hawkeye_reborn | 675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd | Triage

Analysis

max time kernel
152s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2022 20:55

Sharing

Report Analysis Logs

General

Target

675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe
Size

615KB
MD5

b508506b4e813de4707a7b809831557c
SHA1

bbf05d0126cafcbf089ee39be24593cae86bc5b6
SHA256

675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd
SHA512

d76786d1c4cf72b43992514585cac47facf9222ba6973f66380d76c888f6c72f387c3c2e1ffa435195e96e7b89e76dc043b889cda4306815f6b2d2d6e074bbc8

Score

10^/10

hawkeye_reborn keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

Protocol: smtp
Host:
mail.thecencoa.com
Port:
587
Username:
emeh@thecencoa.com
Password:
1FE],nt0RnrJFV]q@p

Mutex

1c1b78e9-2b7f-479a-8fb5-510bc5ae2304

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:1FE],nt0RnrJFV]q@p _EmailPort:587 _EmailSSL:true _EmailServer:mail.thecencoa.com _EmailUsername:emeh@thecencoa.com _ExecutionDelay:20 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:20 _MeltFile:false _Mutex:1c1b78e9-2b7f-479a-8fb5-510bc5ae2304 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

Processes:

675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\jAh0Z0oNS1pEixHL\\whd1r7ksPElm.exe\",explorer.exe"	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

35 bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe

description	pid	process	target process
PID 4964 set thread context of 2188	4964	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe

pid	process
4964	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe
4964	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe

description	pid	process
Token: SeDebugPrivilege	4964	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe
Token: SeDebugPrivilege	4964	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe

description	pid	process	target process
PID 4964 wrote to memory of 2188	4964	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe
PID 4964 wrote to memory of 2188	4964	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe
PID 4964 wrote to memory of 2188	4964	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe
PID 4964 wrote to memory of 2188	4964	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe
PID 4964 wrote to memory of 2188	4964	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe
PID 4964 wrote to memory of 2188	4964	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe
PID 4964 wrote to memory of 2188	4964	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe
PID 4964 wrote to memory of 2188	4964	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe	675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe

C:\Users\Admin\AppData\Local\Temp\675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe
"C:\Users\Admin\AppData\Local\Temp\675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964

C:\Users\Admin\AppData\Local\Temp\675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe
"C:\Users\Admin\AppData\Local\Temp\675e58b30dbe6db3e64dd796053d52938dcc0ec4b92b3ff4e591df01c0c9fadd.exe"
2⤵
PID:2188

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-133-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2188-132-0x0000000000000000-mapping.dmp

Download
memory/2188-134-0x0000000074FE0000-0x0000000075591000-memory.dmp

Filesize
5.7MB

Download
memory/2188-135-0x0000000074FE0000-0x0000000075591000-memory.dmp

Filesize
5.7MB

Download
memory/2188-136-0x0000000074FE0000-0x0000000075591000-memory.dmp

Filesize
5.7MB

Download
memory/4964-130-0x0000000074FE0000-0x0000000075591000-memory.dmp

Filesize
5.7MB

Download
memory/4964-131-0x0000000074FE0000-0x0000000075591000-memory.dmp

Filesize
5.7MB

Download