hawkeye_reborn | 56784d0caa833c18d3a8721c7ff2877916436bff9614d334c7e6303e520aa369 | Triage

Analysis

max time kernel
61s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2022, 03:10 UTC

Sharing

Report Analysis Logs

General

Target

56784d0caa833c18d3a8721c7ff2877916436bff9614d334c7e6303e520aa369.exe
Size

2.3MB
MD5

3b34f0a54378d95b2bc464a6504bc302
SHA1

4f81561232b2b829d01b7fecbbebf495ae15c88d
SHA256

56784d0caa833c18d3a8721c7ff2877916436bff9614d334c7e6303e520aa369
SHA512

53afd26ba97f3930c21cc511ac23af8a1c4ded067795122fc0376f220213bf4b98dca8acc8bc6d4e0084d86bce8982be131397291650fe3273bed648a872cc7a

Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.0.5

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
abu@israelimonks.us
Password:
jack@123

Mutex

c5da685c-fa20-4dca-81cd-d90bb902c9f5

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:jack@123 _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:abu@israelimonks.us _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:c5da685c-fa20-4dca-81cd-d90bb902c9f5 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:true _Version:9.0.0.5 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.0.5, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 1 IoCs

Detects M00nD3v Logger payload in memory.

resource	yara_rule
behavioral2/memory/4404-133-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation	56784d0caa833c18d3a8721c7ff2877916436bff9614d334c7e6303e520aa369.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url	56784d0caa833c18d3a8721c7ff2877916436bff9614d334c7e6303e520aa369.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4460 set thread context of 4404	4460	56784d0caa833c18d3a8721c7ff2877916436bff9614d334c7e6303e520aa369.exe	78

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
4524	schtasks.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 4404	4460	56784d0caa833c18d3a8721c7ff2877916436bff9614d334c7e6303e520aa369.exe	78
PID 4460 wrote to memory of 4404	4460	56784d0caa833c18d3a8721c7ff2877916436bff9614d334c7e6303e520aa369.exe	78
PID 4460 wrote to memory of 4404	4460	56784d0caa833c18d3a8721c7ff2877916436bff9614d334c7e6303e520aa369.exe	78
PID 4460 wrote to memory of 4404	4460	56784d0caa833c18d3a8721c7ff2877916436bff9614d334c7e6303e520aa369.exe	78
PID 4460 wrote to memory of 4404	4460	56784d0caa833c18d3a8721c7ff2877916436bff9614d334c7e6303e520aa369.exe	78
PID 4460 wrote to memory of 4524	4460	56784d0caa833c18d3a8721c7ff2877916436bff9614d334c7e6303e520aa369.exe	79
PID 4460 wrote to memory of 4524	4460	56784d0caa833c18d3a8721c7ff2877916436bff9614d334c7e6303e520aa369.exe	79
PID 4460 wrote to memory of 4524	4460	56784d0caa833c18d3a8721c7ff2877916436bff9614d334c7e6303e520aa369.exe	79

C:\Users\Admin\AppData\Local\Temp\56784d0caa833c18d3a8721c7ff2877916436bff9614d334c7e6303e520aa369.exe
"C:\Users\Admin\AppData\Local\Temp\56784d0caa833c18d3a8721c7ff2877916436bff9614d334c7e6303e520aa369.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:4404
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn /tr "C:\Users\Admin\RegAsm\RegAsm.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4524

Network

DNS

bot.whatismyipaddress.com

RegAsm.exe

Remote address:

8.8.8.8:53

Request

bot.whatismyipaddress.com

IN A

Response

20.50.73.10:443

322 B
7
209.197.3.8:80

322 B
7
209.197.3.8:80

322 B
7
209.197.3.8:80

322 B
7

8.8.8.8:53

bot.whatismyipaddress.com

dns

RegAsm.exe

71 B
130 B
1
1

DNS Request

bot.whatismyipaddress.com

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4404-133-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4404-139-0x00000000733D0000-0x0000000073981000-memory.dmp

Filesize
5.7MB

Download
memory/4404-140-0x00000000733D0000-0x0000000073981000-memory.dmp

Filesize
5.7MB

Download
memory/4404-141-0x00000000733D0000-0x0000000073981000-memory.dmp

Filesize
5.7MB

Download