hawkeye_reborn | c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829

Analysis

max time kernel
171s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2022 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe
Size

803KB
MD5

7ee76fb6f3aef651152cc35ec63cce55
SHA1

037f3926469b076d133ffb80a04627b1ce61756a
SHA256

c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829
SHA512

f38a790b14e462887f0fbb362c84b8c38710505ea39ce817bc6e953431a39cc67a2bc010465420bb2bd2ed24c4218e532190682300a988dec69b5407d8eef17b

Score

10^/10

hawkeye_reborn collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

Protocol: smtp
Host:
smtp.emailsrvr.com
Port:
587
Username:
[email protected]
Password:
Comfort123@

Mutex

b2bd680a-11d5-436c-8d57-9b6d23c79b01

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:false _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:Comfort123@ _EmailPort:587 _EmailSSL:true _EmailServer:smtp.emailsrvr.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:10 _MeltFile:false _Mutex:b2bd680a-11d5-436c-8d57-9b6d23c79b01 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2988-148-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/2988-150-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/2988-151-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1232-141-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/1232-143-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/1232-144-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/1232-145-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

resource	yara_rule
behavioral2/memory/1232-141-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/1232-143-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/1232-144-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/1232-145-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/2988-148-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/2988-150-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/2988-151-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 744 set thread context of 828	744	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	85
PID 828 set thread context of 1232	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	86
PID 828 set thread context of 2988	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4368	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1232	vbc.exe
1232	vbc.exe
1232	vbc.exe
1232	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 4368	744	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	83
PID 744 wrote to memory of 4368	744	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	83
PID 744 wrote to memory of 4368	744	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	83
PID 744 wrote to memory of 828	744	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	85
PID 744 wrote to memory of 828	744	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	85
PID 744 wrote to memory of 828	744	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	85
PID 744 wrote to memory of 828	744	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	85
PID 744 wrote to memory of 828	744	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	85
PID 744 wrote to memory of 828	744	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	85
PID 744 wrote to memory of 828	744	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	85
PID 744 wrote to memory of 828	744	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	85
PID 828 wrote to memory of 1232	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	86
PID 828 wrote to memory of 1232	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	86
PID 828 wrote to memory of 1232	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	86
PID 828 wrote to memory of 1232	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	86
PID 828 wrote to memory of 1232	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	86
PID 828 wrote to memory of 1232	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	86
PID 828 wrote to memory of 1232	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	86
PID 828 wrote to memory of 1232	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	86
PID 828 wrote to memory of 1232	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	86
PID 828 wrote to memory of 2988	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	87
PID 828 wrote to memory of 2988	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	87
PID 828 wrote to memory of 2988	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	87
PID 828 wrote to memory of 2988	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	87
PID 828 wrote to memory of 2988	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	87
PID 828 wrote to memory of 2988	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	87
PID 828 wrote to memory of 2988	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	87
PID 828 wrote to memory of 2988	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	87
PID 828 wrote to memory of 2988	828	c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe	87

C:\Users\Admin\AppData\Local\Temp\c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe
"C:\Users\Admin\AppData\Local\Temp\c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LcTjPlRIY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF7AE.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4368
- C:\Users\Admin\AppData\Local\Temp\c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe
  "C:\Users\Admin\AppData\Local\Temp\c3e26900e127c3a77acd2ca2e081835e3fc72bb7aa06f8ead05f8688664e6829.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp2CF7.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1232
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp30FF.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:2988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2CF7.tmp

Filesize
4KB

MD5
8376e754a86cd9a9461b4a4ae2486b11

SHA1
d0e566622882fde386f482f1dcee15b2c7fa5d3a

SHA256
c02f630d99769ab6a71fec1ee712a8c6a97742e5469b4e4157d5ca716e09e62c

SHA512
a1caf85a93499f37d7451bf9b3ef01cbf833e9371585257c009a5de183d072d46a0b8124a8816e0bd94025a5129ad6fb15738f12a865485a3aff07343a14ec6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF7AE.tmp

Filesize
1KB

MD5
3bacecffd1b4051892678de9396b7980

SHA1
202ea921ef885356d25daa7fea7010fa6761ccb1

SHA256
bbfb80e7784f9370e06f764048eac5d2f962d3db08c306d306641389c473b1a9

SHA512
785c49ae4122fe61236ed13b120bed639716ea51310e918c1c42302ae3a0f962044b159d14a052eed4400f5a35c63ca7fa0b63d79c7c9cd8bad97e61c9669eb4

Download Submit
memory/744-135-0x0000000006FC0000-0x0000000007026000-memory.dmp

Filesize
408KB

Download
memory/744-131-0x00000000050E0000-0x0000000005684000-memory.dmp

Filesize
5.6MB

Download
memory/744-134-0x0000000005030000-0x00000000050CC000-memory.dmp

Filesize
624KB

Download
memory/744-130-0x0000000000100000-0x00000000001D0000-memory.dmp

Filesize
832KB

Download
memory/744-133-0x0000000004B80000-0x0000000004B8A000-memory.dmp

Filesize
40KB

Download
memory/744-132-0x0000000004BD0000-0x0000000004C62000-memory.dmp

Filesize
584KB

Download
memory/828-139-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1232-141-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1232-143-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1232-144-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1232-145-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2988-148-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2988-150-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2988-151-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download