b146a7899b5b168422f523
SHA1

58a21249e5326ff2781442206b12123446b40e43
SHA256

58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695
SHA512

b3d4e70078249c46900a516662e644ed832f1016c0d7d5ccb8dc97603c20dc790e1970fb309d02c0b9a9c9e273bb51331b10832bf33d531f0aa0e55e0ed19cc1

Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.0.5

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
youngusd21

Mutex

c87557dc-6bd9-4df8-8fc7-0e9c049de5db

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:youngusd21 _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:c87557dc-6bd9-4df8-8fc7-0e9c049de5db _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:true _Version:9.0.0.5 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.0.5, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 2 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral2/memory/3932-131-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral2/memory/524-143-0x0000000000140000-0x00000000001D0000-memory.dmp	m00nd3v_logger

Executes dropped EXE 2 IoCs

pid	Process
4448	altspace.exe
4696	altspace.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	altspace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	altspace.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	bot.whatismyipaddress.com
11	bot.whatismyipaddress.com
19	bot.whatismyipaddress.com

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000022e6c-140.dat	autoit_exe
behavioral2/files/0x0007000000022e6c-141.dat	autoit_exe
behavioral2/files/0x0007000000022e6c-153.dat	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4100 set thread context of 3932	4100	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	80
PID 4448 set thread context of 524	4448	altspace.exe	84
PID 4696 set thread context of 4892	4696	altspace.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1844	schtasks.exe
3636	schtasks.exe
1924	schtasks.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 3932	4100	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	80
PID 4100 wrote to memory of 3932	4100	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	80
PID 4100 wrote to memory of 3932	4100	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	80
PID 4100 wrote to memory of 3932	4100	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	80
PID 4100 wrote to memory of 3932	4100	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	80
PID 4100 wrote to memory of 1924	4100	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	81
PID 4100 wrote to memory of 1924	4100	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	81
PID 4100 wrote to memory of 1924	4100	58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe	81
PID 4448 wrote to memory of 524	4448	altspace.exe	84
PID 4448 wrote to memory of 524	4448	altspace.exe	84
PID 4448 wrote to memory of 524	4448	altspace.exe	84
PID 4448 wrote to memory of 524	4448	altspace.exe	84
PID 4448 wrote to memory of 524	4448	altspace.exe	84
PID 4448 wrote to memory of 1844	4448	altspace.exe	85
PID 4448 wrote to memory of 1844	4448	altspace.exe	85
PID 4448 wrote to memory of 1844	4448	altspace.exe	85
PID 4696 wrote to memory of 4892	4696	altspace.exe	90
PID 4696 wrote to memory of 4892	4696	altspace.exe	90
PID 4696 wrote to memory of 4892	4696	altspace.exe	90
PID 4696 wrote to memory of 4892	4696	altspace.exe	90
PID 4696 wrote to memory of 4892	4696	altspace.exe	90
PID 4696 wrote to memory of 3636	4696	altspace.exe	91
PID 4696 wrote to memory of 3636	4696	altspace.exe	91
PID 4696 wrote to memory of 3636	4696	altspace.exe	91

C:\Users\Admin\AppData\Local\Temp\58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe
"C:\Users\Admin\AppData\Local\Temp\58bc10f2e64f515c63fb0998d12116d91dbe165cb5c1e656cbd69ed1dc478695.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:3932
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn LockAppHost /tr "C:\Users\Admin\Narrator\altspace.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1924

C:\Users\Admin\Narrator\altspace.exe
C:\Users\Admin\Narrator\altspace.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:524
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn LockAppHost /tr "C:\Users\Admin\Narrator\altspace.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1844

C:\Users\Admin\Narrator\altspace.exe
C:\Users\Admin\Narrator\altspace.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:4892
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn LockAppHost /tr "C:\Users\Admin\Narrator\altspace.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:3636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegAsm.exe.log

Filesize
680B

MD5
8faf48455ffc017246b08e89f6ba1956

SHA1
2f6c39d9828b3f95dc050f52a38cd7d3f543baf8

SHA256
9a643ce75fdfe840ea158010f28f8520bea2a60220494b44a25039a2a318fc35

SHA512
dafd4f1bf894ef1c61ff65dbcb8d5a151b33d8e39f3e354e6e433c8c7c0e8c2105615bffde8d796e361b77ccbe917a70ca4d03cc8cb6396f0495ff9e5b7010a9

Download Submit
C:\Users\Admin\Narrator\altspace.exe

Filesize
1.9MB

MD5
2a46e0b7624f13764803119c7b65a047

SHA1
3ccf828c5abf47332ba05a874fa0da173f738763

SHA256
39105a98591011488c615744fb9d1cd6f4b2f78554ffba1100c9e5b4d008eefd

SHA512
aa99cc78e6897443c8014cb1aebfdb81be996979983c2e8e6b7592995ef7588d67e27b0eb59b844ae7bb0305a5ac840284bb05d4f15301c218724fe45a9954ba

Download Submit
C:\Users\Admin\Narrator\altspace.exe

Filesize
1.9MB

MD5
2a46e0b7624f13764803119c7b65a047

SHA1
3ccf828c5abf47332ba05a874fa0da173f738763

SHA256
39105a98591011488c615744fb9d1cd6f4b2f78554ffba1100c9e5b4d008eefd

SHA512
aa99cc78e6897443c8014cb1aebfdb81be996979983c2e8e6b7592995ef7588d67e27b0eb59b844ae7bb0305a5ac840284bb05d4f15301c218724fe45a9954ba

Download Submit
C:\Users\Admin\Narrator\altspace.exe

Filesize
1.9MB

MD5
2a46e0b7624f13764803119c7b65a047

SHA1
3ccf828c5abf47332ba05a874fa0da173f738763

SHA256
39105a98591011488c615744fb9d1cd6f4b2f78554ffba1100c9e5b4d008eefd

SHA512
aa99cc78e6897443c8014cb1aebfdb81be996979983c2e8e6b7592995ef7588d67e27b0eb59b844ae7bb0305a5ac840284bb05d4f15301c218724fe45a9954ba

Download Submit
memory/524-143-0x0000000000140000-0x00000000001D0000-memory.dmp

Filesize
576KB

Download
memory/524-152-0x0000000073BD0000-0x0000000074181000-memory.dmp

Filesize
5.7MB

Download
memory/524-151-0x0000000073BD0000-0x0000000074181000-memory.dmp

Filesize
5.7MB

Download
memory/524-149-0x0000000073BD0000-0x0000000074181000-memory.dmp

Filesize
5.7MB

Download
memory/3932-131-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/3932-136-0x0000000073B00000-0x00000000740B1000-memory.dmp

Filesize
5.7MB

Download
memory/3932-138-0x0000000073B00000-0x00000000740B1000-memory.dmp

Filesize
5.7MB

Download
memory/3932-139-0x0000000073B00000-0x00000000740B1000-memory.dmp

Filesize
5.7MB

Download
memory/4892-161-0x0000000073B00000-0x00000000740B1000-memory.dmp

Filesize
5.7MB

Download
memory/4892-162-0x0000000073B00000-0x00000000740B1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads